The "only used in exceptional cases" argument is the same tired line every government uses before mass surveillance becomes the norm. Once a backdoor exists, it's not just "good guys" using it; it's an open invitation for abuse.

• Cu3PO42

  today at 9:12 AM

  Indeed. During the pandemic, restaurants in Germany were required to track customer's information including addresses, so people could be informed in case of a confirmed CoViD infection of another customer who was there at the same time. Of course, this information was never to be used for any other purpose whatsoever.

  In one case, however, there was a capital crime near a restaurant (or similar venue) and police and prosecutor used this information illegally to track down witnesses. They were sued after the fact and lost, but got nothing more than a slap on the wrist.

  Once information is available, it will be used for purposes other than the intended one, even by the "good guys".

  • HPsquared

    today at 9:19 AM

    Better to simply not collect the data in the first place. It's like the hierarchy of controls used in risk management, from most to least effective:

    - Elimination – physically remove the hazard

    - Substitution – replace the hazard

    - Engineering controls – isolate people from the hazard

    - Administrative controls – change the way people work

    - PPE – protect the worker with equipment

    Only with hazardous data, or things like moral hazards rather than physical hazards.

    • moring

      today at 9:51 AM

      Offtopic, but do you know some good sources to read on that matter?

  • FirmwareBurner

    today at 9:39 AM

    >restaurants in Germany were required to track customer's information including addresses

    Ironic they went along with this considering how chest-pumping Germans are about their government being all about protecting their citizens' "privacy".

    >They were sued after the fact and lost, but got nothing more than a slap on the wrist.

    Government workers don't care about doing a good job since if they break the rules they won't get fired and the fines are not paid from their pockets but from the taxpayers pockets anyway so there's no incentive to be competent at your job.

• cedilla

  today at 9:03 AM

  It also always lead to the same downward spiral of prosecutors complaining that the data they need to investigate drug trade is right there, but they can only access it for terrorism reasons, so why not add drug trade to the list of exceptions. Repeat with homicide, then fraud, all the way down to traffic infractions.

I am very glad they are doing this as a UK based ADP user. Waiting to see how long before they forcibly turn it off for existing users. I will of course just remove everything from iCloud at that point.

• kennysoona

  yesterday at 7:34 PM

  It's not like you can use an alternative without facing jail time if you don't give up the keys.

  • PaulRobinson

    yesterday at 10:38 PM

    The penalty for not giving up keys is max 2 years in prison. Most offences that they're trying to use the encrypted data to use as prosecution evidence (for example, child pornography), have penalties that are way more than 2 years in prison.

    If you're genuinely innocent, the 2 years is horrid. If you're actually guilty, it's a cheap way to serve your time.

    It's a weird and perverse law that shouldn't exist, but it's likely in time the government will need to move the needle one way or the other, as habitual criminals are getting used to doing the maths.

    • llm_trw

      today at 2:35 AM

      This comes up every time someone wants to give the death penalty for rape.

      If the punishment for rape is harsher than the punishment for murder than anyone committing it may as well remove the evidence by using a blender.

      • robocat

        today at 2:59 AM

        Is there a academic study of the heuristic of choosing between option A versus option B?

        People (even criminals) are not perfectly economic thinkers. That's probably a good thing. I have this terrible thought of a quant rapist: juggling their risk that the victim stays quiet or otherwise acts (police or revenge). Deciding on the Kelly Criterion for losing 20 years in prison.

        I'd watch a movie about a killer using statistics properly. It is annoying when muderers are cast as being idiots. I imagine the protagonist runs a hedge fund and gets bored of getting away with white collar crime.

        • drdaeman

          today at 5:36 AM

          In this modern age, I'm rather interested in the inverse: lawmakers doing proper scientific research, and legislating based on that; attempting to discover the sociological or economical truths rather than chasing slogans and acting on beliefs and agendas.

          • danielscrubs

            today at 6:06 AM

            They do that in many countries. Basically they check the likelihood of being a repeat offender and try to minimize that. Tax crimes become harsher than violent crimes because of it, for example… it is not popular amongst the population though.

            • genewitch

              today at 6:36 AM

              I've only heard rumors that Scandy countries do this, do you have any references?

        • dspillett

          today at 8:36 AM

          > People (even criminals) are not perfectly economic thinkers.

          This imperfection feeds into the argument for not punishing rape as harshly as murder: the rapist is likely to misjudge the chances of the murder being discovered and traced back to them, when doing the risk math to decide how to proceed. If their imperfect thinking leads them to overestimate their chance of pulling off the perfect murder (or the perfect coverup after one) then that pushes the chance of equal punishment leading to more murders higher.

          "Doing risk math" oversells it for crimes of opportunity, where decisions about how to keep the action quiet after it has happened is going to be very emotion/panic (rather than facts/stats) driven, but for premeditated attacks I suspect things will flip the other way.

