Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
United States Encryption United Kingdom

UK Demand For a Back Door To Apple Data Threatens Americans, Lawmakers Say (msn.com) 94

Posted by msmash from the breaking-news dept.
Members of key congressional oversight committees wrote to the United States' new top intelligence official Thursday to warn that a British order demanding government access to Apple users' encrypted data imperils Americans. From a report: Ron Wyden, a Democrat on the Senate Intelligence Committee, and Andy Biggs, a Republican on the House Judiciary committee, wrote to just-sworn-in National Intelligence Director Tulsi Gabbard and asked her to demand the United Kingdom retract its order.

If the top U.S. ally does not back off, they said, Gabbard should consider limiting the deep intelligence sharing and cooperation on cybersecurity between the countries. The Post first reported the existence of the confidential British order last week. It directs Apple to create a back door into its Advanced Data Protection offering, which allows users to fully encrypt data from iPhones and Mac computers when putting it in Apple's iCloud storage. Apple cannot retrieve such content even when served with a court order, frustrating authorities looking for evidence of terrorism, child abuse and other serious crimes.

The order was issued under the Investigatory Powers Act, which allows the British Home Office to require technical cooperation from companies and forbids those companies from disclosing anything about the demands. It would apply globally, though the U.K. authorities would have to ask Apple for information stored by specific customers.

UK Demand For a Back Door To Apple Data Threatens Americans, Lawmakers Say More | Reply

UK Demand For a Back Door To Apple Data Threatens Americans, Lawmakers Say

Comments Filter:

  • Apple PR Nightmare (Score:3)

    by Vandil X ( 636030 ) on Thursday February 13, 2025 @09:05AM (#65163393)
    Apple markets their devices for their "privacy" and security. If this is thwarted by the invention of a backdoor (or the public disclosure of an existing one), then it won't be long for nefarious actors to use this level of access beyond the scope of UK officials.

    If Apple pulls out of the UK market, that's a significant blow to their financials, but perhaps it would be a smaller blow than losing worldwide confidence in their products.

    • Re: (Score:3)

      by Zocalo ( 252965 )
      Apple have already stated their intentions on this. Given the way the current system works (public & private keys) adding a backdoor is simply not possible, so they'd have to do a major refactoring of the code to use a different system to comply with the order. They're not prepared to do that for the UK, so the solution will be to simply remove the encryption from *ALL* UK user accounts, including all the politicians, members of the security services, and everyone else. The upside (if you can call it

      • Given the way the current system works (public & private keys) adding a backdoor is simply not possible, so they'd have to do a major refactoring of the code to use a different system to comply with the order.

        This is just Apple trying to dazzle lawmakers with technobabble. The reality is, Apple already knows how to turn your user password back into your encryption key (otherwise restoring an iCloud backup to a replacement device would not be possible), and simply storing a copy of your password on Apple's servers would be an adequate "backdoor". It'd be a PR nightmare for Apple for sure, but absolutely trivial to implement.

        I'm really surprised on a "News for Nerds" site there's so many people repeating the ref

        • Cryptographically you can have two master keys, so presumably Apple owns those. But that's data in the cloud, on the phone they might not even have that and if you can't get into the phone then likely Apple can't either - after all they want you to buy a new one anyway. Any criminal would be stupid to put their data in the cloud where Apple, Microsoft, and Amazon can read it just as easily as they read your company's source code.

    • If this is thwarted by the invention of a backdoor (or the public disclosure of an existing one), then it won't be long for nefarious actors to use this level of access beyond the scope of UK officials.

      That doesn't necessarily follow.

