Why Apple Turned Off Advanced Data Protection in the UK (and What It Means for Everyone)

If you want your iCloud data to be as well-protected as possible, you need to turn on Advanced Data Protection (ADP)— but that's no longer going to be an option in the UK. Apple is pulling ADP from the country, reportedly following a request from the UK government for a backdoor into encrypted iCloud files, and the fallout is likely to have global consequences.

What is ADP?

ADP applies end-to-end encryption (the gold standard for data security) to just about everything you've got backed up in iCloud, making it virtually impossible for anyone else to access it. If ADP isn't enabled, only certain types of data get this protection, such as passwords and payment info, Messages in iCloud, and your health data. It's important to note that this data remains fully protected from everyone—even Apple and UK spies.

Without ADP, the rest of your iCloud backups (think iCloud Drive, Photos, and Notes, for example) are still protected, but with a lower level of encryption. That protection does a very good job at keeping out bad actors and preventing your data from being hacked, but it can still be accessed if required by Apple employees and—crucially for this current story—government and law enforcement agencies.

While Apple and the governments and security services of the world would tell you they have robust checks in place when it comes to who can get at encrypted data, the possibility for access is still there. With ADP (and other places where end-to-end encryption is deployed, like WhatsApp) that possibility goes away. Even if the FBI or MI5 demand files, they can't be delivered.

Earlier this month, The Washington Post reported that UK officials had requested secret, backdoor access into Apple's fully encrypted data files. The demand was apparently made under the auspices of the Investigatory Powers Act of 2016, which gives the country's security services widespread access to user data in the name of investigating criminal activity: Fighting terrorism and stopping child abuse are two common reasons given for creating an encryption backdoor.

It's a fight that's been going on for years. Governments and law enforcement agencies want their own special keys to the locks protecting user data across the world, ostensibly to halt criminals in their tracks. Privacy campaigners and tech companies like Apple argue there's no effective way of limiting a backdoor to just the "good guys" and not the "bad guys" (even if it was easy to distinguish between the two, which it isn't).

Apple's move in the UK—and the global implications

Users in the UK now see a message like this. Credit: Lifehacker

Apple's policy has long been that it will never offer backdoors to its encrypted data, so it would seem to have decided that its only other option is to pull ADP. Brits without ADP enabled can no longer turn it on, while those who do have the feature set up will have to eventually turn it off (though Apple hasn't said when).

"Apple can no longer offer Advanced Data Protection (ADP) in the United Kingdom to new users and current UK users will eventually need to disable this security feature," Apple spokesperson Julien Trosdorf told The Verge. "We are gravely disappointed that the protections provided by ADP will not be available to our customers in the UK given the continuing rise of data breaches and other threats to customer privacy."

As you would expect given the sensitive nature of the issue, government officials in the UK haven't said anything about what's been reported—and you'll see Apple makes no direct reference to it either, because to publicize a demand made under the Investigatory Powers Act is itself a criminal offense.

As for other organizations, such as Google and Meta, we're still in the dark. Presumably the UK government has made the same request, but details haven't leaked out—and no one involved can talk about it. Google and Meta, like Apple, have repeatedly said they're against encryption backdoors.

It's a mess if you're in the UK (like me), but it affects everyone: Given the rather blurry national borders we now have in the internet age, UK agencies would most likely have been able to access end-to-end encrypted data from users across the world through this backdoor, which for now looks off the table.

I've got ADP switched on, but unless the issue gets sorted out, I'll have to turn it off soon—meaning some of my iCloud data is more vulnerable to snooping again. As is often the case, it's ordinary users who end up losing out, while the debate on encryption backdoors rumbles on.

View the full article