        • CobrastanJorji

          today at 4:52 AM

          But if criminals are not perfectly rational economic thinkers, harsher prison sentences may not be morally justified!

          • johnisgood

            today at 6:20 AM

            A behaviorist perspective on justice, punishment, and rehabilitation does not require morality.

            1. Pragmatism - Justice can be effectively framed around practical outcomes and societal safety, it requires no moral framework.

            2. Remorse and Emotional Response - Feelings of remorse can be understood as conditioned responses shaped by environmental influences rather than as reflections of moral responsibility; remorse does not necessitate moral weight as they can arise from societal conditioning and past experiences.

            3. CBT - Cognitive Behavioral Approaches demonstrate that behavioral and emotional changes can occur without delving into moral implications, and requires no moral reflection.

            4. Behavioral Accountability - Individuals can be held accountable for their actions based solely on their observable behavior and its consequences, without the need for moral judgments. The focus is on modifying harmful behaviors through interventions and reinforcements rather than assigning moral blame.

            So, this framework provides a rational and effective approach to understanding and managing human behavior, focusing on the pragmatic aspects of justice, rehabilitation, and accountability, it does not require an already shaky and subjective moral judgment or moral accountability, and as thus, need not be morally justified.

            If you want me to elaborate (with examples, too), I am willing to as my time allows.

        • matwood

          today at 7:21 AM

          > I'd watch a movie about a killer using statistics properly.

          At the start of the movie Heat, one of the hot head robbers kills one of the guards. De Niro, the leader of the robbers, immediately kills the other guard and says something along the lines of 'it's capital murder either way so may as well not leave any witnesses'. Ultimately, it's Di Nero being non-rational and driven by emotion that leads to the final scene in the movie.

        • chii

          today at 3:51 AM

          > People (even criminals) are not perfectly economic thinkers. That's probably a good thing.

          why is that a good thing?

          Perfect economic thinkers are good, because they'd be predictable and can be reasoned with. Providing economic incentives to such means you can direct behaviour in an easy and efficient way.

          Irrational thinkers cannot be reasoned with via economic rationality. Therefore, either you have to stack the incentives so high that the cost becomes overbearing, or you use some other means of control that's less nice.

          • contravariant

            today at 8:51 AM

            Perfect economic thinkers will kill one guy so his organs can save three others.

            Utility is a flawed way to capture ethics.

      • kennysoona

        today at 7:41 AM

        Except that rape and murder are separate offenses and both would be charged, not one or the other.

        • bryanrasmussen

          today at 8:16 AM

          they can't execute a criminal more than one time.

  • cpressland

    yesterday at 7:42 PM

    This is correct - but I’d rather my law enforcement had a pre-existing reason to investigate me rather than just stumbling upon something in random hidden searches. Innocent until proven guilty is key here.

    I have nothing to hide, but I’m still not giving you access to my photo library.

    • paxys

      yesterday at 11:17 PM

      Whether the data is encrypted or not, they still need a warrant.

      • account42

        today at 9:08 AM

        For now. Once the means are there it's only a matter of time until everything is scanned automatically.

      • KennyBlanken

        today at 4:21 AM

        Those warrants are secret. We don't even know if they're following the rules they lay out.

        In the US, the secret FISA court hasn't turned down a single warrant. Either the government is only coming to them with completely justified cases or they're just a rubber stamp. Either way, there's no oversight so we have no way of knowing.

    • Braxton1980

      yesterday at 10:47 PM

      [flagged]

      • bdamm

        yesterday at 10:56 PM

        You seem to think that the indexing and searching happens only if there is a reason. Why do you think that? There are all kinds of cases where government agents were found to have abused access to data for reasons that had nothing to do with illegal or immoral behavior by a target.

      • bloqs

        yesterday at 10:59 PM

        Irritatingly naive

      • willk

        yesterday at 10:55 PM

        Because they can.

        • Braxton1980

          yesterday at 11:10 PM

          So they randomly picked a person to search?

          • ethagnawl

            today at 12:19 AM

            They have a jealous ex who is a LEO.

          • reaperducer

            yesterday at 11:47 PM

            Never been across an international border?

            • yreg

              today at 12:18 AM

              Speaking of which, iOS needs to finally support user accounts, ideally hidden ones as well.

  • jackjeff

    today at 7:47 AM

    That’s not necessarily true.

    RIPA notices do indeed assume you’re in possession of the keys of anything encrypted and you must disclose when asked nicely.

    You just need an airtight provable way of showing you have a way to destroy that key when you push a button and do that before the notice arrive. I suspect that’s after they seize your stuff.

  • ben_w

    yesterday at 7:41 PM

    That's still a big improvement. A backdoor can be exploited by criminals who want personal gain, not just used as intended by police.

  • volemo

    today at 8:31 AM

    I can be criminally charged for encrypting my data (and keeping it encrypted)? That’s mental!

    Guess, I better delete that big file of random numbers from my computer.

