Apple Challenges UK Order for Access to Encrypted User Data

Apple has launched a new legal challenge against a United Kingdom government order that seeks access to user data stored on its iCloud service, particularly data protected by its Advanced Data Protection feature. This feature, which is opt-in, utilizes end-to-end encryption, meaning even Apple cannot access the content of users' backups, drive storage, photos, and voice memos.

The government's requests were issued under the Investigatory Powers Act (IPA), which includes provisions for technical capability notices. These notices can compel companies to provide UK security services with methods to access customer data. The government previously attempted to keep legal challenges to an initial notice secret, but this notice was later withdrawn after drawing criticism from U.S. politicians concerned about its implications for American citizens' data.

A subsequent request was issued by the government in October, specifically excluding U.S. users. Privacy advocacy groups, including Privacy International and Liberty, have expressed support for Apple's renewed legal action. These organizations view end-to-end encryption as a critical security tool for protecting sensitive personal information.

Privacy International stated that if Apple's claim addresses the orders aimed at undermining iCloud security, it is crucial for preserving public privacy and security. Liberty's director of external relations, Ruth Ehrlich, emphasized the far-reaching implications for privacy rights, noting the risks associated with creating backdoors to encrypted data like bank details, health information, private conversations, and images.

However, the Investigatory Powers Commissioner, Sir Brian Leveson, has previously cautioned against the use of the term "backdoor." He has stated that such notices are only issued if deemed necessary and proportionate by the Secretary of State, with independent review and approval by a Judicial Commissioner. Furthermore, any requests for data access under the IPA require separate authorization and are subject to independent oversight.