      You seem to be assuming that a backdoor has to be some sort of exploitable flaw, but it doesn't need to be that at all. Apple could, for example, add an API that requires cryptographic authentication using a key that only Apple has, or only the UK government has, etc. As long as that API is implemented correctly it would keep out anyone without the necessary key. Public disclosure of the API and even the details of its implementation wouldn't matter as long as the key was

  • Just like when the US was trying to pressure apple into giving up the keys to the kingdom for that terrorists phone. They did a mind job on the american people by somehow keeping people from asking the real question of "why is it possible for them to even give up this information". The owner of the device should be responsible for their own encryption. If you are "trusting" someone else to be in control of your encryption, then you may as well not be encrypted at all. Encryption plugins should be the paradi

    • Re: (Score:3)

      by sinij ( 911942 )

      The owner of the device should be responsible for their own encryption.

      This should be at least an option. However, typical user is not capable of managing their keys and that means that recovery would not be possible. This in turn will create false perception among non-techies that encryption is dangerous for your data and will undermine the whole system. Either way, UK government wins by undermining user data encryption.

      The situation with UK government has only one good solution - Apple tells them to go pound sand and Trump threatens punitive tariffs if they do anything ab

      • This in turn will create false perception among non-techies that encryption is dangerous for your data and will undermine the whole system

        Isn't it already the perception of DNSSEC among techies?

      • Re: (Score:2)

        by mccalli ( 323026 )
        That's already the case - you own the decryption key in iCloud, and if you lose it your data is gone. It's covered in their support document [apple.com], and also a warning comes up if you try to enable it

        • Re: (Score:2)

          by sinij ( 911942 )
          I am not sure what it takes to lose decryption key with the existing setup. You need to lose your phone, your apple account login, and configure iCloud to disable web access all together.

      • Re: (Score:2)

        by Sloppy ( 14984 )

        typical user is not capable of managing their keys and that means that recovery would not be possible. This in turn will create false perception among non-techies that encryption is dangerous for your data

        False perception? It'll point out a real thing: when encryption is done right, nobody can access the data unless they have the key. So it's both a danger and a strength.

        There's no reason to not point this out and let people learn from it.

        If they think they can do things well, they have a chance at keeping

        • Multiple keys. You can put some in escrow. Or split a key into shards, print them out, put all the shards in different safes, 5 out of 8 votes can unlock the data. Having just one "the key" is simplistic, even if it's common.

          So I could imagine a system where Apple says "sure, here's all the data, we've decrypted our lock on the data, now you just have to get past the remaining certs if you have those keys." Would be nice to have Apple allow changes to their system so that the user can do their own encrypti

      • We've got some industrial users who were (at least in the past) very hesitant about turning on full security. They have a fear that once the switch is flipped that they'll lose access to their own data because it's now encrypted, and there's a compex PKI set of keys and certificates and HSMs and so many other stuff that they don't understand. At the same time they have their own customers demanding that they protect data, as well as government pressure, so I presume they've bowed to the necessity by now.

    • Re: (Score:2)

      by MikeMo ( 521697 )
      That's not what went down. The US asked Apple to make a special version of the OS [npr.org] that would not wipe the terrorist's phones after multiple failed attempts to log in.
    • What, like a switch for "enable cloud encryption", or are you suggesting manually encrypting each file? The first is pretty standard for a hosting service, the latter seems like a pain in the rear.

      • Manually encryption could be automatic. But then it wouldn't be manual. Ugh.

        The problem here is that the average user isn't a crypto expert. And the average user doesn't know how to modify their phone or add their own encryption. This is very similar to how most Linux users didn't bother with GPG (that and because it was obtuse to those unfamiliar with more modern cryptography). But it is perfectly feasable that Apple, or cloud providers, have an API where customers can plug in their own security. The

        • Tricky and a royal pain. It sounds like you're suggesting moving files from my phone to my computer for encryption before uploading to iCloud instead of letting it sync on its own. You'd need some sort of proxy that decrypts the traffic, pulls out the files being synced, encrypts them, and then re-encrypts the stream. Not easy to setup, not easy to maintain.

          • Well, I'm mostly a computer user. The phone is for games on the toilet and making phone calls :-) But yes, if you could add your own trusted apps to the phone to do this. I doubt it would ever happen with Apple, but if there's full source code for Android kernel...

