UK demands access to Apple users' encrypted data

[Leptons]

bmwmike said:

It'll never happen. It's so ridiculously blinkered that it's pointless, even if apple agreed to it, which they won't.

This aged well.

[130R]

Strangely Brown said:

130R said:

Strangely Brown said:

130R said:

Apple just removed end-to-end encryption for the UK. So the government have successfully weakened online security / privacy for all UK based users. Great job.

No, they didn't.

They removed ADP for new users (existing users later). ADP only applies to a limited set of data categories that the majority of users were not using anyway as it was optional and had to switched on. The "important stuff" is still end-to-end encrypted.

Yes they did ..

ADP is end-to-end encryption for iCloud data like backups, photos, notes, etc. With standard data protection that iCloud data is encrypted but the encryption keys are stored by Apple.

No, they fking didn't. End-to-end encryption still exists so they did NOT "remove end-to-end encryption for the UK" as you claimed. They have removed end-to-end encryption for some categories of data where it is stored on Apple servers.
Messages, Health etc and the important personal stuff is still as it was.

You're arguing over semantics. That's exactly what I said in the second message above. Also a lot of the data under ADP, like iCloud Drive, is "important personal stuff" ..

[bmwmike]

Leptons said:

bmwmike said:

It'll never happen. It's so ridiculously blinkered that it's pointless, even if apple agreed to it, which they won't.

This aged well.

Well, in fairness I was referring to apple ceding to the UK government requests to add backdoors. Which has not happened and never will. So, yes, it has aged well.

[ATG]

Evanivitch said:

Unless the government makes non-compliant AES256 tools illegal to distribute in the UK...

But people who are intent on breaking the law to commit acts of terrorism or distribute donkey porn aren't going to be quaking in their boots at the thought of using a VPN to download some encryption tools.

[Murph7355]

Evanivitch said:

I use commercial, government approved, AES256 encryption software as part of my work, because the government tells me I have to.

So if you could explain what MOD will require contractors to do in future that would be much appreciated, because right now it looks like the whole defence industry will need MODNET laptops from Monday...

I would imagine they'll tell you to keep doing what you're doing because they'll have access to the keys for your work stuff and with all the vetting the risks of you having kiddie porn or other illegal stuff on your work device are likely small?

Of course if you're using similar for nefarious means, I imagine they might have different words with you?

(Am also assuming you're not using Apple devices and their built in security to rely on solidity for your work. But then with the muppets in govt, maybe they do?)

Evanivitch said:

So you don't care about your personal data (encrypted by law under GDPR) or banking details being at risk. Righto.

Which of my data has to be encrypted by law under GDPR is impacted by what Apple have been asked to do? Is all my banking data now unencrypted? And, pretty importantly in the circumstances, can the authorities go and ask my bank manager for ALL my details and respond with a shrug saying "sorry copper, no can do, we don't have the ability to do this".

Righto.

InitialDave said:

It's not the government surveillance angle that's the direct problem with an engineered in back door in an encryption or other system (though you shouldn't be blasé about such a thing anyway).

It's that once said back door exists, it can be used by basically anyone.

Indeed. Though for the data categories this applies to, so what?

Plus, one assumes Apple take great care over such things and won't ever let things get compromised with their super-good value devices and services..... (Applies to all the big providers btw, I'm not anti-Apple. I'm sure the same will apply to Google)

ATG said:

They won't be able to do any of that because all of that data will still be properly encrypted. It doesn't matter what Apple does. You can encrypt the data BEFORE you send it to Apple. Stopping Apple from providing end to end encryption is a minor inconvenience for anyone who wants to store or communicate data privately. If Apple put a backdoor in their own E2E encryption layer, then it ain't E2E encryption anymore. The service becomes pointless so they're withdrawing it. It is now fractionally more inconvenient to send encrypted data, that's all.

Adding friction to those who will do dodgy things with it isn't an issue I'm bothered about. As I noted, I know it won't stop the worst of it. I don't think that's anybody's aim tbh. Stopping some will do.

