Secret Order Seeks to Compel Apple to Weaken Encryption, Washington Post Reports
The British government last month ordered Apple to provide direct access to global users’ fully encrypted cloud backups and prohibited the technology giant from alerting any individuals so targeted.
See Also: Gartner Report | Break Free From Security Complexity. Platformization Delivers Simplicity.
The existence of the secret order, first publicly revealed Friday by The Washington Post, “requires blanket capability to view fully encrypted material, not merely assistance in cracking a specific account, and has no known precedent in major democracies,” the newspaper reported.
Cybersecurity experts have reacted with alarm over this unanticipated move. “I’m sure the U.K. government is well-intentioned but the road to hell is paved with good intentions,” said Alan Woodward, a professor of computer science at England University of Surrey, who has advised Parliament on 5G security and other national security matters. “The unintended consequences will affect us all.”
Rather than complying with the “technical capability notice” issued by the British government and breaking security and privacy promises to users, Apple would instead likely cease to offer any form of encrypted storage in the U.K., The Washington Post reported, citing anonymous sources. Even so, that move would still fall short of the British government’s demand that Apple furnish it with access to iCloud backups – including data backed up from iPhone, iPad and Mac devices – for users worldwide.
The notice to Apple was reportedly issued under Britain’s Investigatory Powers Act 2016. Controversial even before it was passed, critics have long derided the IPA as being a “Snooper’s Charter.” The law, as written, allows the government to demand that any telecommunications operator remove any “electronic protections” on encrypted communications. The government can also legally prevent the organization from publicly discussing that it’s been served with such a notice.
“The insane thing about the U.K. law is that it does not only apply to U.K. customers. It can potentially be used to go after non-U.K. customers as well. Say, people here in the U.S.,” said Matthew Green, a cryptographer and professor at Johns Hopkins University, in a Friday post to social platform Bluesky.
Woodward said he’s “stunned” over the U.K. government’s attempt to get Apple to undo the services it’s built that are protected by strong encryption.
“I have to assume Apple will challenge this and if they win it’ll pull the teeth of the IPA,” he said. “Of course, there is nothing to stop other countries from issuing their own versions of this demand.”
Any company that complied with this type of demand from the U.K. would have a difficult time rejecting the same demand from other countries. Of course, Apple may not be the only technology giant being so targeted by Britain. How many other companies worldwide have been served with a technical capability notice isn’t known.
For years, Western governments have repeatedly pressed technology firms to use weak encryption, rather than strong encryption. In response, experts and providers have warned that using weak encryption – aka adding a backdoor to a product or service – puts individuals, organizations and governments at risk from malicious criminals, nation-states and competitors.
Why has the U.K. government picked a fight with the world’s largest company, and chosen now as the time to do it? Apple sports a market cap of more than $3.5 trillion, and stands as a cornerstone of America’s technological success.
The report about the existence of the secret order targeting Apple comes less than three weeks after the start of a new presidential administration in the United States. The order being revealed could signal diplomatic pushback from officials in the Trump administration.
The long-running encryption debate took a major turn in recent months, after the U.S. discovered that Chinese state-sponsored cyber espionage hackers infiltrated at least nine American telecommunications giants – plus more abroad – and were intercepting communications for high-level political and party figures, including Trump’s campaign.
The hackers, tracked as “Salt Typhoon,” reportedly also accessed court-mandated backdoors that telecoms added to their infrastructure, and used it to spy on targets, including the FBI (see: China’s Hacking of US Telecoms: Officials Name More Victims).
Multiple telecoms are reportedly still struggling to eject the hackers from their infrastructure. Based on the attacks, CISA in December 2024, under President Joe Biden, released guidance advising the public at large to “use only end-to-end encrypted communications” across their devices and online accounts, and to secure access to high-value accounts using phishing-resistant multifactor authentication
Long-Running Encryption Debate
News of the secret order recalls the Apple versus FBI from 2016, in which the Obama-era U.S. Department of Justice attempted to legally compel Apple into unlocking an iPhone seized during the course of an investigation.
Apple declined, arguing that strong encryption is essential for keeping information secure. Many in the information security community viewed the case as an attempt by anti-strong encryption forces to legally “backdoor” products built by Apple – and by extension any U.S. technology company – to bypass any encryption they’ve built into their devices.
As Brad Smith, president of Microsoft, told RSA Conference 2016 in a keynote speech: “The road to hell starts with a backdoor.”
The push to protect devices and cloud services with strong authentication began with technology giants adopting end-to-end encryption for communications services, which was a direct reaction to former National Security Agency contractor Edward Snowden’s leaks. They revealed that the NSA and Britain’s sister agency GCHQ, among other intelligence agencies, were regularly conducting mass interception of individuals’ communications.
White House officials’ push to compel technology providers to use weak encryption – aka backdoors – continued throughout the first Trump administration. The second Trump administration’s stance on encryption isn’t yet clear.