            You dont re-encrypt the data in the stream, you encrypt once on your end, then whatever the stream does with it is its own business (if it wastes time doing more encryption then so be it). The "traffic" thus is never plaintext, ever. You sourc

            • Well, the issue at hand was iCloud encryption. What I meant was that to do your own encryption of your iCloud files, you'd need a proxy to decrypt the traffic from your phone, find the files being synced, encrypt them and then re-encrypt the traffic as it leaves for iCloud.

              If we're talking about using a different cloud storage service, the question is moot. They don't seem to be asking DropBox to unlock anything.

  • Managed decline (Score:5, Insightful)

    by sinij ( 911942 ) on Thursday February 13, 2025 @09:25AM (#65163457)
    For anyone interested in watching this unfold - UK is what managed decline looks like in practice. Your country gets poorer, your national identity is forgotten, your individual rights are eroded. The next step isn't trans-national cosmopolitan population but sectarian violence and fracturing of your country into multiple smaller states. On the current trajectory there won't be United Kingdom in 10 years, but there will be England, Wales, Scotland, etc. and they all will be much, much poorer and even less influential on the world stage.

    • Re: (Score:1)

      by dfghjk ( 711126 )

      Just like Putin plans for all western nations, including the US. In fact, everything you wrote could be applied to the US. Doesn't mean the predictions are true, it's more suggestive that you've either been convinced of Putin's propaganda or you work on behalf of his interests.

    • For anyone interested in watching this unfold - UK is what managed decline looks like in practice. Your country gets poorer, your national identity is forgotten, your individual rights are eroded. The next step isn't trans-national cosmopolitan population but sectarian violence and fracturing of your country into multiple smaller states. On the current trajectory there won't be United Kingdom in 10 years, but there will be England, Wales, Scotland, etc. and they all will be much, much poorer and even less influential on the world stage.

      Managed decline? Us folks across the pond are asking ya ta hold our beer, bud. We're gonna show ya how to accelerate that decline.

    • Re: (Score:1)

      by AmiMoJo ( 196126 )

      Some of the regions could be better off as independents. Scotland could get back into the EU, from which it would benefit greatly, for example.

      The UK should have broken up long ago. It was only held together by the Empire and former glory, and then later by the EU doing its best to make sure that the regions were not neglected. Now that it's just English politics running everything, conditions for the other countries have deteriorated. There is a slight exception in Northern Ireland, but only because their

      • Its economy is only afloat because of what the English taxpayer gives it. If it was independent it would need to go to the IMF immediately.

        https://www.ft.com/content/ff6... [ft.com]

        It would inherit its share of the UK's national debt, denominated in a foreign currency - the pound.

        It would not be eligible to join the Euro because its indebtness would be too great.

        • Re: (Score:3)

          by AmiMoJo ( 196126 )

          If Scotland did become independent then the currency would be a matter of negotiation. Chances are they would continue to use the pound for a while, which would make the rest of the UK somewhat reluctant to see their economy tank. There would probably be a transition period until they could adopt the Euro.

          As for how much debt they would inherit, that's another thing to be negotiated. As a part of the EU though their economy would do fine, especially with all that renewable energy they have. Remember that th

          • Chances are they would continue to use the pound for a while

            OK - so what happens is that the banks stop lending north of the border except with a significantly higher interest because there is a very high chance of de facto devaluation of the currency once it is detached from the rUK pound. So people will keep their money in banks guaranteed by the Bank of England, which will remain the central bank, but no company will invest in Scotland; too much uncertainty.

            which would make the rest of the UK somewhat reluctant to see their economy tank.

            But only a little bit, and the cost of propping up a bankrupt government will be too much. The Scottish eco

            • Re: (Score:3)

              by AmiMoJo ( 196126 )

              The currency wouldn't be devalued. It would be sterling until the join the Euro.