I also suspect that any legal case will be (marginally or not) easier if the person being investigated is found to be encrypting things before sending via an encrypted channel...it's an affirmative action to hide rather than a "ooh sorry, I didn't know it was all encrypted for me when I lost the key, I'd have loved to help".

ATG said:

With open source tools as simple to use and install as 7-zip, the harder life is made for commercial software vendors, the more users will become incentivised to discover and use open source alternatives. Ultimately you can't make people unlearn maths in much the same way that you can't force people to forget how guns work.

Maybe we should just open up gun laws then? Or allow people to make their own still? Or any number of other things that people cannot unsee? (I am facetiously using the North Korea argument in reverse here).

I very much doubt the hardcore kiddie fiddlers are relying on Apple's devices and infrastructures to do the worst of their trade. So this does not cover them, and I doubt it's intended to.

It's not beyond logic that a lot of the casual st that goes on may well be, due to the ubiquitous nature of the devices. (WhatsApp's another, non-Apple focused, example). And this may make that much easier to prosecute. Happy days.

Maybe there is a case for licensed 256-bit tools. (After all, defence contractors need them ). And whilst open-source exists, maybe there's a case for if you're found to be using it/unlicensed tools it will see you in deep st (more than a few weeks away) should your collar ever be felt. After all, if there's a licensed and legal need to use it (just like guns) then there's an avenue for that. But it's not one that allows you to do anything you damn well like without consequence. (And yes, criminals still do bad things with guns. I know).

[bmwmike]

What is with the references to aes256 specifically?. Have ukgov said they're banning AES or something?

[Evanivitch]

Murph7355 said:

Evanivitch said:

I use commercial, government approved, AES256 encryption software as part of my work, because the government tells me I have to.

So if you could explain what MOD will require contractors to do in future that would be much appreciated, because right now it looks like the whole defence industry will need MODNET laptops from Monday...

I would imagine they'll tell you to keep doing what you're doing because they'll have access to the keys for your work stuff and with all the vetting the risks of you having kiddie porn or other illegal stuff on your work device are likely small?

Of course if you're using similar for nefarious means, I imagine they might have different words with you?

(Am also assuming you're not using Apple devices and their built in security to rely on solidity for your work. But then with the muppets in govt, maybe they do?)

Evanivitch said:

So you don't care about your personal data (encrypted by law under GDPR) or banking details being at risk. Righto.

Which of my data has to be encrypted by law under GDPR is impacted by what Apple have been asked to do? Is all my banking data now unencrypted? And, pretty importantly in the circumstances, can the authorities go and ask my bank manager for ALL my details and respond with a shrug saying "sorry copper, no can do, we don't have the ability to do this".

Righto.

Why are you assuming this stops at apple? What part of the legislation says "Apple"?

Apple have avoided this by simply turning off the option of protection and not providing a backdoor. So when people start using secondary encryption, where does the government go next? Winzip? Bitlocker?

This isn't paranoia, it's the natural progression of a policy that started in 2013.

And to add, no the governent doesn't have access to the keys of the stuff that is sent using encryption.

https://www.gov.uk/government/publications/industr...

https://www.google.com/url?sa=t&source=web&amp...

Edited by Evanivitch on Sunday 23 February 07:25

[Paft Dunk]

I’ve always (simply) assumed that the prime target of this is the iPhone backup files encrypted with ADP. Once that is accessible the surely all the other data is accessible by whomever was able to restore (or open) the backup file. This isn’t being done on a whim, I assume security services are hitting issues with accessing some data types and this is one of them.

I tuned on ADP as soon as it was available. My data, can do what I want with it.

I also encrypt everything in Dropbox as well, with my own keys. So I assume all the terrorists storing their nefarious plans in iCloud can just move to Dropbox now.

Ridiculous weakening of security.

[768]

Murph7355 said:

I also suspect that any legal case will be (marginally or not) easier if the person being investigated is found to be encrypting things before sending via an encrypted channel...it's an affirmative action to hide rather than a "ooh sorry, I didn't know it was all encrypted for me when I lost the key, I'd have loved to help".

How are they going to know? That only works if the encryption is useless.

This stuff is binary, we can protect confidentiality using encryption, or we can't.

