U.K. orders Apple to let it spy on users’ encrypted accounts

It's also worth noting that one of the ways the five eyes get around domestic spying laws is to spy on each other's citizens. So the CIA spy on British citizens the UK government want to spy on, and GCHQ spy on American citizens the US government want to spy on. So this would indirectly allow the US government to spy on US citizens (even more than it already does, anyway)

Why are you using Russia and China as examples of the bad guys here. They're not asking for global access to everyones data, the UK is. The UK are the bad guys.

The thing is, most people think that governments wants new tools for surveillance. The fact is, they had this power for a very long time (see Crypto A.G. and history of NSA and others), and practical and verifiable E2EE took these capabilities away.

Now they want their toys back. This is why the push is so hard and coming from everywhere at once.

What stops them is one of two things:

Option 1: they operate a separate shard in that country and that shared is only accessible by that country. Companies like Apple, AWS, Cloudflare etc. have been doing it this way in China for a while now. Result: they can spy on the stuff in their country, but the only stuff in their country is their own stuff.

Option 2: no longer operate in an official capacity in that country. Have no people and no assets. Mostly works when the country is not a significant market. This usually means some things are only available grey market, black market or not at all. This is why certain products have lists of "supported countries" - it's not just ITAR stuff but also "we don't want to deal with their regime" stuff. Result: country gets nothing, no matter how loud they ask. Side-effect: you can't really risk your employees visiting such a country as they will be "leveraged".

> If Apple can provide the UK government with foreign data, what's to stop Russia or China making them provide data on UK minister's phones, or more likely dissidents in exile?

nothing

the first precedence of not-draft law here was Cloud Act I think

through I would be surprised if China doesn't "de-facto" requires Chineese companies operating outside of China (including Subsidiaries) to cooperate with their secret service in whatever way they want

and if we go back to the "crypto wars" of the ~2000th then there is a lot of precedence of similar law _ideas_ by the US which where turned down

similar we can't say for sure that there aren't secret US court orders which already did force apple to do "something like that" for the FBI or similar, SURE there is a lot of precedence of Apple pushing back against backdoor when it comes to police and offline device encryption, but one thing is in the public and the other fully in secret with gag orders and meant for usage in secret never seeing the light of courts so while it's somewhat unlikely it would be foolish to just assume it isn't the case, especially if we go forward one or two years with the current government...

Anyway UK might realize that now they have left the US they have very little power to force US tech giants to do anything _in the UK_ not even speaking about regulation which is a direct attack on the sovereignty of other states to own/control/decide about their population(s data).

IMHO ignoring the US for a moment because they are in chaos the EU, or at least some key EU states should make a statement that a UK backdoor allowing UK to access EU citizen data would be classified as espionage and isn't permittable if Apple wants to operate in the EU (but formulated to make it clear it's not to put pressure on Apple but on the UK). Sadly I don't see this happening as there are two many politcans which want laws like that, too. Often due to not understanding the implications undermining encryption has on national security, industry espionage and even protection of democracy as a whole... Sometimes also because they are greedy corrupt lobbyist from the industry which produces mass surveillance tools.

There are tangentially similar precedents already, such as the American FACTA law. It is obviously a quite different context, as it just relates to financial information, not all information - but it's a law from the US government, that demands foreign companies send information back to the US.

The wild thing is that foreign companies actually do it. To avoid annoying the US, a lot of other governments ensure that the data is reported.

https://en.wikipedia.org/wiki/Foreign_Account_Tax_Compliance...

> what's to stop Russia or China making them provide data on UK minister's phones, or more likely dissidents in exile?

Realistically: Apple is a US company (with lots of foreign entanglements) with US leaders, and the US and UK are close allies with extradition treaties and the like. I'd expect the US government to put lots of pressure on Apple to prevent it from acting on such requests from Russia or China, and I wouldn't be surprised if Apple execs would get slapped with espionage charges if they didn't head the warnings (especially if they "provide data on UK minister's phones").

We are watching the redefinition of the idea of territorial sovereignty that emerged from the Peace of Westphalia in 1648. We in the US see our expectations of privacy shaped in the UK, and the reverse.