    • kennysoona

      today at 8:52 AM

      > I can be criminally charged for encrypting my data (and keeping it encrypted)? That’s mental!

      That's the UK.

  • ohgr

    yesterday at 7:39 PM

    Indeed. But you can of course say "show me the court order" and defend yourself.

    • OsrsNeedsf2P

      yesterday at 9:01 PM

      Not in the UK. In fact there's precedence they can arrest you for not unlocking your devices, without a warrant[0]

      [0] https://www.independent.co.ug/activist-convicted-uk-terror-o...

      • ohgr

        yesterday at 10:20 PM

        They can arrest you for anything. I’ve been arrested twice. And questioned once. And apologised to twice.

        • ethagnawl

          today at 12:25 AM

          I was stopped and questioned twice within a span of about ten minutes while walking around near Parliament in the middle of the night because someone _supposedly_ called in some sort of a threat. I was severely jetlagged and had never been to London before, so I figured it wouldn't be any different than walking around NYC but that may have been naive on my part.

          • Reason077

            today at 7:46 AM

            You can walk around 99.9% of central London at any time of night and nobody is going to raise any eyebrows no matter how jet-lagged you look. But there's always a chance you're going to attract some attention outside Parliament, or certain embassies, especially if there's an "elevated threat level" or whatever.

        • 77pt77

          yesterday at 10:33 PM

          apologised?!

          Surely you're joking!

          No way that really happened or it was an empty apology like.

          > I'm sorry you made yourself suspicious

          • ohgr

            yesterday at 11:43 PM

            First time I was arrested for being next to a fight until I was cleared of any involvement. This required some explaining and the policeman was an idiot.

            Second time some busybody reported to the police that I was carrying a knife. This was a Santoku knife that I'd literally bought and was still in the plastic packaging but you could see it through the plastic bag I was carrying it in. We had a bit of a laugh about it and they apologised for wasting my time. They did however arrest me so that they could do a formal search and had right to as they had reasonable suspicion I was carrying it as a weapon. I'm not bothered they were very reasonable and so was I.

            • today at 2:57 AM

            • KennyBlanken

              today at 4:25 AM

              Nothing about either of those is reasonable.

              In the US both of those would have been handled with an Investigatory detention - same as being pulled over for a traffic stop. Not even remotely an arrest.

              > They did however arrest me so that they could do a formal search and had right to as they had reasonable suspicion I was carrying it as a weapon.

              What "reasonable suspicion"? They could see the "weapon" that had been reported and at that point it should have been "have a nice day" and then them trundling themselves over to whoever called it in and charged them with making a false report.

              I swear, UK police seem generally nicer than US cops but infinitely dumber and the shit you brittons put up with in terms of having your rights violated is astounding.

              • akimbostrawman

                today at 8:33 AM

                Because of the increase in knife crimes in the last couple of years the UK police have become incredible aggressive towards anybody in possesion of even small purpose knifes in public. I'm honestly surprised OP got away with it.

              • lolinder

                today at 4:37 AM

                > In the US both of those would have been handled with an Investigatory detention - same as being pulled over for a traffic stop. Not even remotely an arrest.

                I'm not from the UK, but it seems likely that this is just a question of semantics. Many US traffic stops are far more stressful—and handled in a way that is far less conciliatory—than the "arrest" that OP describes. It doesn't sound like they were taken to a police station or even necessarily handcuffed, more just formally detained.

                As for US detentions: It doesn't especially matter if they're not technically "arrests" in US parlance, you're still being stopped by the police and you still can't go anywhere until they let you because there's a too-high probability that they'll find an excuse to make your life miserable if you don't cooperate.

              • ohgr

                today at 7:19 AM

                At the same time they don’t tend to blow holes in the victim here.

          • Braxton1980

            yesterday at 10:50 PM

            He didn't even explain why he was arrested or what he was suspected of

    • gambiting

      yesterday at 9:40 PM

      If you are stopped at the border then you don't have such a right. British border force can just demand you give them keys to all your devices and hold them for 7 days, no court order needed.

      Watch this if you're curious how that looks like:

      https://www.youtube.com/watch?v=991kRp8KUmo

      • lucb1e

        yesterday at 9:58 PM

        The part that stood out to me, copying from the automatic transcript:

        > they're sitting there with these like blank A4 Bits of Paper writing down everything I'm telling them like you know bits of interest and it's exactly the same thing the Russians did when they interrogated me [...] to be honest interactions with the Russians have been pretty much the same as inter with the British government

        I didn't do my research before going to the UK for the first time two months ago and just went with my gut feeling, that is, deleting files from my phone that I don't want to end up in a government system through Cellebrite's "accelerated justice" or whatnot. Never done this for any other country before (I cross borders on a weekly basis). Seeing this video and the Ugandan article from the sibling comment, that was definitely the right move

        • ohgr

          yesterday at 10:24 PM

          I get bagged and tagged at least once a week when I go shopping in the UK in the last 50 years. You don’t want to come here at all. I’d rather hang around in Russia these days.