What are they going to do about it when some widely installed software, or a worm, whatever, decides to encrypt some data on every machine and delete the key? Arrest everyone that then has backups switched on? Arrest you when it's embedded in an image on this forum?

Edited by 768 on Sunday 23 February 07:28

[Murph7355]

Evanivitch said:

Why are you assuming this stops at apple? What part of the legislation says "Apple"?
...

This isn't paranoia, it's the natural progression of a policy that started in 2013....

I'm not assuming it stops at Apple. I know it will and should apply to them all. Thought I'd said that. Maybe that was in the duplicate NP&E thread.

As for paranoia...govts have been incredibly poor at keeping legislation up with technology advances. It seems they are trying to catch up. Fair enough.

Some (most I've seen thus far) of the arguments are very much paranoia.

768 said:

Murph7355 said:

I also suspect that any legal case will be (marginally or not) easier if the person being investigated is found to be encrypting things before sending via an encrypted channel...it's an affirmative action to hide rather than a "ooh sorry, I didn't know it was all encrypted for me when I lost the key, I'd have loved to help".

How are they going to know? That only works if the encryption is useless.

This stuff is binary, we can protect confidentiality using encryption, or we can't.

What are they going to do about it when some widely installed software, or a worm, whatever, decides to encrypt some data on every machine and delete the key? Arrest everyone that then has backups switched on? Arrest you when it's embedded in an image on this forum?

How are they going to know data has been encrypted? Errrrrrm.

If there are widespread encryption attacks then they're generally known about and can be accounted for.

Sitting on hands because no approach is perfect is daft. It will evolve. But to evolve, moves have to be made. Some will be missteps. Some will take things in the right direction. That is how progress will be made.

Modern technology makes it very easy to distribute godawful st to far more people far more quickly. Shrugging and saying "but my bank details will be compromised" (when they won't) is not the answer. It's tech nerds admiring the problem and an innate desire for perfection when perfection doesn't exist (even and especially in the arguments put forward not to progress).

[768]

Murph7355 said:

768 said:

Murph7355 said:

I also suspect that any legal case will be (marginally or not) easier if the person being investigated is found to be encrypting things before sending via an encrypted channel...it's an affirmative action to hide rather than a "ooh sorry, I didn't know it was all encrypted for me when I lost the key, I'd have loved to help".

How are they going to know? That only works if the encryption is useless.

This stuff is binary, we can protect confidentiality using encryption, or we can't.

What are they going to do about it when some widely installed software, or a worm, whatever, decides to encrypt some data on every machine and delete the key? Arrest everyone that then has backups switched on? Arrest you when it's embedded in an image on this forum?

How are they going to know data has been encrypted? Errrrrrm.

No, encrypted twice. Although that's not an unreasonable point; how can you tell if you're looking at encrypted data for which someone must have a key, or a file with random noise?

Murph7355 said:

It's tech nerds admiring the problem and an innate desire for perfection when perfection doesn't exist (even and especially in the arguments put forward not to progress).

It's tech nerds understanding that you have a zero or one.

[andyb28]

Paft Dunk said:

I’ve always (simply) assumed that the prime target of this is the iPhone backup files encrypted with ADP. Once that is accessible the surely all the other data is accessible by whomever was able to restore (or open) the backup file. This isn’t being done on a whim, I assume security services are hitting issues with accessing some data types and this is one of them.

I tuned on ADP as soon as it was available. My data, can do what I want with it.

I also encrypt everything in Dropbox as well, with my own keys. So I assume all the terrorists storing their nefarious plans in iCloud can just move to Dropbox now.

Ridiculous weakening of security.

I would agree with you, it seems logical that the phone backup and being able to restore that could open access to all sorts of data.

Additionally, does anyone remember thefappening?

[andyb28]

I wonder if these guys will update their guidance?

https://www.ncsc.gov.uk/guidance/cyber-security-ti...

[Strangely Brown]

130R said:

ou're arguing over semantics. That's exactly what I said in the second message above. Also a lot of the data under ADP, like iCloud Drive, is "important personal stuff" ..

It's not semantics, it's an important distinction.