Give me that sort of commitment to privacy and translucent colorful cases for future Macs and Tim Apple's got my money for the next five years at least.

Give Apple a big enough incentive to negotiate with and they may very well cave. If I've learned anything about corporations, it's that money and incentives always speak louder than their purported values.

Yes, this would be something i would love to read

In China, Apple limits end to end encryption and stores user data on state-owned servers. The Chinese app stores censors apps like the New York Times and Washington Post, disallows privacy apps like Signal, or any VPN that might bypass the great firewall.

I think the odds that they quit trying to earn the ~$100B annual revenues they get from the UK over this is closer to zero than 1

They obviously don't care about privacy enough to fully withdraw from the UK! That would be insane.

Tim Apple has been on inauguration, so very possible.

I have bad news for you...

So at least we don't have to worry about anything. Apple can give them access to LLM generated SQLite rows and call it a day. Nobody would notice.

Yes but no, post WW2 the UK was one of the most liberal places in the world. Somehow things took a turn in the past two decades or so. And then around the 2020s the decline started to rapidly accelerate. The stories that have come out lately are really insane.

Perhaps. Another possibility is that the same societal shift that drove the UK to give up the right to be armed also pushed them in the direction of giving up other rights.

Poland broke the Enigma code .. and built the first Bombes.

Maybe you're thinking of William Thomas Tutte breaking the Tunny (sawfish) code?

The war on terror was a big thing in the UK long before 2001—largely because there was in fact quite a lot of terrorism going on there, to be clear.

As Apple isn’t based in the UK and owes no fealty to their government. I don’t agree that your citation is relevant here. Apple is a US company. Bribing local officials to overlook the gay founder is sensible corporate practices, however uncomfortable that is to consider. Revoking privacy guarantees globally, reversing years of public opinion gains overnight, is not. The UK cannot do anything to materially harm Apple in any way that Apple can’t afford short of sending a double-oh to Cupertino.

Of course Apple doesn't have principles, they're a for-profit company. What's in question here is whether they believe the UK is financially worth opening this can of worms. Following US government whims is good business for them in almost all cases, but that math isn't the same for the UK.

For $1 million, you’re promised intimate access to Trump and his inner circle. This isn’t just about tradition or unity-it’s about buying influence and maintaining power. In a world where we’re supposedly pushing for fairness, equality, and transparency, this feels incredibly hypocritical. It’s as if we’re endorsing a system where money talks louder than public interest or ethical considerations. It makes you wonder where the line is between modern capitalism and a system that operates more like an oligarchy.

Google had shareholders in 2005 too or thereabouts when they publicly decided to abandon the Chinese search market for soft, fuzzy reasons (i.e., not because they were losing money on Chinese operations).

And as far as I know, they're still absent from the Chinese search market.

Imagine weighing the right of privacy of everyone in the world against the right of safety of 0.8% of the world population.

one can't compare china and the uk.

china had leverage because of the manufacturing happening over there and the incredible market opportunity, UK doesn't have much.

technically i believe apple could get out of the UK market to provoke a backslash on the government.

If they concede, other government will use the exact same blackmailing technique and one can say it will be the absolute end of their "privacy" marketing campaign they spent so much money into.

Apple offers the same escrowed key and non-escrowed key (advanced data protection) features in China as far as I'm aware. The extra capability GCBD has would be access to protected at rest data like iCloud email.

Their Irish tax haven is rather specifically _not_ in the UK.

Apologies for any offense given. Total brain fart moment. If I could delete this comment I would

Go ahead and call someone from Ireland, British.

Ireland is in EU. UK is not in EU anymore

I have lived to the day that we give an example on china not doing something stupid a western democracy does about rights and freedom. Wild times to be alive. I am also surprised that they demand worldwide access and not just UK users data or all the data stored in UK jurisdiction. But this is going too far.

It can be enforced in this way: police raids the local headquarters and jail a bunch of people because their company didn't comply with the law.