          Facetious comment aside the only time I’ve had problems with border security anywhere is getting a large carpet back home from Azerbaijan. This was very interesting and required them to examine every square centimetre of it. China, US, UK, Europe all really boring. Russia was incompetent. They didn’t even check anything at all (2012)

        • Marsymars

          yesterday at 10:21 PM

          I don’t know of any country where border guards don’t have the authority to seize your device if you’re trying to cross.

          I just use devices with ephemeral storage for crossing borders to save myself from having to do any research on any particular country’s device privacy practices.

          • lucb1e

            today at 12:39 AM

            Then I'm not sure what we're criticizing China for, if no country has such fundamental rights for the people under its control. The warrant system exists for a reason. I'm not more likely to be carrying something illegal when going between countries than within the jurisdiction where my registered place of residence is; less if anything because there might be spot checking indeed

      • inopinatus

        today at 12:47 AM

        Some firms routinely forbid carrying company data (including encrypted data) across five-eyes and PRC borders, this is why.

      • 77pt77

        yesterday at 10:34 PM

        Imagine you're a citizen and say no.

        Are they arresting you?

        Because they have to let you in.

        • gsnedders

          yesterday at 11:10 PM

          This depends on who the Border Agency officer is:

          An Immigration Officer may search you until they are satisfied you are a citizen. As long as you have a passport (or emergency travel document) listing you a citizen, this should be straightforward and they're unlikely to have grounds for any further search. At that point, you have been let into the country.

          Customs Officers are much more likely to have grounds for a search — if they believe you are bringing prohibited material on the electronic device into the country (and "reasonable grounds" is low, as it typically is for customs — "you're acting kinda sus" is a reasonable ground), they can search your device. It is an offence to refuse a search, so while you've been admitted to the UK, you could be arrested for that offence.

          This is all broadly comparable to most other countries immigration and customs laws; the UK is not an outlier here.

          The problems with the UK are primarily things that apply to everyone, not just at the border — for example the Terrorism Act 2000 and Regulation of Investigatory Powers Act 2000. But again, in the border case — that's basically all going to be _after_ you are admitted to the UK.

        • gambiting

          yesterday at 11:00 PM

          You don't have the right to say no or even stay silent. If you refuse to give up your passwords they will charge you with the whatever the legislation around it is, it's 2 years behind bars for refusing.

          • UberFly

            today at 6:00 AM

            God this is scary. What if this "authority" figure is abusing their position? Do you have any recourse?

            • johnisgood

              today at 6:28 AM

              Probably not, just a waste of money and time, but hopefully someone can provide a reasonable recourse.

              What if you say you forgot? I actually had times (after not having used my phone for a month or two) that I (& my muscles) forgot my PIN (not for the SIM card) and I had to do a factory reset.

              • gambiting

                today at 8:55 AM

                Well it's not automatic 2 year prison sentence. The state charges you with a crime, it goes to trial, and then you have to defend yourself - if your argument is that you forgot, then it would be an interesting case - ultimately the prosecutor would need to prove that it's unlikely you forgot, say if they had proof (say CCTV recording at the airport) showing you using your phone 5 minutes before it was confiscated - it would be pretty hard to argue that in the space of those 5 minutes you forgot the password. But if you had a device in your suitcase and could successfully argue that you haven't used it in ages and the password was long and complex then yeah, I guess you'd be found not guilty - up to the judge/magister/jury depending on where exactly in the justice system you end up. But yeah, while stopped at the border saying "I forgot" is not a good card to play.

    • kennysoona

      yesterday at 8:06 PM

      Is a court order explicitly needed in the UK to demand a key?

      • ohgr

        yesterday at 8:15 PM

        Yes there has to be magistrate approval and you can challenge a notice with legal representation.

      • blitzar

        yesterday at 8:15 PM

        A warrant is required - can be issued by the Secretary of State.

  • teekert

    today at 6:03 AM

    Really? So you can have your own Nextcloud server, connect over Tailscale and you’d face jail-time? I can’t imagine that.

    • kennysoona

      today at 7:37 AM

      The law is about making sure the UK government has access to your encrypted data if they want it. It doesn't only apply to big corporate solutions.

      • teekert

        today at 7:46 AM

        Wtf. What is next, my thoughts? Who are these people? Thinking they can outlaw basic maths operations.

  • v3xro

    today at 9:22 AM

    Yes, and they have the resources to go after every (former) user of ADP. </s>

• justinclift

  yesterday at 11:40 PM

  > I will of course just remove everything from iCloud at that point.

  The iPhone's backup utility doesn't seem to support anything other than iCloud, so you'd probably have to individually set up some kind of automated scheduling that (no idea how) for your main apps.

  Not sure if you'd be able to backup system stuff though. :(

  • GeekyBear

    today at 1:06 AM

    On a Mac, creating encrypted local backups of your iOS device is built into MacOS.

