Advanced Data Protection, which encrypts iCloud data, has been pulled in the UK
Apple’s encryption fight in the United Kingdom could be the least of its worries, with industry observers fearful that other governments around the world will also try to weaken encryption on security grounds.
In the U.K., the government has attempted to force Apple to destroy the security of iCloud by providing it with a backdoor. While Apple has fought back, the incident can have a considerable chilling effect on digital security elsewhere in the world, regardless of whether or not the U.K. government gets its way.
The legal fight, which has already seen Apple disable Advanced Data Protection in the country, resulted in a secret hearing over the order. The behind-closed-doors nature of the courtroom battle led to calls from privacy advocates and even the U.S. government, demanding the details of the hearing to be made public.
The result of the hearing, which took place on March 14, has not been revealed. It is unclear if a ruling was made due to the gag order on Apple and the cloak-and-dagger nature of the fight.
It’s certainly a problem in the U.K., but it could become one elsewhere.
Privacy advocates told CNBC they fear that the legal fight over encryption could have a bigger effect. One that can bring the same sort of fight to other countries.
Unexpected effects
The U.K. encryption fight is one that affects more than one element of security, and also impacts users in other countries.
For a start, the U.K. order could potentially require Apple to give up access via a backdoor to not only the iCloud data for U.K. citizens, but also users based in other countries.
Then there’s the US-UK Privacy Shield, an agreement that helps protect data traveling across the Atlantic Ocean to servers owned by U.S. companies, without undermining the data protection rules of the UK. The UK-US Privacy Shield is an extension of the EU-US Data Privacy Framework, which provides somewhat similar protections.
According to Malwarebytes’ David Ruiz, the loss of end-to-end encryption for cloud storage is bad, but “the global consequences tip this into far worse territory.” The US-UK Privacy Shield replaced a safe harbour agreement struck down in 2015, which provided some protections of EU citizen’s data from things like NSA surveillance programs.
“With the UK’s order, I legitimately do not know what happens to the US-UK Privacy Shield,” Ruiz adds.
Emboldening action
A bigger potential problem on the horizon is that other governments could try to take on Apple and other tech companies in the same way. With the U.K. being a prominent fighter, this could embolden others to try and make Apple do the same thing.
Ruiz proposes that the “Five Eyes” intelligence alliance could see the action as promising. This could lead to the same sort of rules being introduced in Australia, New Zealand, Canada, and the United States, and in the same way.
Johns Hopkins Carey Business School assistant professor of information systems Javad Abed referred to it as a “policy earthquake.” With other countries having a history of fighting over encryption, including public calls from security agencies in the United States, Abed warns “some lawmakers might see the U.K. Situation as a playbook.”
In the U.S., this could come in the form of lawmakers using existing statutes to achieve the same goal, or to encourage executive action.
That said, Abed adds that there challenges to the U.S. doing the same thing. Strong free speech protections, a fragmented legislative process, and the threat of a bipartisan backlash could help prevent a U.S. equivalent from occurring in the first place.
Add in that the U.S. has publicly opposed the U.K. government’s order, and it becomes harder for the United States to justify performing the same action for its own ends.