The only way to prevent that is not having any local office, no employees, nothing. Sell physical objects only by the means of local 3rd party resellers which will import goods. Same thing for services. Of course they can ban imports and services or go after those 3rd parties. It depends how nasty they want to be.

> I'm still missing how this could be enforced ?

By banning Apple from doing business in the UK.

The US used a similar strategy decades ago to break Swiss Bank Secrecy laws (either Swiss banks had to give up the info or they were going to be kicked out of the US).

Sadly jurisdiction has nothing to do with it.

https://www.irishtimes.com/business/technology/uk-spy-base-g...

This is not just a case of the British intelligence services secretly “tapping into” Irish telephonic and internet traffic via land and maritime cables. Rather in most cases they are being provided free (or commercial) access to the information by companies associated with the use, ownership or maintenance of these cables.

Post-Snowden the Irish government retroactively legalised it...

> I'm still missing how this could be enforced ?

Basically by saying that if they don't comply, they can't do business in the UK.

The US CLOUD act says something similar to your straw man (though it doesn't ban E2E encryption like the UK is attempting to do):

https://en.wikipedia.org/wiki/CLOUD_Act

Note that it the bar is having the ability to access the server, so this law is completely incompatible with most GPDR solutions: It's illegal to store European user data and then refuse to hand it over to US law enforcement, regardless of whether the data is stored in Europe or the request breaks European law.

I imagine they would fine apple a large sum of money. If apple refuse to pay they send high court sheriffs to confiscate any property they have in the UK to pay the debt.

The opposite is happening all the time - i.e. US demanding access to European data from Facebook and Google et al. It is not one-sided.

> More importantly, apple has customers in the UK. The business from captured apple users is more valuable than apple's privacy reputation.

Is it though? I wonder how much of Apple's revenue is from the UK, probably around 5-6%? Apple isn't exactly as popular in the rest of the world as they are in the US.

Would damaging their privacy reputation globally be more valuable than the UK market? I honestly don't know, but my hunch says no - they are likely to want to keep their reputation and dump the UK market. I think more likely is Apple is going to be able to get the UK to cave in. Apple is extremely competent with PR, and would be able to spin any kind of pull-out or degraded service in the UK as the government's choice and fault, to the ire of UK citizens.

Who has more to lose though? I mean any government that would do something as stupid as banning Apple because Apple didn’t allow it to spy on its citizens wouldn’t be very popular or last that long..

I mean this would be even more stupid than Partygate and the whole Truss debacle put together.

"As far as we know" is the most important part.

We know.

Of course that's a thing. However, anyone who's ever read a history book has a pretty good reason to be suspicious it ends there.

Collude seems like a pretty good word for an alliance formed for the purpose of subverting the law.

> a back door that allows UK security officials unencumbered access to encrypted user data worldwide

As far as I can tell, China is asking to keep Chinese data in China and have access to it, but it is not asking to access data of American or European citizen and if it did we would be pissed off.

Simply answering "no" when that's the truth could be illegal too. The ability to say no creates the ability to say yes as well. If I ask Apple whether they got an order and they say "no", then a year later they say "we cannot confirm nor deny", well then that's a yes.

Kinda depends on judicial interpretations of free speech, but that's how warrant canaries work. Are warrant canaries legal in the UK? They seem to be in the US but idk how well established that is.

That concept has always sounded like tech people trying to hack the law without the proper real-world legal knowledge, IMO.

Bruce Schneier wrote in a blog post that "[p]ersonally, I have never believed [warrant canaries] would work. It relies on the fact that a prohibition against speaking doesn't prevent someone from not speaking. But courts generally aren't impressed by this sort of thing, and I can easily imagine a secret warrant that includes a prohibition against triggering the warrant canary.

Lots of similar discussion on HN already, e.g. in https://news.ycombinator.com/item?id=5871541.

You're right to point out how carefully worded these statements are. But I suspect it's rare for companies of Google's status to not have been asked for a backdoor. It's not really an informative question to ask Google.

no one, you'll be in secret prison before you somehow gain standing

Such actions, even just the act of deleting text, conveys a message you were ordered to not convey and the government is not likely to take too kindly to that.