    On Windows, you create an encrypted local backup of your iOS device using iTunes.

    It backs up everything. OS, Apps, and data.

    • volemo

      today at 8:34 AM

      > It backs up everything. OS, Apps, and data.

      I’m not claiming you’re wrong, but I think the backup includes the list of apps and versions and excludes data that can be easily downloaded from AppStore.

  • ohgr

    yesterday at 11:45 PM

    I don't backup my phone anyway. There's nothing I can't replace in about 30 minutes work.

  • treesknees

    yesterday at 11:46 PM

    It's not automated but you can certainly still use iTunes to create a local encrypted backup of the entire phone, apps, and data. Works over USB and Wirelessly on the same network. People who decide not to use iCloud can certainly still keep their data safe.

  • yesterday at 11:46 PM

• HexPhantom

  today at 8:36 AM

  Yet I don't have much faith that the UK government will back down

• Obscurity4340

  today at 5:01 AM

  I wonder how the metadata comes into play here. Metadata is fair game even with ADP. Apple retains it and could probably be compelled to pass that along

• sieabahlpark

  yesterday at 9:12 PM

  [dead]

How do we know there are not back-doors already in Apple's cloud storage (that the 5-eyes cult has access to)? This fight may just be theater the goal of which is to legitimize the view that Apple's cloud storage is secure and free from government snooping.

Trust, then verify. No ability to verify? No trust.

• matthewdgreen

  yesterday at 9:53 PM

  This fight is about providing encryption to the masses. If you want to use your own open source security solution, you should definitely do that (really!). But you will be one of a small number of people doing so. And a society where only a small number of "wizards" have freedom isn't a free society at all.

  I am very sympathetic to the idea that more components should be open source, and Apple's systems should be much more open (particularly backup.) But at the end of the day if Apple is compromised there is no open source solution that can save you. They design the silicon.

  • TheDong

    yesterday at 11:55 PM

    > This fight is about providing encryption to the masses

    If apple cared about providing encryption to the masses, ADP would be enabled by default and you'd have to opt out of it.

    As-is, all your messages, photos, and so on are backed up unencrypted to apple's servers where they can read them at will. End-to-end encryption is opt-in, and I doubt most "the masses" even know a setting for that exists.

    • HnUser12

      today at 12:15 AM

      >If apple cared about providing encryption to the masses, ADP would be enabled by default and you'd have to opt out of it.

      Apple is also a company that needs to cater to its customers. If they enabled ADP by default and customer locks themselves out and goes to Apple, they want to be able to help. ADP is intended for people who understand what it is but nit savvy enough to run their own system.

      • TheDong

        today at 2:01 AM

        You can't have it both ways. Either you're providing encryption to the masses, or you're not.

        Providing encryption to the masses would in fact be telling people who lost their phone, or forgot their password "no, all your photos are gone forever, tough luck. Also, you have to make a new apple account and re-purchase all your apps".

        • sadeshmukh

          today at 8:36 AM

          You must have a different definition of "providing" because offering a service is definitely providing it. Apple makes "smart" devices that do what people want them to, and encryption is second to that. I think it's a fair compromise to have it easily available but not default.

      • protocolture

        today at 12:34 AM

        This is correct, apple has a very customer first support culture which has a famous history of blowing up in their faces.

        Internal metrics for support teams are almost entirely customer satisfaction focused, which built a culture of getting a result for the customer at all costs, which was very exploitable by social engineering.

        It doesnt surprise me that they dont want to let customers encrypt and lose all their baby photos by default.

    • matthewdgreen

      today at 2:29 AM

      I didn’t say it was Apple fighting. I’m referring to the broader fight. Getting Apple to deploy encryption by default is one outcome I’d like us to fight for. But if we give up and start poo-pooing Apple’s encryption because it’s not pure enough, that fight is over.

  • seanw444

    yesterday at 10:26 PM

    Is the society that relies on everyone else to make the decisions that serve their best interests free either?

    • knowknow

      today at 12:01 AM

      It’s impossible to live without depending on other people’s decisions unless you live completely isolated. It’s not “free” but most people are fine sacrificing some freedom for other gains. This has already been discussed for centuries, see Thomas Hobbes and the social contract.

• dwaite

  today at 12:49 AM

  Partly because they document the doors which are there for LE : https://www.apple.com/legal/privacy/law-enforcement-guidelin...

  They also switched a few years back to provide signed firmwares rather than encrypted firmwares to ease independent verification, and have the Apple Security Research Device program to do runtime exploration with certain security walls turned off. (Supposedly creating these devices requires a partial factory retooling)

  Apple also only has per-device global builds, rather than regional builds which might obscure requested features. My understanding is that they take transparency measures to make sure it can be detected if a firmware was released out-of-stream, and anonymity measures to prevent targeting a specific device with a custom firmware.

