Sunday, 9 February 2025
As has been widely reported, the government of the United Kingdom has secretly ordered Apple to build a back door into iCloud to allow ‘blanket capability to view fully encrypted material.’
Assuming the UK doesn’t back down, what are Apple’s options? This is my personal take: if I’ve missed something, I’d love to hear about it.
Option 1: Comply
Most companies would just comply with the order, but Apple is not most companies.
That’s not just because they have marketed themselves as privacy and security conscious, although that presumably factors into their decision. From what I’ve seen from interacting with their engineers and observing how they behave (both in technical standards bodies and in their products), this is a commitment that goes much deeper than just marketing.
More significantly, Apple will be considering the secondary and tertiary consequences of compliance. So far, every democratic country around the world has refrained from making such an order; for example, Australia’s widely debated legislation that mirrors the UK “Snooper’s Charter” has an explicit provision to disallow “systemic weakening” of encryption like we see here.
If the UK successfully forces Apple’s hand, every other government in the world is likely to take notice and consider making similar (or even more extreme) demands. CSAM scanning will just be the start: once access to that much data is available, it’s open season for everything from Lèse-majesté to punishing activists and protesters to policing sexual orientation, abortion, and other socially motivated laws. Even if a particular country doesn’t make the same demand of Apple, arrangements like Five Eyes will allow one agency to peer over another’s shoulders.
As I’ve written before, no one should have that much power.
In the tinderbox that is politics has become in many parts of the world, this is gasoline. I’d pay good money to be a fly on the wall in the meetings taking place with the Foreign Service, because they of all people should understand the potential global
29 Comments
asterisk9
Their best option, and the option they will surely take, is to refuse the request
zero0529
Why so extreme, I believe they only will have to stop providing their premium iCloud service to the UK as this is the one that have E2E encryption and thus would be affected?
WhyNotHugo
I agree that decentralising is without any doubt the best option. The best option for consumers. But it's not the best option for Apple: they want to remain tightly and firmly in control.
But removing Apple entirely from the "cloud" integration would be the best bet. E.g.: take a path similar to IMAP and CalDAV, where any third party provider can be used.
zaptrem
Decentralize iCloud doesn’t solve the problem because the majority of users (myself included) would want to keep using their hosted/“official” version due to the Apple subscription bundles we’re already paying for (the blog mentions this) and wanting the smoothest/most fully featured version. If the UK mandates some sort of encryption backdoor then that will follow anywhere the protocol is used (in the UK, that is. Apple would certainly use a non-backdoored version everywhere else it’s legal).
jamesy0ung
I mostly use iCloud for photo sync. It would be nice if there was some sort of API or something that third party applications could use to upload and download photos automatically in the background, like iCloud Photos does.
emilsedgh
The biggest downside of Option 2 is stated as:
> Perhaps more importantly, this is also a strategically worrisome direction to go in, because it plays into the narrative that Big Tech is more powerful than sovereign nations.
I don't buy it. I think it can be a fantastic win for them. Announce a leave date unless the government backs down and advertise it heavily on TV and everywhere:
Your government wants us to spy on you. We are not going to comply. Call your parliament members to <blah>.
This would make them champions of privacy and every other government will know how deep their commitment is.
zeitg3ist
Isn't the "advanced data protection" option already making it impossible for Apple to comply in cases where this is enabled? Of course this is not a perfect solution as it has to be explicitly enabled (and it has some usability drawbacks), but imagine that people who care about this stuff have this enabled already.
mediumsmart
Someone enlighten me – what impact does this have – iCloud as in the iCloud my phone is backed up to? with that door they can clone my phone onto another iPhone etc? Huge pain to run macOS and iOS without iCloud but if they want to do that, fine – so be it.
Zealotux
Apple already did the right thing almost ten years ago against an arguably more powerful entity https://www.apple.com/customer-letter/
Refusing23
But whats the best option for the endusers?
i personally dont care whats best for apple.
elashri
I think it would be suicidal for Apple to comply with that. It would open it to requests for many other countries demanding the same. Now this will create problems because now countries will start requiring Apple not to disclose their citizens information to any other party. Now you have two opposing requirements that will lead to Apple products to be banned in many countries if not all. I think Apple have much to lose by complying with UK that just withdraw and make UK users put pressure on their government.
And it is not classical west vs east. I think this is on much more fundamental concept of sovereignty. Many countries on both sides of ideological spectrum invest a lot on hacking and zero days exploits to obtain information on specific targets. UK is too lazy and demanding this privacy violation and internationally illegal action (just guessing) to be routine request.
edit: Fix typos
gamedever
Apple's biggest income growth is services like iCloud. There is no way they are going to give up that money spigot. Decentralization would mean losing out on that sweet sweet service profit. Especially as other companies undercut them
flanked-evergl
Funny how this happens in a country which has GDPR as part of their law. At least you get the popups, though, those really keep you safe.
The US should sanction and embargo the UK for this, some illegitimate despotic regime that is in full economic and social collapse should not be able to access everyone's data.
sanitycheck
Apple cares about profits, and only about users to the extent that it can profit from them. The touted security and privacy aspects of their service are useful for marketing, but they are not primarily why people buy Apple devices.
They already operate in China, allowing the Chinese government to access all "Chinese" user data. Non-Chinese Apple accounts also work perfectly well in China, which leads me to believe that the extent of data sharing is greater than has been disclosed (or dissidents could just use a foreign phone to avoid surveillance). I strongly suspect the CIA/FBI/DHS has similar access.
(Microsoft stuff also works fine in China, Google stuff does not. Draw your own conclusions.)
I think it's somewhat likely they'll just backdoor it and not tell the public, they can see this is just the way the world is headed.
