Apple has stopped offering end-to-end encrypted iCloud backups in the UK due to a legal order.

Apple recently made a significant change in the UK, discontinuing the option for end-to-end encrypted iCloud backups. This decision came after the UK government issued a Capability Notice, requiring Apple to provide access to encrypted data. This affects how securely user data is stored and who can access it, sparking debates about privacy versus security.

This means Apple and authorities can access user data, raising privacy concerns.

For new UK users, they won’t have the option to enable Advanced Data Protection (ADP), which provides end-to-end encryption for iCloud backups, photos, notes, and more. Existing users with ADP enabled will need to disable it, meaning their data will no longer be end-to-end encrypted and could be accessed by Apple and, by extension, authorities with legal requests. However, some data like Health and Passwords remain end-to-end encrypted under standard protection.

Apple’s Position

Apple expressed disappointment, emphasizing the importance of end-to-end encryption for user privacy, especially with rising data breaches. They stated, “This is a disappointing development,” and reaffirmed they won’t create backdoors, highlighting a conflict between privacy and law enforcement needs.

Background on End-to-End Encryption

End-to-end encryption ensures that data is encrypted on the sender’s device and can only be decrypted by the intended recipient, meaning even the service provider, like Apple, cannot access it. For iCloud, Advanced Data Protection (ADP) extends this to additional data types, such as backups, photos, and notes, beyond the 15 categories already end-to-end encrypted by default (e.g., Health data, Passwords).

Imagine sending a secret letter in a locked box that only you and your friend can open; that’s end-to-end encryption. Without ADP, it’s like Apple holding a master key, allowing them to unlock the box if needed.

The Capability Notice and Legal Context

The Capability Notice (TCN), under the UK’s Investigatory Powers Act 2016, is a legal order requiring telecommunications operators, including Apple, to have the technical capability to assist with interception warrants or access communications data. This notice demanded Apple provide access to end-to-end encrypted iCloud data, which conflicts with the encryption’s design, as Apple doesn’t hold the decryption keys.

To comply without building a backdoor—something Apple refuses, citing security risks—they decided to remove ADP in the UK. This is a first for Apple, as they’ve never before removed a privacy feature due to government demands, making this a significant and surprising development.

Impact on UK Users: Detailed Breakdown

For new UK users, ADP is no longer an option, meaning their iCloud data (backups, photos, notes, etc.) will use standard encryption, where Apple holds the keys. This allows Apple and authorities, with legal warrants, to access this data. Existing users with ADP enabled must disable it, and according to Apple’s support page (iCloud data security overview), when disabled, the data reverts to standard protection, reducing end-to-end encrypted categories from 25 to 15.

This means sensitive data like photos or notes could be accessible, which might worry users, especially those with private information. However, data like iMessage and FaceTime remain end-to-end encrypted, unaffected by this change, as they are part of the 15 categories under standard protection.

Alternatives for Users

Users concerned about privacy can explore third-party apps or services offering end-to-end encryption, though these may lack the seamless integration of Apple’s ecosystem. Alternatively, they could avoid backing up sensitive data to iCloud, but this isn’t practical for many, given iCloud’s convenience.

Apple’s Stance and Statements

Apple has been vocal about their disappointment, stating, “We are gravely disappointed that the protections provided by ADP will not be available to our customers in the UK given the continuing rise of data breaches and other threats to customer privacy,” as reported by BleepingComputer. They emphasized, “Enhancing the security of cloud storage with end-to-end encryption is more urgent than ever before,” highlighting their commitment to privacy.

Apple also reaffirmed, “As we have said many times before, we have never built a backdoor or master key to any of our products or services and we never will,” linking to prior statements, as noted by TechCrunch. This stance underscores the tension between privacy and law enforcement, with Apple refusing to compromise security for all users.

Broader Implications and Reactions

This decision has raised alarms among privacy advocates, with the Electronic Frontier Foundation (EFF) calling it an “emergency,” urging Apple to resist undermining private communications. They fear this could set a precedent for other governments to demand similar access, eroding digital rights globally.

The move is unprecedented, as Bloomberg described it as a “stunning development,” noting it’s the first time Apple has caved to such demands, potentially signaling a shift in tech company-government relations.