Apple Pulls Encryption From the UK - DTNSB 4961  ## Metadata - Author: [[Daily Tech News Show]] - Full Title: Apple Pulls Encryption From the UK - DTNSB 4961 - Category: #podcasts - URL: https://share.snipd.com/episode/c67dd51c-407a-4aea-9017-acff7b416f1f ## Document Notes ## Highlights - **Apple's Encryption Removal** - Apple discontinuing Advanced Data Protection (ADP) in the UK reflects government pressure. - This removal of an optional extra layer of security weakens user data protection. Transcript: Huyen Tue Dao Data protection is opt-in, so not all users have it anyway. But if you have it and you live in the UK, you don't have it anymore. Apple has not violated the law and acknowledged their request, but I think we can guess that they got one because Apple just announced it will no longer offer ADP in the UK. In fact, it's already stopped it. It carefully crafted its response, telling Bleeping Computer, we are gravely disappointed that the protections provided by ADP will not be available to our customers in the UK, given The continuing rise of data breaches and other threats to customer privacy. Enhancing the security of cloud storage with end-to encryption is more urgent than ever before. Apple remains committed to offering our users the highest level of security for their personal data and are hopeful that we will be able to do so in the future in the United Kingdom. Now, they never said they got a request. They never pointed a finger at the government. They sort of left it up to us to guess why they would be so disappointed that they can't offer it anymore. So Apple's government information request page still says that the company has never created a backdoor or master key to any of its products or services and never allowed any government Direct access to Apple servers. So they haven't said they haven't gotten a request, but they still say we haven't complied with that. And this is how they don't comply with it. They just remove the idea altogether. So UK users are now seeing a message if they try to turn the feature on, Apple can no longer offer advanced data protection, ADP, in the United Kingdom to new users. Again, doesn't say why, just says it can't do it. Still have it, but are eventually going to have to disable it in order to continue accessing iCloud. So they won't be able to get to iCloud unless they go and turn this off. This does not affect messaging, as I said. It does not affect health, and it does not affect iCloud keychain. All three of those remain end-to encrypted in the UK when you're using it. Apple also did clarify that ADP continues to be available worldwide. So the reports that the UK had asked for access to worldwide communications either were incorrect or they are not complying with that because they're saying, no, we're not giving any, We're not removing it from anyone else. Gwen, we're going to talk to Nate Langston, who's in the UK later in the show about this, but what's ([Time 0:03:22](https://share.snipd.com/snip/0ea165ae-6c8a-4f43-a89c-db36c934548a)) - **Nate Langston's Response to ADP Removal** - Nate Langston proactively disabled ADP due to ambiguity and reliance on iCloud. - He chose Apple cloud services due to trusting them more with his data compared to other tech giants. Transcript: Huyen Tue Dao Well, good morning, Nate. At least it's morning for me while I'm recording this. What a lovely bit of information for you to face on a Friday. Nate Lanxon It was a delight. Yes. It was one of my favorite things that took place today. Huyen Tue Dao I imagine so. So at the top of the show, we explained what's going on here. What did you do when you found this out besides maybe Scream or something like that? Nate Lanxon Well, the first thing I did was look into the finer details of what happens to people in the UK who have this feature enabled already. I did speak to a friend of mine who didn't have it enabled and they said that they had a pop-up warning on their phone that says this is not available in the UK. That kicked in about 3pm. So obviously it was planned to go live at 3 today in the UK. I went and then checked my page and it just said that it was not able to be offered to new users, but I did have the option to turn it off. So the specifics of what's going to happen next for people who don't opt out is not clear. It seems like there will be a grace period offered, but at some point, Apple will have to disable this feature. And because Apple does not have the key to decrypt the data, the risk, at least from our interpretation, is that you may lose access to your data entirely. That I'm sure will be clarified in the coming days and weeks. But I took the proactive step to disable ADP immediately anyway. There are a couple of reasons for that. One, I hate ambiguity when it comes to data and the availability of things like iCloud, which I rely on extensively. And the second reason comes back to why I went all in on using Apple as a place for cloud services, not backups, because iCloud isn't a backup service, but for consolidating my data. And that's because I went