If you want to message someone secretly, use an audited open source solution – don't rely on a megacorp to look out for your interests.
tonyedgecombe
I wonder if Google has received the same request. If not then why not?
mozball
Apple's 1 billion+ users across the world should protest this ludicrous overreach of power since the UK is essentially declaring digital sovereignty over all of them.
In the meantime maybe consider alternative cloud storage providers.
khana
[dead]
mike_hearn
I worked for years on decentralization projects so I wish this would happen, but I think in the current climate there is a much simpler and more direct option that Apple is far more likely to take. Perhaps the author's politics prevent him from seeing it: Cook will talk to Trump, Trump will announce crippling sanctions on the UK unless they leave tech firms alone, the UK will fold with some excuse designed to save face (perhaps pretending they never issued such an order at all) and everything will continue as before.
This is by far the most likely outcome because it's consistent with everything we know about the new US administration:
• Trump loves tariffs, he believes they actually make people richer. The previously prevailing WTO order that tried to push tariffs down is dead and buried.
• He already forced allies like Canada, Columbia and Mexico to do what he wants by threatening to impose truly massive tariffs. They agreed to his demands within days. Trump is willing to break allied economies to get what he wants.
• Elon Musk is Trump's most powerful and dynamic ally. He hates censorship demands, especially from European governments. He also hates the current British government, and via X has been exposing the American right to the off-the-charts levels of political censorship and oppression that's been happening under Labour (e.g. people getting longer jail sentences for Facebook posts about immigration than for violent crimes or child porn). The right are spoiling for a fight with Labour at the moment, this would be free red meat to their base.
• The US right also holds Europe in contempt for its failure to produce a viable tech industry and are inclined to view its regulations as mere extortion by losers for crimes that the Americans did not commit. The last eight years appear to have turned Trump into a radical libertarian, a plot twist few saw coming. The Biden administration was ideologically aligned with the EU and UK on this, but they're gone and there is no built-in sympathy anymore.
• The UK is run by a very weak and unpopular government. Starting from a few weeks ago Reform (Farage's party) now outpolls all the other parties. New governments after a long period of incumbency usually have a honeymoon period, but due to the weird way they won the election this one didn't. They also didn't campaign on picking a fight with Apple. There's no democratic mandate here and this isn't the will of the British people. If Labour push ahead with this, Reform will make lemonade. "Don't break my iPhone" is the easiest political campaign in history.
zarzavat
Apple needs to take the nuclear option here. They don't have to actually go through with it, just the mere threat would be effective. Starmer is unpopular and desperate for political wins, he has little to lose by conceding, whereas Apple has a lot to lose by conceding.
newsclues
What if they just sell a new Time Capsule appliance so anyone can setup their own local iCloud?
dariosalvi78
Apple should just keep being Apple and things should just keep getting worse, so that people may finally realise that if all smartphones are operated by a duopoly they may understand that's something has gone horribly wrong and it may be time to build a completely new ecosystem
ak_111
Many are saying that Apple can't comply without breaking EU GDPR. Hence Apple has been put in the situation where they are forced to accept either operating in the UK market or the EU market.
So my question is (am genuinely not being snarky) why would the UK gov put Apple in this situation? The current leader (Starmer) is a lawyer surely he must have been aware of the legal predicament this would put Apple in, what is the intention behind asking for something that you are fully aware there is absolutely no chance they can comply with?
hajimuz
People care more about security won’t use iCloud at the first place.
Providing a decentralized protocol probably doesn’t hurt the revenue, but increases the development cost.
coffeedoughnuts
Some people discussing how Trump/US could intervene to calm this situation – why would they? Presumably part of the US state would very much like access to this data, and with the security services of the US and the UK sharing lots of their intelligence (and with other five eyes nations) this would mean the UK becomes a one-stop-shop for gathering data on your own citizens without the need to trouble your own domestic legal system.
The UK's demand for access to _all_ apple users, not just UK citizens (a la China) indicates to me that it's at least possible this action has the backing of the US (though, obviously, there is not evidence for this – it's just hypothetical)
entropyneur
This is the American company that censored Radio Liberty in Russia (a country they've "left" because of the war) at the request of Russian authorities. Expecting them to take a stand against UK is insanity.
fujinghg
The best option is to remove everything you have from any cloud at this point and stop bothering about the vendor’s policies entirely. I am in the process of doing that.
What I use it for now may be an issue if a regime changes. As evident from the US situation.
If someone wants your data they can come and get it, with a court order and due process, not a rubber stamp from whatever incompetent incumbent meanders into power and fucks stuff up. Then quietly via a side channel with no knowledge and effort.
Notably without iCloud my iPad is basically useless. So it’s going on eBay tomorrow.
fauigerzigerk
Isn't Option 3 (open up) basically the status quo? It's not called iCloud and iCloud does get some preferential treatment, but the APIs for 3rd party cloud storage and Files app integration already exist and are widely used.
I just wonder why any government would ban E2EE in iCloud but permit the use of 3rd party E2EE apps. As soon as those 3rd party solutions gain any traction, the government can simply tell Apple to remove them from the App Store.
At the end of the day all roads lead to the sideloading ban. That's what turns Apple into this convenient tool for authoritarian police states.
luke-stanley
Option 4: Just move the UK data to China. If it's not end-to-end-encrypted then they get access anyway. No messing.
asmor
Do not try to solve legal issues with technology. They're not the same scope.
If the UK wants Apple to introduce a backdoor, the two options are to do it or not to do it. To not do it and invent some excuse leaning on technical details doesn't work. Apple has the keys to sign software for these devices at the end of the day. That includes software that betrays the user's trust. That previously data was incidentally stored unencrypted on servers is not relevant for the fact they're being compelled to make this data available – at least not with my understanding of UK law.