Azernews.Az

Apple has made significant concessions to the UK government by disabling the Advanced Data Protection (ADP) feature in iCloud for users in the United Kingdom. This move, which occurred last week, has raised serious concerns among cybersecurity and data protection experts, as it could set a concerning precedent for other countries seeking access to encrypted user information, Azernews reports.

Despite positioning itself as a strong defender of user privacy, Apple complied with the demands of the British authorities under the Investigatory Powers Act (IPA) of 2016. This law grants the UK government the power to compel companies to provide user data for national security and crime prevention purposes. The UK government issued a "technical capability notice" to Apple, demanding the creation of a backdoor in iCloud. This is not about hacking individual accounts but about granting the government "full access to view fully encrypted materials."

The changes made to the IPA in April 2024 have further expanded the surveillance powers of British intelligence agencies, enabling them to access large amounts of personal data stored by third parties and to interfere with companies using various encryption protocols.

British Interior Minister Dan Jarvis stated that the "notification of technical capabilities" does not require companies to disclose specific information but obliges them to "be able to respond to an individual warrant or permit." In essence, the authorities want to undermine technologies such as full end-to-end encryption, which ensures that only users have access to their encrypted data. This would prevent British intelligence agencies from being unable to conduct surveillance when needed.

According to The Verge, this requirement for Apple marks the first such case since the update to the IPA last year. The law prohibits companies from publicly confirming or denying the receipt of such notifications, effectively making the UK’s efforts to weaken data encryption largely invisible. Apple can appeal the decision, but it cannot disclose the existence of this request or any actions taken in response. Information about Apple's compliance was revealed through a leak to The Washington Post.

Following the article in The Washington Post, Apple silently disabled the ADP feature for UK users, without offering a public explanation. The ADP feature extended end-to-end encryption, previously applied to passwords, health data, and payment information, to iCloud Drive data, backups, notes, photos, voice memos, and more.

Andrew Crocker, director of surveillance litigation at the Electronic Frontier Foundation (EFF), told The Verge that "the UK government has put Apple in a difficult position by requiring a backdoor into iCloud end-to-end encryption for users around the world." In his view, Apple's decision to disable the feature for UK users may have been the only reasonable response to the situation, but it leaves UK users vulnerable to breaches and deprives them of a vital privacy protection technology.

Experts are concerned that the UK’s actions could signal a dangerous precedent for other governments seeking to weaken encryption and gain greater control over user data. If more governments follow suit, this could lead to a significant reduction in the level of protection for personal information on a global scale. The implications of this move are far-reaching, as it risks eroding trust in digital platforms and potentially undermining the security of millions of users worldwide.