Recently, the UK administration requested that Apple reduce the security measures of iCloud for its users globally. On Friday, Apple initiated actions to align with this request for individuals in the United Kingdom. However, the British legislation is crafted in such a manner that mandates Apple to grant its government access to users from any location around the globe. If the government insists that Apple compromise its security on a worldwide scale, it would heighten everyone’s cyber risks in an already perilous environment.
For iCloud users, there exists an option to enable a feature known as “advanced data protection,” or ADP. When activated, the majority of your information is protected by end-to-end encryption. This indicates that no individual, not even someone from Apple, can access that information. It’s a limitation applied through mathematics—cryptography—and not merely a policy. Even if an individual successfully breaches iCloud, they won’t be able to access ADP-secured data.
Utilizing a contentious authority in its 2016 Investigatory Powers Act, the UK government wishes for Apple to reconfigure iCloud to incorporate a “backdoor” for ADP. This backdoor would allow UK authorities to potentially surveil a user in the future if needed. Instead of implementing such a backdoor, Apple opted to disable ADP for the UK market.
If the UK government continues to uphold its demands, the consequences will resonate deeply in two ways. Firstly, Apple cannot confine this functionality just to the UK government, nor to other governments with which it aligns politically. Should Apple comply with governmental requests for user data, every other nation will anticipate the same adherence. For instance, China will likely insist that Apple identifies dissenters. Apple, already reliant on China for both sales and production, might find it impossible to deny such requests.
Secondly, once a backdoor is established, others will likely attempt to exploit it clandestinely. A tactical means of entry cannot be restricted solely to individuals with legitimate legal authority. Its very presence encourages others to make an attempt. In 2004, hackers—identity unknown—compromised a backdoor access feature in a significant Greek cellphone network to monitor users, including Greece’s prime minister and other governmental figures. Just last year, China breached U.S. telecommunications and gained access to systems that facilitated surveillance on cellphone users, potentially encompassing the presidential campaigns of both Donald Trump and Kamala Harris. This incident led to the FBI and the Cybersecurity and Infrastructure Security Agency recommending that all individuals utilize end-to-end encrypted messaging for their safety.
Apple isn’t alone in offering end-to-end encryption. Google provides this capability as well. Applications like WhatsApp, iMessage, Signal, and Facebook Messenger extend the same level of security. Numerous other providers also offer end-to-end encrypted cloud storage. Comparable security measures are available for smartphones and laptops. Once the UK causes Apple to compromise its security, similar actions against these alternative systems are almost inevitable.
It appears improbable that the UK isn’t synchronizing its initiatives with the other “Five Eyes” nations—namely the United States, Canada, Australia, and New Zealand: the affluent English-speaking intelligence alliance. Australia enacted a comparable law in 2018, empowering it to require companies to diminish their security features. As far as we are aware, it has never been executed to compel a corporation to reconfigure its security—but due to the law’s gag order, we may never find out. The UK legislation also includes a gag order; we are only informed about Apple’s actions because a whistleblower disclosed it to the Washington Post. For all we know, similar demands may have been made of other companies. In the United States, the FBI has long championed for such powers. The UK’s timing of this request during a period of distraction from the foreign-policy upheaval of the Trump administration may be the opportunity they have awaited.
The corporations must resist, and—more critically—we must insist they do so. The UK government, akin to the Australians and the FBI in previous years, claims that this form of access is essential for law enforcement, arguing that it’s “going dark” and that the internet is rife with lawlessness. We have encountered such rhetoric since the 1990s, but its minimal evidence does not hold credibility. Numerous court cases involving digital evidence repeatedly demonstrate that police gather evidence through various means, most of which—such as traffic analysis or informants—are unrelated to encrypted data. What law enforcement agencies require are improved investigative and forensic computing capabilities, not backdoors.
We can all contribute. If you utilize iCloud, contemplate activating this feature. The more individuals who employ it, the more challenging it becomes for Apple to disable it for those needing protection from incarceration. This also exerts pressure on additional companies to provide comparable security. And it aids those in need to persevere, as enabling the feature cannot serve as an implicit admission of guilt. (This is an advantage of utilizing WhatsApp over Signal. Given that a vast number of global users are on WhatsApp, having it on your device does not inherently appear suspicious.)
In terms of policy, we face two paths. We cannot construct security frameworks that function for some individuals but not others. We can either ensure that our communications and devices are as robust as possible against any entity seeking access, including foreign intelligence organizations and domestic law enforcement, which safeguards everyone, including (unfortunately) those engaged in criminal activities. Alternatively, we can compromise security—that of criminals and everyone else too.
This presents a dilemma of security versus security. Certainly, we are all more secure if law enforcement possesses the ability to investigate and resolve crimes. However, we are likewise safer if our data and communications are secure from unauthorized surveillance. A backdoor within Apple’s security not only poses personal risks but threatens national security. We inhabit a world where electronic communication is ubiquitous, and key data is stored digitally. These devices and systems are utilized by every national leader, legislator, police officer, judge, executive, journalist, dissenter, political strategist, and citizen. They need to be fortified against threats, from account takeovers to ransomware, and from external espionage and manipulation. It’s worth noting that the FBI recommended that we all adopt end-to-end encryption without backdoors for messaging just a few months back.
Securing digital infrastructures is challenging. Defenders must thwart every assault, while snoopers require just one successful attempt. Given the critical nature of these devices, a defense-dominant approach is essential. Any deviation from this principle renders us all less secure.
This article originally appeared in Foreign Policy.