  The Secure Enclave also requires the device passcode as part of an approval process for installing new device/enclave firmware; the underlying OS and security enclave are not meant to have the capability of being transparently updated/modified.

• HexPhantom

  today at 8:41 AM

  Agree, blind trust in any big tech company is naive. But if Apple already had hidden backdoors, why would the UK government be pushing so hard for one now?

• willtemperley

  today at 6:28 AM

  We can never truly verify, because there is no such thing as perfect security [1].

  However there is "Deterrence through Accountability. We can attempt to legally prosecute the attackers" [1].

  That is what is happening here. The attackers are being prosecuted.

  [1] https://www.cs.cornell.edu/courses/cs5430/2017sp/l/03-princi...

• protocolture

  today at 12:29 AM

  Yeah its a concern of mine.

  Australia introduced the concept of these laws with the Access and Assistance bill. The politicians were adamant it was necessary, however there were so many potential users of the system (Politicians, police, spy agencies) it never made a lot of sense.

  Fast forward a few years and ASIO gave a press conference where they admitted to only having used the powers under the bill twice. Which makes me concerned about who the bill was for and what it has been used for. Unlike the British version, any public information release leads to instant jail time, and it was unclear whether this extended to briefing legal counsel.

  I feel like, if the 5 eyes wanted to breach iCloud they would use Australia rather than Britain where it can be publicly contested like this.

• cpa

  yesterday at 11:02 PM

  I understand that's not your point, but the government is a massive entity: it's entirely possible that the intelligence community has capabilities that wouldn't be admissible in court and therefore are of limited use to law enforcement. Or that they might be unwilling to share them with law enforcement.

• makeitdouble

  today at 12:02 AM

  "Trust but verify" was political double speak from the start, it's fascinating how it still lives on for so long.

  And yes, we shouldn't put trust in corporations in the first place.

• cantrecallmypwd

  today at 6:54 AM

  We more need FOSS (and supply chain) hardware, software, and (distributed) cloud platforms with encrypted all at rest and in-flight with zero knowledge storage (minus specific private keys and offline authoritative key locations, of course). The problem, of course, is the main platforms are ultimately owned by single point-of-failure (SPoF) corporations that can be leaned on, banned, or raided. This would require immense, deliberate investment to avoid compromise/slowly replace closed choices and to avoid supply chain attacks. And then, ultimately, it requires a socio-political bargain to decide whom to trust and why, such as, based on interests and leadership team.

"In 2021: No (IPT) cases were found in favour of the complainant": https://en.wikipedia.org/wiki/Investigatory_Powers_Tribunal#...

• bsimpson

  yesterday at 10:26 PM

  This sounds like something Douglas Adams would have written about.

From a leadership personality angle, who do you think initiated this brilliant marketing/messaging campaign — sue a country because ”it infringes on human rights and Apple upholds it.“

Do you think this kinds thing comes from someone in Marketing, Legal, a C-Suite, or is this kind of thing a thing by community at Apple? If it is the last, it would be brilliant to read that protocol/process/flow.

• relistan

  today at 8:40 AM

  I don’t know, but it feels like the UK gave them the softest pitch, straight over the plate, and all they had to do was hit it. (Maybe a cricket metaphor would have been better)

Good. Even if they lose, they should make as much noise as possible before giving up on the UK market. Maybe it will start to turn the tide of public perception.

• HexPhantom

  today at 8:46 AM

  The more awareness there is, the harder it becomes for governments to quietly erode encryption without pushback. If nothing else, it might make other companies think twice before rolling over.

Can't see much coming of this. At the very least the largest two parties are all for this kind of encryption backdoor and regardless of what the 'court' decides parliament can just legislate around it.

• ohgr

  yesterday at 6:52 PM

  Apple will do it for the attention, PR and to hurt the idea generally even if they lose. Mindshare and ire towards the government are as strong as any legal judgement over time.

  • thaumasiotes

    yesterday at 7:24 PM

    > Mindshare and ire towards the government are as strong as any legal judgement over time.

    Much stronger.

• Defletter

  yesterday at 6:49 PM

  Yup, the Courts are ultimately there to fulfil the will of Parliament: if there's a clear power granted by Parliament to do this sort of thing, and there's no compelling objection from other areas of law, then this is more just a delaying tactic.

  • krona

    yesterday at 7:45 PM

    Essentially true however judicial review can expose legal flaws, incompatibilities, or breaches of higher legal principles (e.g. the Human Rights Act 1998) essentially compelling (not forcing) the government to amend or adjust legislation.

    A notable example being section 23 of the Anti-terrorism, Crime and Security Act 2001.

