Apple iCloud - downgrading of encryption

Frozen_up_north

As some may have noticed, Apple are ceasing end to end encryption on iCloud (the Advanced Data Protection (ADP) tool) as a result of UK Government pressure to allow access to users' data. Details:

https://news.sky.com/story/apple-removes-advanced-security-tool-over-uk-government-row-13314003

Are DropBox, Google Drive, etc. next?

I use Proton Drive, but it is not as user friendly on an iPhone as the built-in iCloud... although backups of photos is automatic and files/photos can be uploaded/download and swapped to a PC. Proton are based in Switzerland and are highly unlikely to take notice of anything UK Gov Plc wants.

Any thoughts on alternatives that automatically backup notes, files, etc?

MattMattMattUK

Frozen_up_north said:

As some may have noticed, Apple are ceasing end to end encryption on iCloud (the Advanced Data Protection (ADP) tool) as a result of UK Government pressure to allow access to users' data. Details:

https://news.sky.com/story/apple-removes-advanced-security-tool-over-uk-government-row-13314003

Are DropBox, Google Drive, etc. next?

No, because they do not offer end to end encryption.

WhatsApp may be in their sights, though Meta has always said they would withdraw the product entirely from that country if a government tried to force them to remove end to end encryption.

Frozen_up_north said:

I use Proton Drive, but it is not as user friendly on an iPhone as the built-in iCloud... although backups of photos is automatic and files/photos can be uploaded/download and swapped to a PC. Proton are based in Switzerland and are highly unlikely to take notice of anything UK Gov Plc wants.

Any thoughts on alternatives that automatically backup notes, files, etc?

I would not worry about it, most people do not use ADP anyway, the normal iCloud service will be fine.

Billxx

Matt above is spot on. Storage in iCloud uses basic encryption anyway, the encryption keys are stored in Apple servers.  Advanced Data Protection provided encryption that not even apple could decrypt.

So for most people, standard encryption is enough.

tghe-retford

The ultimate goal is to abolish end-to-end encryption and Apple are not in compliance with the law as it stands. The argument being is that privacy and encryption allows nefarious crimes to take place behind closed doors, whether in cyber space or real life. There is also the concept that the Internet is a public place and you have no right of privacy online. Eventually this will also extend to real life private spaces too.

Your only option is increasingly looking to host your own encryption offline or your own solution within a cloud storage solution. Bear in mind that withholding encryption keys from law enforcement is currently a crime that will land you an indefinite prison sentence until you hand everything over and in future, the use of encryption itself will be outlawed. At that point, assume everything you say, type or produce can be seen, read or viewed by anyone anywhere. The banks where encryption of private financial information is critical seem very quiet on what's coming down the line.

The other problem is that if the likes of Apple, Proton, Signal, Meta et al refuse to comply with demands to abolish encryption, their only option is to exit the UK market and they will have a legal requirement to prevent anyone from the UK accessing their services via a VPN. We're already due to see the fallout of mandated age/ID verification requirements for all websites accessible in the UK that host any age restricted content or anything not "safe for kids" by July and the mess that will cause. Or the levies that will be implemented on tech firms that the likes of X, Uber and Google have stated may have them exit the UK market.

DullGreyGuy

tghe-retford said:

The other problem is that if the likes of Apple, Proton, Signal, Meta et al refuse to comply with demands to abolish encryption, their only option is to exit the UK market and they will have a legal requirement to prevent anyone from the UK accessing their services via a VPN. We're already due to see the fallout of mandated age/ID verification requirements for all websites accessible in the UK that host any age restricted content or anything not "safe for kids" by July and the mess that will cause. Or the levies that will be implemented on tech firms that the likes of X, Uber and Google have stated may have them exit the UK market.

Other than that isnt what the UK law states, even if they were to exit the UK market the Investigatory Powers Act isnt limited to UK citizens, UK territorial limits or UK companies. How enforceable they would find the law to one not operating in the UK is another matter. 

tghe-retford said:

the use of encryption itself will be outlawed. At that point, assume everything you say, type or produce can be seen, read or viewed by anyone anywhere. The banks where encryption of private financial information is critical seem very quiet on what's coming down the line.

This is where the UK is going in the opposite direction from its peers, US etc are currently pushing for greater encryption to enhance security and avoid single points of failure. I think quantum computers or other vast steps in processing power which will make current security standards useless is more likely to happen first. 

bob2302

tghe-retford said:

...  the use of encryption itself will be outlawed. At that point, assume everything you say, type or produce can be seen, read or viewed by anyone anywhere. The banks where encryption of private financial information is critical seem very quiet on what's coming down the line.

 It's an entirely different situation to Apple, banks aren't holding data they can't read.