The impression I have is that (some) people in the UK protest but are ignored, vilified, or punished for it. And then nothing changes.

The last time I wrote to my MP, I got a form letter back basically saying "Don't bother contacting us, only The Party matters". (I mean, those weren't the words at all; but having had lame-but-bespoke messages back from them in the past, this was a noticeable and disheartening change).

No right to own money. That will be taken away when cash is phased out.

No right to be mean on social media, too.

As far as I know they haven’t started murdering political opponents yet, so that’s something. But I take your point, the UK is today not a serious country for a variety of reasons.

They have this power precisely because you have given up. Government power is derived from the consent of the goverened. Collective action does work and always will, but it needs to be coordinated. If enough people in the UK stopped going to work, they could affect change pretty quickly I reckon.

Don’t you think maybe this attitude is part of the problem?

Brit here.

> Hardly anyone gets prosecuted and those who do have often done something bad.

Perhaps often they've done something bad, but sometimes they haven't, that's the point. Obviously this is wrong and you shouldn't be so passive about it.

> If they are planning a totalitarian takeover they are being very sneaky about it. There is a strong anti totalitarianism tradition here including elections since 1265, writing books like 1984 and bombing nazis.

I'd argue people in the UK today like to adopt the label of being anti-authoritarian and anti-totalitarian, but in reality most people here, including our politicians, quite like authoritarianism.

For example, people here often argue things like "I support free speech, but obviously insulting someone for their identity is wrong". So in the UK we apparently have free speech and I can apparently criticise religious people, but at the same time just this week someone in the UK was arrested for burning a bible.

You see this hypocrisy constantly in the UK... "I'm not an authoritarian, but smoking is bad". "I'm not an authoritarian, but you can't be saying that". "I'm not an authoritarian, but if you're worried about mass surveillance you probably have something to hide". "I"m not authoritarian, but you can't just let people have private data on an encrypted device which the government can't access".

The UK is very authoritarian these days, but unlike other parts of the world people here deny it while arguing in favour of more of it.

There's nothing necessarily wrong with being authoritarian and wanting the government to have more control either. Clearly many countries find this type of government appealing, but lets at least be honest about it. We don't want kids on social media. We don't want people smoking. We don't want people being about to call people names on Twitter. We don't want people burning religious texts. We don't want people being free from government surveillance.

Today, maybe, even so it probably depends on who you ask.

The thing about giving your rights away is that it’s very difficult to get them back, and you never know who “they” are going to be in the future.

Plenty of people have been jailed in the uk for not providing pins or passwords.

> and spiteful, authoritarian politicians taking power.

Or spiteful, authoritarian non-politicians taking power, spreading misinformation, and censoring free speech:

https://www.techdirt.com/2025/02/03/musk-shows-us-what-actua...

It's only an offence if you "knowingly fail" to provide it - https://www.legislation.gov.uk/ukpga/2000/23/section/53

s3 makes it clear that if you plausibly claim you have forgotten it, then the prosecution must prove this is not the case (i.e. you still know it) beyond reasonable doubt.

It’s illegal but they do it anyways. Recall there was a man named Snowden who revealed the NSA does collect USA citizens’ data.

It's not a pet theory when there's proof they have engaged in it through five eyes. We're not saying it respects the constitution or its intent. We're saying it's what happens.

Black CIA sites weren't legal either, nor was torture.

Why would they "access [their] data", instead of a report from a foreign intelligence agency?

Social media ban for under 16s is the latest half witted idea enacted by the government here.

Any specific whacky examples?

> legislatures

He will just do an executive order. He is an authoritarian, basically a king. "But but but it's illegal". The system can't keep up with speed he is dismantling it.

I'm not sure what the hypothesis is in your experiment, i agree that all that stuff is really bad

Parent seems to be attempting to discredit, not protect, Labour by calling them "Tory-lite".

This stuff started from the Online Safety Act 2023 passed under Rishi Sunak's Tory government.

For some reason Americans, including Musk, go all partisan and feel the need to blame speech restriction on the lefty party but it's not what happened.