              • The trading deficit means that money would leave the economy rapidly and interest rates would rise. The government would have to cut imports massively, face a severe fiscal and economic crisis, or change currency, and not to the Euro. 'Devalue' might be the wrong word, but the effect would be the same. The breakdown of currency unions is a nasty experience for those caught up the events when it is done in a crisis.

      • Re: (Score:3)

        by Viol8 ( 599362 )

        "The UK should have broken up long ago. It was only held together by the Empire and former glory"

        I suggest you go learn some history. The United Kingdom came to pass in 1603, long before any British empire, when the SCOTTISH king James I was crowned king of england too. And Wales had been under english rule since the 12th century.

        "Now that it's just English politics running everything"

        Really? So the devolved governments do nothing and have no powers?

        Stick to BS'ing about your own country, not ours which you

        • Re: (Score:3)

          by pjt33 ( 739471 )

          I suggest you go learn some history. The United Kingdom came to pass in 1603, long before any British empire, when the SCOTTISH king James I was crowned king of england too.

          Not so. The kingdoms of Scotland and England were ruled in personal union for a century before the United Kingdom came to pass in 1707 with the Act of Union under Queen Anne. It took almost another century before Ireland became part of the United Kingdom rather than being ruled in personal union.

          • Re: (Score:2)

            by Viol8 ( 599362 )

            Fine, but the act of union simply formalised what had been the de facto situation for the previous 100 years under more or less absolute monarchs until the civil war. After that Cromwell created the - albeit short lived - commonwealth of england and scotland which pretty much demonstrates the point.

      • Some of the regions could be better off as independents. Scotland could get back into the EU

        Could it though? From a techincal perspective nation forming is hard, and you need recognition as a nation. And there are a few EU countries which have a REALLY STRONG vested interest in making it a truly terrible idea to break away from the country you're currently part of.

        If Scotland gets independence and is then utterly fucked over, this puts pressure on the Basque region to not leave, for example and there are ot

        • Re: (Score:2)

          by AmiMoJo ( 196126 )

          Spain would be fine with it, as long as it happens through legal means. Their issue with their break away wannabe state is that they keep refusing to offer any legal path to that, which has lead to non-legal means being employed.

          Unless something incredible happens then I think independence is inevitable, as it's the decline of the UK. We are locked into it pretty tightly now, and it's looking more like it could get worse, rather than better.

          • Spain don't generally speaking want the basque region to break away via legal means either.

            I think independence is likely too, but I think the feeling that Scotland would be welcomed with open arms by people who don't eat to encourage their own independence movements is dangerously naive.

            • Re: (Score:2)

              by AmiMoJo ( 196126 )

              What I mean is that Spain won't mind Scotland joining the EU if it is through a legal route, because they can simply deny the Basque region such an opportunity.

              It might have a small effect where it convinces a few more people that if they did break away the EU would take them, but realistically with the polling as it is and the long road to a legal vote, it's not a big concern.

              They could also do what we should have done and agree to negotiate with the EU before actually leaving, not setting up a deadline or

              • Well it's tricky: if enough people want it via legal means it gets politically tricky to ignore self determination. Much easier if you can make people a bit less keen by showing what happens if you leave.

                Different circumstances, reasons and treaties, but wow did Brexit dampen enthusiasms for leaving the EU, when people saw what the consequences were. That had not gone unnoticed.

                But yes, Scotland world need to negotiate first. The trouble is that could also load to a long to indefinite period of uncertainty.

        • And there are a few EU countries which have a REALLY STRONG vested interest in making it a truly terrible idea to break away from the country you're currently part of.

          Surely Czechia, Slovakia, Slovenia, and Croatia would all count as fairly recently having broken away from the country they were part of?

    • Great job brexit and you're also describing the USA.

    • The whole of europe is in managed decline pal. Check out the German and French economies at the moment which are in the toilet - the latter currently having a debt of 110% of GDP! As for southern europe , oh dear. The only country in the EU thats doing well is Poland ironically.

    • Technically, England, Wales, and Scotland are their own countries already.