[Zaichik]

This is very bad and we only know about Apple. The fact the government can make these blanket requests to weaken our security in secret is appalling.

What's worse is the obvious lack of any technical knowledge on behalf of the government. Having met government 'experts' in this field from certain shady departments professionally I was dismayed at their total lack of knowledge but thought that was a one off - clearly not.

I have sent the following to my MP:

I am writing to express my deep concern over the UK government’s insistence that Apple weaken the encryption and data security protections provided to its customers. As you are no doubt aware, this has led Apple to announce that it will remove certain security features entirely for UK users rather than compromise the integrity of its global security standards.

This decision is a direct consequence of the UK government’s legislative overreach in demanding access to private communications under the Investigatory Powers Act. The notion that tech companies should build deliberate weaknesses into their security systems in order to facilitate government surveillance is not only an attack on privacy but also a reckless move that jeopardises the personal and financial security of UK citizens.

As a result of this development, I am reluctantly considering moving my data storage and encryption needs to a provider that offers robust, government-inaccessible security—such as Alibaba Cloud's encryption services, which operates under the jurisdiction of the Chinese government and therefore remains out of reach of UK authorities. It is deeply ironic that, in seeking to protect my privacy, I now find myself contemplating moving my data to a foreign government rather than one that is supposed to represent my interests.

I would like you to raise this matter with the Home Secretary and obtain a response on the following points:

Why is the UK government undermining the security of its own citizens in this way, while other democratic nations allow strong encryption to remain intact?
Has the government considered the long-term consequences of pushing UK citizens toward foreign encryption services beyond its jurisdiction?
How does the government justify forcing companies like Apple to make UK users less secure while criminals and bad actors simply move to alternative encryption methods beyond its control?

The UK should be leading the way in digital rights and security, not forcing companies to roll back protections that keep citizens safe from cybercriminals and other threats. I would appreciate your response on this matter and look forward to hearing the Home Secretary’s justification for prioritising mass surveillance over individual security.

[Strangely Brown]

Zaichik said:

As a result of this development, I am reluctantly considering moving my data storage and encryption needs to a provider that offers robust, government-inaccessible security—such as Alibaba Cloud's encryption services, which operates under the jurisdiction of the Chinese government and therefore remains out of reach of UK authorities.

Please tell me this post is satire.

[Zaichik]

Strangely Brown said:

Please tell me this post is satire.

no, but to illustrate to the government how poorly thought out their plans are and what the consequences could be.
The reality is though, that the Alibaba encrypted cloud would be more secure than Apple iCloud now.

[768]

Zaichik said:

The reality is though, that the Alibaba encrypted cloud would be more secure than Apple iCloud now.

Probably not to a Chinese dissident. But I agree with you, that to someone in the UK there's merit in storing encrypted data outside the jurisdiction of this government.

[camel_landy]

Weeelll... This is what happens when you play the "Won't you think of the children?" card all the time, instead of having the balls to push back and ask "What are the parents doing?" instead.

M

[Evanivitch]

Murph7355 said:

I'm not assuming it stops at Apple. I know it will and should apply to them all. Thought I'd said that. Maybe that was in the duplicate NP&E thread.

As for paranoia...govts have been incredibly poor at keeping legislation up with technology advances. It seems they are trying to catch up. Fair enough.

Some (most I've seen thus far) of the arguments are very much paranoia.

....
How are they going to know data has been encrypted? Errrrrrm.

If there are widespread encryption attacks then they're generally known about and can be accounted for.

Sitting on hands because no approach is perfect is daft. It will evolve. But to evolve, moves have to be made. Some will be missteps. Some will take things in the right direction. That is how progress will be made.

Modern technology makes it very easy to distribute godawful st to far more people far more quickly. Shrugging and saying "but my bank details will be compromised" (when they won't) is not the answer. It's tech nerds admiring the problem and an innate desire for perfection when perfection doesn't exist (even and especially in the arguments put forward not to progress).

This shows your ignorance. Bad laws that fix nothing only erode the freedoms of law abiding citizens.

This literally fixes nothing for the reasons explained to you time and time again, it's unbelievably easy to circumvent.