through a process of trying to figure out which of the massive tech companies I distrust the least. And this is something, I mean, it's probably even something you and I have talked about over the years, but it boils down to I decided Apple needs my data the least out of the big tech companies. It doesn't need it to mine for, you know, potential shopping information or searching. It wants to lock me in in a whole different way than involves me buying iPhones every year, but it doesn't specifically need it in the same way others do. And I believe Apple is still a decent gatekeeper for my information that I have on iCloud, which like most people, I think is not particularly revelatory were anyone to go prying through It. I don't want them to, but it's not particularly risky stuff there. So I felt that deactivating it, knowing that access to this would still require a warrant from a court. And it is also still going to be protected by the fact that Apple is Apple. For me, speaking very personally, that was enough for me to say, I'm going to sidestep any potential headaches and I'm just going to disable it now. Huyen Tue Dao Yeah, I think that's important for people to note. Your data still would be encrypted on your device, if you so choose. It is still encrypted when it's transmitted to iCloud. As far as we know, there shouldn't have been any change in that. What Apple has said is it has eliminated the option for you to have it encrypted on iCloud itself, which prevents Apple from seeing it, prevents anybody but you with your device being Able to access it. Now it will be unencrypted on Apple's iCloud servers, meaning Apple could look at it. And so that's why you're saying like, well, maybe they could, but I trust them. But also meaning that anyone who got into Apple's iCloud servers, if there was a breach, could get it. How do you feel about that? Because if it's encrypted, you don't have to worry about it. If somebody gets into Apple's iCloud servers, doesn't matter, your stuff's encrypted. It's going to be hard for them to see. Now, if someone got in, they could see it. ([Time 0:23:04](https://share.snipd.com/snip/0a7952d6-5363-4d7a-8009-be0b72645798)) - **Cloud Storage Caution** - Be mindful of cloud storage risks, as UK law change impacts data protection. - Encrypt sensitive data before uploading if concerned, despite Apple's previous protections. Transcript: Huyen Tue Dao They could. Nate Lanxon And I have, you have to trust that the powers that be are taking the steps necessary to prevent that. But I think it is on a user as well to be careful about what data they store in the cloud. You know, that is still a fact. If something is that sensitive that you want it to be protected, there's nothing stopping you putting it in a folder, compressing it, encrypting that and storing that on iCloud. You know, if something is stored unencrypted, but the thing itself is encrypted, then the data that's being protected remains encrypted. So that's something that is always going to be available to you anyway. So that's how I feel about that. But more broadly, I think there are a couple of ([Time 0:27:08](https://share.snipd.com/snip/e72edbec-7c4a-4e77-88b2-e0802a7897da)) - **Security Restrictions' Ineffectiveness** - Restricting security measures often displaces illicit activities rather than stopping them. - Legitimate users face weakened security without any real benefits, according to expert consensus. Transcript: Nate Lanxon Things that people are going to want to finance us to. The first is why was this implemented in the first place? And what we have not found evidence of is that moves like this prevent bad actors doing the thing that lawmakers push these changes out in order to stop them doing it generally as we've Seen from uh from illegal material to things like piracy is that this tends to be well if i can't use this we'll move it elsewhere and for the legitimate users like you and i and i'm sure Everybody listening we are have our security weakened um no one wins. There's no benefit. That's the general consensus of experts on this issue. Yeah. Do you have a sense ([Time 0:27:47](https://share.snipd.com/snip/d9a565ee-3d63-4fdf-933a-de353e5c8677)) - **Regional Restrictions and VPNs** - Regional restrictions raise questions on circumventing with VPN or account locations. - Nate questions how consistent encryption remains while traveling, considering data laws. Transcript: Huyen Tue Dao I am curious and we don't know the answers to what I'm about to, to ponder, but I'm curious, uh, if you have a VPN, can you get around this, uh, pretend to be in another country or does it go By where the account is created or, or, it's stored and that sort of thing? If I travel to visit you, which I would love to do, do I not get end-to encryption on my iCloud backups while I'm in the UK? Or does it not apply to me because I'm not a UK citizen? There's a lot of questions when you do a regional thing like this, how it works. And generally, if ([Time 0:31:07](https://share.snipd.com/snip/0d0fff43-0073-44da-89ac-4c9ab2b426da))