UK Loses Bid for Complete Secrecy Over Apple Backdoor Demand

The British government lost its bid to maintain “absolute” secrecy over its attempt to compel Apple to provide backdoor access to user data.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

Britain’s independent Investigatory Powers Tribunal on Monday dismissed a government bid to prevent public disclosure of its invocation of a 2016 law requiring the tech company to provide law enforcement with unencrypted copies of customer data.

Apple filed a complaint with the tribunal, which has oversight of government surveillance activities, after being served with a “technical capability notice” by the Secretary of State. Such notices, enabled by the Investigatory Powers Act of 2016, allow the government to demand that a telecommunications operator remove any “electronic protections” on user data. The government can also legally prohibit anyone served with such a notice from publicly revealing that fact. The British government has refused to confirm or deny the existence of any individual technical capability notice.

The IPT revealed Monday that it held a March 16 hearing pitting the government against Apple attorneys. A judgment by a two justice panel showed that lawyers representing Secretary of State Yvette Cooper asserted that making even the “bare details” of the government’s order public would damage both public interest or national security.

Apple’s lawyer “and to an extent” the lawyer appointed as counsel to the tribunal said the government’s “concerns are overblown and unjustified,” wrote the two justices, Rabinder Singh and Jeremy Johnson. “We do not accept that the revelation of the bare details of the case would be damaging to the public interest or prejudicial to national security,” they wrote.

Britain’s IPT is an independent judicial body, established under the Regulation of Investigatory Powers Act of 2000, to give the public a right of redress over any allegedly unlawful use of covert investigative techniques or other conduct by or on behalf of the intelligence services.

Critics have long derided the IPA as being a “Snooper’s Charter,” as mathematicians and security experts have continued to emphasize that only strong encryption for data at rest and in transit will safeguard users’ data – from communications and bank transactions to state secrets. Any backdoor is by definition an attempt to weaken encryption, which leaves the data being stored at risk from criminals, unfriendly nation-states or government overreach.

The existence of the secret order itself was first reported by The Washington Post in February. Apple shortly afterward alerted British customers that the company would deactivate the Advanced Data Protection feature, a feature allowing users to protect iCloud backups with end-to-end-encryption.

U.S. President Donald Trump publicly confirmed the notice following a Feb. 27 meeting with U.K. Prime Minister Keir Starmer. “We told them you can’t do this,” Trump told The Spectator. “That’s incredible. That’s something, you know, that you hear about with China.”

Legal experts have welcomed the judgement. “There’s no point to have a specialized tribunal (with special rules) if the issue of disclosure will be preemptively determined by a standard set up by the government itself. The tribunal must be able to properly assess the merits of the claim that disclosure would damage national security,” said ‪Paolo Sandro‬, an associate professor of public law and legal theory at England’s University of Leeds.‬

Even so, Sandro said the judgement also includes “some worrying remarks about the degree of deference” the tribunal will give to the Secretary of State’s assessment of the potential for harm to public order or national security.

The tribunal received written briefs from a number of media organizations, as well as a letter from Senators Ron Wyden, D-Ore., and Alex Padilla, D-Calif., as well as Representatives Zoe Lofgren, D-Calif., Andy Biggs, R-Ariz., and Warren Davidson, R-Ohio. They all collectively “strongly argued in favor of open justice and against the proceedings taking place in secret,” the tribunal said.

The tribunal received a complaint from two privacy rights groups – Privacy Intelligence and Liberty – urging that the hearing be held in public, and challenging the legality of the government being able to issue technical notices. The tribunal said it will hear the complaint at a later date.

“Executive decisions affecting the privacy and security of billions of people globally should be open to legal challenge in the most transparent way possible,” said Ioannis Kouvakas, senior legal officer and assistant general counsel at Privacy International. “We will be moving forward with our complaint before the IPT and we will be seeing the U.K. government in court.”

Whether or not future hearings pertaining to this case continue to happen in secret isn’t yet clear. “It may well be possible for some or all future hearings to incorporate a public element, with or without reporting restrictions,” the tribunal’s judgement says. “It is not possible to rule on that at this stage.”