    • Managed decline is preferable to unmitigated disaster, which is what we're headed for here on the left side of the Atlantic.

      • Re: (Score:2)

        by sinij ( 911942 )
        False choice. You don't have to chose between managed decline or catastrophic collapse. It is avoidable, but it does require returning to Western Values.

        • I never said those were the only two options in the entire set.

          I inferred those are the only two options available to us without a political sea change, and we're still a good 23 months from that being a possibility.

    • Managed decline in the UK? If you are in the US, you may want to read that comment back in a decade or so. At least it is managed in the UK.

      • Re: (Score:1)

        by sinij ( 911942 )
        I expect US will be prosperous and continue to be the dominant military, economic, and cultural power in the world. However, the UK and EU will be greatly reduced, we will likely see EU economic refugees in US by 2035.

    • This doesn't sound like UK, except manybe in the minds of a far right Merka First type. UK still protect rights of individuals, it's national identity is still very strong. You should be far more concerned about the rapid decline in America from the last few weeks as we spiral into unchecked autocracy, it will collapse before the UK does.

  • Excellent Idea (Score:5, Funny)

    by Vlad_the_Inhaler ( 32958 ) on Thursday February 13, 2025 @09:25AM (#65163459)

    I'm all for backdoors into software.

    Best regards
    Vlad

  • Typo in the description (Score:3, Insightful)

    by CEC-P ( 10248912 ) on Thursday February 13, 2025 @09:32AM (#65163469)
    "Apple cannot retrieve such content even when served with a court order, frustrating authorities looking for evidence of people saying bad things about the British Government."
    There, I fixed it for you.

  • The action being proposed by the committee members is quite likely to work. The UK government is keen to build bridges with Washington right now, and has worked pretty hard at doing so. They'll be quite responsive to this kind of political pressure.

  • imperiling Americans is the US Govt's job (Score:3, Insightful)

    by dfghjk ( 711126 ) on Thursday February 13, 2025 @09:46AM (#65163521)

    The real concern is that the American people learn that Apple grants access to the same backdoor built in for the US government.

  • National Security vs Private Sector Security

    To want one, but not the other is literally insane.

  • really ? (Score:2)

    by Tom ( 822 )

    frustrating authorities looking for evidence of terrorism, child abuse and other serious crimes.

    Because we all know that those are absolutely the only issues that they would ever dream of seing as a reason to sift through our personal information.

    Also note that "looking for evidence" implies that the targets of these searches don't need to be guilty, only suspected.

    I'm all for jailing terrorists and child molesters and throwing away the key. I also like my personal freedom to do innocent and legal things without the government poking around in it.

    • 'Also note that "looking for evidence" implies that the targets of these searches don't need to be guilty, only suspected.'

      That's always the case with any search warrant. Nothing to see here.

      • Re: (Score:2)

        by Tom ( 822 )

        The difference being that you can't script a physical search and scale it up.

        If the police would go and search every single house in the country because some genius thought they can interpret the laws that way on their hunt for, say, a pot farm, there would be an uprising. In the digital sphere, that is exactly what we're looking at. Overreach is the norm, not the exception.

  • Hmm (Score:2)

    by vbdasc ( 146051 )

    the Investigatory Powers Act, which ... and forbids those companies from disclosing anything about the demands.

    Does this mean that Apple already violated the UK law?

    • No, as that is referring to demands (not requests) against a particular third party. Because governments don't want those who hold data to tell the owners of that data that their affairs are being poked into otherwise they'd invoke pesky data protection things like the 4th Amendment, or similar in their country, and we can't have that.

  • I'm more scared of a domestic threat from an unelected immigrant. https://www.the-independent.co... [the-independent.com]

    Good thing he has "read only" access to my data. https://www.cbsnews.com/news/t... [cbsnews.com]

    • Re:Domestic threat (Score:5, Insightful)

      by sabbede ( 2678435 ) on Thursday February 13, 2025 @10:18AM (#65163653)
      You say that like the people who voted for Trump didn't know he and Musk were going to setup DOGE. They did. It was a major part of his platform. So, Trump was elected, Musk is working for him. The voters spoke.

