Is Apple shutting down iCloud in the UK?
With the UK government demanding backdoor access to encrypted iCloud data, it’s clear that Apple now faces a daunting challenge. How it responds could have significant implications not only for the company’s privacy, but also its global operations and reputation.
According to the Washington Post, the UK government has secretly demanded that Apple grant it broad access to all encrypted user content uploaded to iCloud. The spying order reportedly came in the form of a “Technical Capability Notice,” a document sent to Apple instructing Apple to grant access under the UK’s sweeping Investigatory Powers Act (IPA) of 2016.
According to sources who spoke to the publication, Apple will likely stop offering encrypted storage in the UK due to demand. Specifically, Apple could withdraw Advanced Data Protection, an opt-in feature that provides end-to-end encryption (E2EE) for iCloud backups such as photos, notes, voice memos, message backups, and device backups.
In this scenario, UK users would still have access to basic iCloud services, but their data would lack the extra layer of security that prevents even Apple from accessing it. In other words, UK users’ iCloud data would revert to default encryption, potentially allowing Apple to access the contents of that data if compelled to do so by UK authorities when issuing a warrant. While no specific case has been publicly confirmed, the IPA grants UK security agencies the legal framework to request data from companies if it is accessible.
Apple could take legal action at any time. However, according to the IPA, while the company can appeal the “notice of technical capability,” it must abide by the order during the appeal process. Apple would be forced to implement the backdoor temporarily while arguing against its legality. Furthermore, the IPA makes it a criminal offense to disclose that the government made the request in the first place.
It is obvious that such a gag order would prevent Apple from honestly communicating with its customers about the security changes. Introducing a backdoor, even if it is intended to give law enforcement access, creates an alternative route to a secure channel. This not only increases the risk of malicious actors discovering and exploiting the vulnerability, but also breaks the promise of complete confidentiality. Essentially, Apple would be lying to its customers about the watertightness of E2EE security.
Complete removal of iCloud in UK?
A more dramatic response from Apple would be to completely remove iCloud services from the UK. While this would protect Apple’s encryption standards, it would significantly disrupt millions of UK users who rely on iCloud for photo storage, device backup, and document syncing. Users would have to find alternative cloud storage solutions and could potentially lose access to years of data collected.
Apple could theoretically try to find a technical solution by restructuring iCloud to separate UK user data. However, the IPA allows UK authorities to compel technology companies to assist with data access regardless of their location, so this solution may not meet the government’s requirements for global access. It would also be costly to implement and would set a worrying precedent for other countries seeking similar agreements.
“I don’t know how this is going to be solved because Apple has been so concerned about user privacy,” Alan Woodward, professor of cybersecurity at Surrey University, told BBC News. “If they agree to this technical notice, their reputation will be in tatters. They will inevitably challenge it.”
Global impact
The UK’s demand could also jeopardise the government’s data-sharing agreement with the European Union. The two regions currently have an agreement that allows the free flow of personal data between the EU and the UK, but the agreement is up for review later this year. The creation of an encryption backdoor could be seen as a breach of the EU’s strict data protection standards.
The spying order has already raised concerns in Washington potentially putting Apple in a diplomatic crossfire. According to the Washington Post, the Biden administration began pursuing this issue ever since the UK first hinted that it might require backdoor access.
The situation is now quite delicate, given recent recommendations from US security agencies to increase the use of encryption to counter Chinese cyber threats. In December, the FBI, National Security Agency and Cybersecurity and Infrastructure Security Agency urged companies to ensure that data traffic is end-to-end encrypted as much as possible to counter state-sponsored hacking. If UK authorities were to require a backdoor into iCloud, it would be in direct contradiction to this policy and could weaken US cyber defenses. Apple would then be faced with the choice of either complying with UK law or protecting US national security interests.
“We would never put a backdoor in our products.”
It is worth noting that Apple has repeatedly and forcefully opposed the introduction of backdoors in its products. In its submission to the UK Parliament in March 2023, the company clearly stated, “We would never build a backdoor into our products.” This echoes CEO Tim Cook’s firm stance in the San Bernardino case in 2016, where he stated, “Apple has never built a backdoor into any of our products and never will.”
The company reiterated this position in its 2024 submission to the UK Parliament on changes to the IPA, warning that the provisions “could be used to force a company like Apple, which would never build a backdoor into its products, to publicly withdraw critical security features from the UK market.”
Apple’s core tenet that privacy is a fundamental human right is a position Apple has reiterated over the years, despite government calls for weaker encryption. Now, in light of the UK government’s latest encryption regulations, the company is being put to the test to prove whether its commitment to user privacy is truly unwavering or whether it is merely a corporate slogan that will give in under pressure from regulators.
