Apple Halts Advanced Data Protection in the UK

Apple on Friday said it will no longer offer its Advanced Data Protection (ADP) service to customers in the United Kingdom, the result of an order that the UK government sent to the company recently that demanded that Apple build a mechanism to give law enforcement access to users’ encrypted ADP backups. 

That order–which is secret but was reported by The Washington Post–essentially left Apple with two choices, neither one of which is ideal: insert a backdoor into ADP for law enforcement agencies or withdraw the service from the UK. Apple chose the latter, which is consistent with the company’s historical stance on encryption in its services. 

“We are gravely disappointed that the protections provided by Advanced Data Protection will not be available to our customers in the United Kingdom, given the continuing rise of data breaches and other threats to customer privacy,” Apple said in a written statement to the Post on Friday. “Apple remains committed to offering our users the highest level of security for their personal data, and we are hopeful we will be able to do so in the future in the United Kingdom.”

It’s important to note that this decision specifically applies to ADP users. ADP is an extra level of security that users can opt in to that provides end-to-end encryption of users’ iCloud backups. With ADP enabled, Apple does not have a key to decrypt users’ backups. Each user sets up a local backup of their data on their own devices and only that user has access to that data. Apple does not have a way to get to it. This decision has no effect on normal iCloud backups, which are stored on Apple’s servers. Those backups can be accessed by Apple under certain circumstances, and law enforcement can get to them too, with a warrant. 

Which is why Apple created ADP a few years ago. With ADP enabled, individual users are the only ones who can access their own backups (leaving aside coercion). What the UK was demanding was a way to defeat this protection on demand. If you’ve read this far, you will understand that this set of circumstances is suboptimal for security and privacy. 

Apple’s decision was entirely predictable, given the company’s past public statements and actions in the face of government demands for access to encrypted services. There really was no other workable option. Apple has planted its flag on the summit of Privacy and Security Mountain™ and there’s no real way to walk back down that slope at this point. You can’t run national TV ads touting the privacy and security of your platform and then crack the door wide open for law enforcement to walk through. 

These are spooky times for reasonable people. The ground is shifting underneath our feet on an hourly basis, particularly when it comes to security and privacy, two words that soon enough we may have to whisper to one another as relics of a barely remembered recent past. 

Apple is among the more valuable companies on the planet and its officers are bound to do what’s best for its shareholders, so these decisions are not made in a vacuum. The company made a calculated choice. The number of ADP users in the UK is likely a tiny fraction of Apple’s overall customer base there, and Apple does not charge extra to enable ADP, so the decision to remove ADP from that market isn’t a huge financial burden for the company. It’s a political move. Time will tell whether it’s a deft one.