You know the answer, of course with FPTP there's only two parties with a realistic chance. But why do they? Because you keep voting on them. Your votes made e.g. Corbyn lose but Starmer win. What signal does this give off? A very different signal than if both would've lost. Would another Tory government would have been even worse? In the short term, maybe. But this kind of short-termism is what has got Labour (and all of the other similar parties all over Europe) in this exact predicament. Better to make them lose for picking an awful candidate that's a Tory-lite and bite the bullet. It's not like the Tories would have kept winning for decades on end with the way things were going.

RIPA and key disclosure law came in under Tony Blair's labour government as well, along with https://en.m.wikipedia.org/wiki/Communications_Data_Bill_200..., arguably the precursor idea to the IPA that this notice was issued under.

Huh? You completely misunderstood what I meant by that moniker. In no way at all does it absolve them of blame - quite the opposite, it's calling them nearly as bad, so close that the difference doesn't really matter.

Well, in the UK just planning a non-violent protest can get you 5 years in prison as many people have already discovered. Protesting has been pretty much made illegal by a very broad legislation that defines any protest that causes "disruption" as illegal - what "disruption" means is up to interpretation of course.

Labour have no problem with it, just the same as the Online Safety Act which is causing chaos right now. They're fine with the legislation and have never expressed a desire to see it repealed. They didn't even do much to prevent it in the first place.

This is what the parent comment is getting at when they say "Tory-lite".

"Tory-lite" is a pejorative for Labour, the implication being that they are almost identical in behaviour.

(I very much agree with the sentiment...)

Which party do you think passed the "Tell us your password or go to prison law" to begin with?

(Hint: It certainly isn't Tory.)

It's also one of the reasons why I will never vote Labour as long as I live.

Are you still under the impression that different political parties will actually do diffrent things? It even sounds like you think Labor are 'good' and the Tories are 'bad'. I think you may change this opinion after the next 4 years.

My sweet summer child. It's a false dichotomy, like most of these types of issues, it has actual bipartisan support.

Same thing happens in many other countries no matter how strongly HN users want to tell you A is literally hitler and B is great.

Labour caused it. Why would they repeal what they want?

Ahh, I used to have that opinion, but I've encountered too many "It's fine if they want it, I've got nothing to hide" people. (They never give you their Facebook password if you ask, though. Funny, that.)

Change what you can, I say, VPN on the network device.

no idea, UK is not important enough to follow their politics. vote for whoever supports privacy.

[dead]

Why now? Well FWIW I also don't have much hope it will happen. But maybe the needle will be moved if Apple doesn't back down and it affects UK iPhone users.

Judges only interpret the law as laid down by parliament. And, in theory at least, parliament cares about public opinion.

Even in that case, Apple could withdraw from the market.

If push comes to shove and apple actually called their bluff and withdrew completely from the UK market, I'd bet that that government would become so unpopular that they would not be elected again for quite some time.

Gag orders affect information, not whether they continue to provide a service or not.

I expect everyone would read between the lines if Apple simply offered "no comment".

Apple can't offer icloud with encryption. It doesn't force them to offer the service at all afaict? Forcing a company to offer service at all seems like a gigantic judicial overstep IMO.

I have zero clue where you’re getting this from. iPhone is incredibly popular and every politician has one.

Then it sounds like they don’t have much to lose ¯\_(ツ)_/¯

As I responded in a sibling comment, that is true when you are being targeted: for blanket surveillance of innocent citizens, it will work wonders.

The problem with just doing encryption is that it can be made illegal and it's obvious when you are using it with a cloud platform. The same is true for steganography (you can make it illegal), but someone would have to know you are using it to apply the same tactic.

Also because the candidate who won the first round and was almost guaranteed to win (not the nut job TikTok guy who came second) didn’t belong to any of the major parties. So the government wasn’t particularly excited about that…

2) why wasn't the person/party that broke the law penalized then? PNL was found to have paid for the TikTok ads for Georgescu. Did they get even a slap on the wrist?

I don't want them to be, they make themselves exempt.

It's bad. It's one of the causes that triggered the French Rebellion in 1793: one rule for them, one for us?

yes, more Jack Straw specials