    • Defletter

      today at 1:36 AM

      There's an interesting talk involving Baroness Hale, who'd later go on to be President of the Supreme Court, where she mentions the Belmarsh case: https://www.youtube.com/watch?v=pYR414Q8v6A&t=2605s

  • switch007

    yesterday at 10:23 PM

    Fun facts about the UK supreme court:

    - It was created by an Act of Parliament

    - It is a government department

    - It can not overturn primary legislation

    - Parliament could dissolve the court if it so wished

    • OJFord

      today at 2:27 AM

      I see from your comment history you're British, so I don't get why you describe this as surprising. There's the Commons, Lords, and the King. Who or what else would be creating or dissolving the court? Why would it be able to overturn primary legislation that's received royal assent? That would just be swapping things around so you'd be saying 'fun fact about parliament, supreme court can...' anyway, surely?

      • switch007

        today at 6:02 AM

        I was speaking to the wider audience here

        Our supreme court is different to the US supreme court for example

      • dmix

        today at 3:13 AM

        Not having a judicial body that is fully independent of the legislative branch (parliament) and not being able to strike down laws is interesting/surprising to me shrug. I've always liked the idea of strong judicial oversight. But I guess without a strong constitution, where parliaments laws can't be ruled unconstitutional, it doesn't matter much... the public will be fully at the whims of parliament.

        • OJFord

          today at 9:11 AM

          Aren't US SC judges picked by the president? Can't he override everything with pardons and executive orders anyway? Can't the US constitution be, uh, amended?

          • dagw

            today at 9:36 AM

            Aren't US SC judges picked by the president?

            They're nominated by the president, but approved by the Senate. There have been cases throughout history where a nominated judge doesn't get through the approval process. Of course when the president and the Senate are aligned and in agreement this approval process is largely a rubber stamp.

            Can't he override everything with pardons and executive orders anyway?

            Not at all. Despite what it sometimes looks like, the president's executive order powers are quite limited. But again, if congress isn't willing to challenge the order and the Supreme Court isn't willing to rule on it, these limits are more theoretical.

            Can't the US constitution be, uh, amended?

            It can, but it is a slow and difficult process, requiring 2/3 support of both the house and the senate, plus support from 3/4 of the States. There have apparently been over 10000 attempts to amend the constitution since the founding, of which 27 have passed. Furthermore the president has no power to suggest or approve constitutional amendments.

            Basically a president that doesn't have the support of Congress and the Supreme Court has surprisingly little power.

        • throwaway2037

          today at 5:57 AM

              > But I guess without a strong constitution
          

          The UK doesn't have a written constitution. This is rare amongst highly developed democracies. Also, to my knowledge, most parliamentary systems don't have a final court that can overturn laws passed by the parliament.

      • Defletter

        today at 3:15 AM

        Well, the British system is particularly unique because there is no formal Constitution, and thus we have no Judicial Review for Constitutionality. There's a pretty interesting talk about this here: https://www.youtube.com/watch?v=YIlkY90Cck8

        • hnfong

          today at 5:58 AM

          This is basically a "the Emperor's new clothes" situation where the UK's constitution can only be seen by smart and educated people. (Yes, you have QCs [now KCs] saying otherwise, but that's exactly my point.)

          Face it, if the constitution is "whatever the prevailing political elite class says it is", then you don't have a constitution.

    • Defletter

      today at 1:17 AM

      Yup. What Parliament giveth, Parliament can taketh away. It is scary to think what Parliament can do with a simple majority.

      • throwaway2037

        today at 5:57 AM

            > It is scary to think what Parliament can do with a simple majority.
        

        If so, why don't we see parliaments misbehave more often and do crazy shit?

  • drcongo

    yesterday at 7:11 PM

    I'm not sure that's entirely true, the UK government gets sued regularly and loses a fair amount.

    • Defletter

      yesterday at 7:35 PM

      Sure, but that's because the government acted in ways contrary to what Parliament willed.

• blitzar

  yesterday at 6:59 PM

  It will be good to have a test of the legislation, the last government spat out some horrifically written legislation, so it might not even say what they think it says.

• aeim

  yesterday at 8:04 PM

  I wonder if this case will be dropped by the uk, now that it's more clear that trump/ us gov serves (or is aligned with...) russia

  The global landscape has changed significantly since (last week) this case began

I think that the people who want to use encryption should use their own software for encryption, which is separate from the cloud service. (This alone might not do, because you also need to implement other security, but it will be one thing to do.)

• HexPhantom

  today at 8:49 AM

  And this whole situation just reinforces the fact that relying on a provider's encryption means trusting that they won't be forced to weaken it later

• Nevermark

  yesterday at 8:00 PM

  You are suggesting people be able to insert an encryption module into other services?

  Or that everyone has to constantly manage a non-default set of tools, and deal with all the interoperability issues of all the mish-mashes of choices others make?

  Or, ...?

  Personally, I cannot see a safe online world that doesn't have hard privacy.

  Why not give people easy ways to report "very bad behavior" online, to authorities that build up a reputation of responding responsibly. Including bounties for the most egregious stuff.

  Then every recipient of anything rotten becomes a honeypot for the criminals.

