Apple UK encrypted data challenge targets fresh iCloud access demand
Apple has filed a new UK tribunal complaint over reported access to encrypted British iCloud backups, reviving a privacy dispute.
By Theo Nakamura · Staff Writer
· 3 min read
Apple’s UK encrypted data challenge has returned to court, with the company confirming that it filed a fresh complaint over the British government’s reported demand for access to encrypted cloud backups of UK users. The filing puts renewed attention on the privacy protections available to iCloud customers in Britain and on the government’s authority to issue secret technical orders.
Apple confirmed the filing to Reuters and CNBC but declined further comment. The Home Office said it would not comment on legal proceedings or operational matters, including whether a particular notice exists.
What is Apple challenging in the UK encrypted data case?
According to the Financial Times, Reuters and the Guardian, Apple lodged its complaint last month at the Investigatory Powers Tribunal, an independent UK judicial body. The reported case challenges the government’s power to issue technical capability notices under the Investigatory Powers Act.
Such notices can require companies to give UK security services access to customer data, including data protected by encryption, the Financial Times reported. Reporting describes the latest notice as focused on encrypted cloud backups belonging to British users. The government has not publicly confirmed its terms, and the law restricts recipients from acknowledging or discussing individual notices, according to the Financial Times.
The current proceeding follows a separate dispute over an earlier order that covered both UK and US customer data. Reuters and CNBC reported that Britain dropped that earlier mandate last year after negotiations and interventions involving the Trump administration. Reports say the later notice did not apply to US users.
What does this mean for iCloud security in the UK?
Advanced Data Protection, or ADP, is an optional iCloud setting that adds end-to-end encryption to most iCloud data, including backups, Photos and Notes. End-to-end encryption means the data can be decrypted only on a user’s trusted devices. Apple says it does not hold the encryption keys for data protected this way.
Apple says new UK users can no longer enable ADP. For those users, 10 categories that ADP would cover, including iCloud Backup, iCloud Drive, Photos, Notes and Voice Memos, use Apple’s standard data protection instead. Under that default setup, Apple says it holds the relevant keys for those categories so it can help with account recovery.
The change does not cover all Apple data. Apple says 15 iCloud categories, including Keychain and Health, remain end-to-end encrypted by default in the UK. iMessage and FaceTime also remain end-to-end encrypted there. Apple said existing UK ADP users would be given time to turn the feature off themselves to continue using iCloud.
Apple has said it has not created a backdoor or master key for its products and services and will not do so. The Home Office said strong encryption and privacy protections should coexist with lawful access to communications when it is necessary and proportionate to address terrorism, serious crime and child sexual abuse. It also cited safeguards and independent judicial oversight in the Investigatory Powers Act.
Privacy International said a case-management hearing to determine how Apple’s complaint and parallel challenges by privacy groups should be handled was scheduled for the following month. No ruling in Apple’s case has been reported.
This story draws on original reporting from CNBC.