      Honestly, you might as well complain about how people didn't vote for a particular cabinet secretary. It is a spurious complaint that can only be based on an intentional misunderstanding of the democratic process. Utterly silly.

      • It's still going to be Biden's fault when Medicare and Medicaid are slashed. https://www.npr.org/2025/02/10... [npr.org]

        • I'm not going to give much weight to Sebelius' opinion on the matter given her track record and partisan leanings. She wasn't interviewed by NPR for her insights, but to scare voters.

          An Obama appointee is not going to accurately or fairly portray the motives and agenda of her political opponents. She's just a hack brought in to build straw men.

      • Re: (Score:2)

        by Zocalo ( 252965 )
        There's knowing what someone claims they are going to do, and knowing how they are going to go about it.

        There's a reason political campaigns are often very heavy on the "what" and very light on the "how", and it's that voters love to fill in the blanks in a way that works for them, if they even think that far given all the single-viewpoint information bubbles many of them now wrap themselves in rather than have to consider different opinions. A lot of people are going to get behind someone promising to
        • No, that argument simply doesn't fly. Trump and Musk said what they were going to do and how. People voted for it. Had you seen a Trump rally, none of this would be a surprise to you.

          Stop looking for an excuse to say that this isn't what Trump won on. Stop listening to the people who say otherwise, they know better but tell you different for malicious reasons.

  • Holy hells the hypocrisy (Score:3, Interesting)

    by nightflameauto ( 6607976 ) on Thursday February 13, 2025 @10:14AM (#65163631)

    The United States government whines continuously about needing back doors into all encryption, then bitch when an ally wants the same? Can they even read their own playbook? Or are we so deep into the "gimme everything, you should get nothing" territory now that they no longer have a playbook?

    • The United States government whines continuously about needing back doors into all encryption, then bitch when an ally wants the same? Can they even read their own playbook?

      The US government is not monolithic. No organization is, but the US government less so than most.

      In this case, it's law enforcement agencies -- notably the FBI -- who is always whining about needing backdoors, but it's a Congressman who is complaining that backdoors may endanger Americans. Presumably the Congressman disagrees with the FBI.

  • There's going to be a flood of chickens coming home to roost with Presidents Elon and Trump (Mump? Trusk?) in the coming years.

    Obviously this example is only tangentially related to the dastardly duo, but any benefit of the doubt will fall against America for the foreseeable.

  • I thought this was by US request all along (Score:3)

    by unami ( 1042872 ) on Thursday February 13, 2025 @10:43AM (#65163747)
    Isn't it commom practice among the Five Eyes countries to have each extensively spy on the citizens of the others and then share that data to circumvent national rights?

  • Cutting off nose to spite face (Score:5, Interesting)

    by Bruce66423 ( 1678196 ) on Thursday February 13, 2025 @10:46AM (#65163757)

    'If the top U.S. ally does not back off, they said, Gabbard should consider limiting the deep intelligence sharing and cooperation on cybersecurity between the countries.'

    I thought you liked having a military base in the Chagos islands in the Indian Ocean, as well as various listening posts in the UK. There's a listening centre on the North Sea coast which the UK cut the US off from when there was a previous row; the US backed down.

  • ...bad guys will use it
    There are only two options, full security or no security

  • Let Britain figure out how to break said encryption.
  • In more normal times the USA would not 'demand' the UK do something, they would 'request' it and probably get a favorable response. However now there is a very real chance that the USA will invade and take control of another country with the threats against Gaza, Greenland and Canada. This is would be a huge step up from the normal interference that the USA undertakes in other countries.

    If the USA were to step over that line how would traditional USA allies respond? With invasion treats feeling more r
  • without British aid you will never win a war again,

Slashdot Top Deals

Our policy is, when in doubt, do the right thing. -- Roy L. Ash, ex-president, Litton Industries

Close