Let’s keep this short and sweet — or rather bitter. The widely reported mandate on Apple to trash its encryption at the behest of the UK government is a disaster for iPhone users and everyone else as well. It’s the most serious setback for personal cyber security we have seen in years. If this goes ahead as reported, there will be no turning back.
In a script that seems to have come out of the Monty Python writers’ room, The Washington Post aired the news that Britain’s government had issued a secret, so-called “technical capability notice” on Apple, demanding it provide a backdoor for intelligence and law enforcement into fully encrypted cloud storage accounts.
Here’s the satirical part — Apple can’t admit it has been served a notice, or even acknowledge discussions; it can’t update users on what has happened, or even tell them the security of their accounts has been weakened; it can appeal, but can’t even wait for the appeal to be heard before making changes.
Signal’s Meredith Whittaker summed it up perfectly: “Using Technical Capability Notices to weaken encryption around the globe is a shocking move that will position the UK as a tech pariah, rather than a tech leader. If implemented, the directive will create a dangerous cybersecurity vulnerability in the nervous system of our global economy.”
After years of back-and-forth between security agencies, regulators, legislators and big tech, with encryption being defended to the hilt, this kills it dead in an instant. Make no mistake, there’s no such thing as a secure backdoor. If you weaken the encrypted enclave, then you can assume it will be exploited by good actors as well as bad. And if the UK were to carry this out, what’s to stop China or Russia doing the same.
The most ridiculous part of this story is that the UK mandate reportedly applies to all iCloud data, regardless of jurisdiction. That would cover the U.S. as well as the UK. That has caused the most consternation here — but this should not apply anywhere.
As EFF warns, “any ‘backdoor’ built for the government puts everyone at greater risk of hacking, identity theft, and fraud. There is no world where, once built, these backdoors would only be used by open and democratic governments. These systems can be, and quickly will be, used by more repressive governments around the world to read protesters’ and dissenters’ communications. We’ve seen and opposed these sorts of measures for years. Now is no different.”
So, why is this worse than you think. In my view — and no one can officially comment, so “views” will be all we can share — any such government action would not stop with Apple. Not to over-simplify matters, but a bad actor would simply run Google’s helpful switch to Android software. If the U.K is going after Apple, it’s also going after Google and Meta and others. Why would they not? But Soviet-style, none of these other parties can comment or answer questions or confirm or deny.
And so this becomes a weakening of the critical dam keeping us all safe from spyware, hackers and data breaches. It starts in one place but it goes everywhere. Apple has the most to lose — it fundamentally changes the iPhone proposition. And so it’s little surprise that this story centers on Apple. But a stand must be taken now.
I agree with EFF: “Encryption is one of the best ways we have to reclaim our privacy and security in a digital world filled with cyberattacks and security breaches, and there’s no way to weaken it in order to only provide access to the ‘good guys’.”
The irony in this timing is the U.S. government changing its position on encryption. In the wake of China’s Salt Typhoon hacking America’s networks, citizens were urged to turn to encryption whenever possible. If that furor taught us anything, it’s that backdoors will be exploited. Put them in for the right reason and they’ll be used for the wrong reason. Make no mistake — if Apple doesn’t successfully prevent this update, it will just be the beginning of a very dangerous path.