  Breaking everyone's privacy is going to attract every nefarious and security conscious actor in the world to the buffet. Every state actor, "good" or "bad" is going to want to have access to everything that can theoretically be accessed. Worst possible kind of honeypot.

• tonetegeatinst

  yesterday at 7:31 PM

  Remember software can be banned or regulated via export control.

  • 14

    yesterday at 7:38 PM

    Exactly. Just like the pirate bay.

    • akimbostrawman

      today at 8:39 AM

      That ban seems to be incredibly toothless considering a simple DNS/IP change can bypass it.

• kjsingh

  yesterday at 7:40 PM

  at least Apple should provide a way of inserting a module to encrypt decrypt files. and say, we just store the bytes user provide us.

  • dylan604

    yesterday at 7:58 PM

    This is the issue. If you encrypt your own, then the software will not be able to use it as it's not a file it expects. So all of the software that you want to use your encrypted files will need to have this type of module.

    At that point, I feel like we've opened pandora's box. If every single app had to be able to decrypt/encrypt with your personal key, we just know someone will roll their own and fuck it up for everyone else.

    • hnlmorg

      yesterday at 8:46 PM

      It depends on where you put that module.

      In NT you can have modules that sit between various operations on the file system. It’s how AV works without having to hook into every single application that reads and writes from storage.

      There’s no technical reason why this kind of approach couldn’t be applied by Apple for encryption. But it would require relinquishing some control over their platform, so it would never happen.

  • immibis

    yesterday at 8:15 PM

    Microsoft gets that excuse, because it lets you run anything at all on your computer. Apple doesn't, because it only lets you run things approved by Apple. Instead of "why did you make this encryption system we can't break into? Trillion dollar fine!" it'd be "why did you let XYZ Corp install this encryption system we can't break into? Trillion dollar fine!"

I've been wondering. What would happen if Tim Cook personally 'leaked' the notice on twitter?

How would the UK government reasonably sanction Apple?

• harry8

  today at 6:57 AM

  Why would the UK government limit itself to being reasonable?

  I can imagine most CEOs pausing before picking a fight with the intelligence services.

• genewitch

  today at 6:45 AM

  Force cell carriers to block imei of apple handsets

If Apple had the wherewithall, theyd give up on the UK and be done with it. Should they not prevail legally. Pipe dream, I know.

• ohgr

  yesterday at 7:08 PM

  I never get this perspective. Firstly we do give them a crap load of revenue. Secondly it'd probably trash any of their non US business almost immediately as people start looking for contingency in case they pull out of other countries. Thirdly they didn't pull out of China. And fourthly there are a lot of Apple engineering staff here in the UK - it'd cripple them because they won't move to the US.

  They will comply with the law and make a lot of noise and not a lot else.

  • wil421

    yesterday at 8:20 PM

    How can a company the size of Apple be crippled by employees in the UK?

    • ohgr

      yesterday at 8:29 PM

      Literally a large chunk of the ARM core team are in Cambridge including most of the GPU folk and there are a ton of infra and software team in a couple of other UK locations.

      On top of that, a big chunk of the follow the sun on call engineering (SRE) are here that look after global infra and most of the European support operation are in Northern Ireland.

      • sureIy

        today at 4:34 AM

        Fruit Engineering Ltd. hires brits and contracts with offshore Apple Inc. The former does not have the keys and cannot be forced to do anything iCloud-side.

        It's not like corporate doesn't know all the tricks already. The only reason they need is whether the UK market is worth the hassle. That's all.

  • pertymcpert

    yesterday at 9:51 PM

    The Apple engineer staff can keep their jobs.

  • theshackleford

    yesterday at 9:23 PM

    Define a “crapload.” My understanding is that it’s actually a number that could be walked away from.

    • ohgr

      yesterday at 10:31 PM

      8000 staff including very high level engineering and technical.

      • theshackleford

        today at 1:47 AM

        Isn't that potentially devastating to the UK, not Apple in the long run? Choosing to walk away from the market in terms of supplying goods does not mean needing to walk away from high level engineering staff.

        Of course, you may mean these staff are only required to service the UK market...but it sounds like you mean they are valuable to Apple, at which point I am unsure as to why they would not be retained/shifted as appropriate.

        Also my apologies, I assumed revenue here. Also thank you, I had not considered staffing, but it makes sense.

        • ohgr

          today at 7:16 AM

          Yes it’s more critical staff. And it’s more a cultural thing. I know a couple of Apple folk and they will definitely not relocate to retain the job. Especially in the current political climate.

          You don’t actually need as much money to survive in the UK as the US for example. So there isn’t the motivator to retain high level salaries other than luxury.

          It would be “no thanks” and take a 30% cut to go and work somewhere else.

• madeofpalk

  yesterday at 7:43 PM

  What happens when Australia blocks this next? Then Japan? Then Brazil? Then Sweden? Then the US?

  • autoexec

    yesterday at 9:13 PM

    "What if every country on Earth violated everyone's rights" isn't really much of an argument against standing up to countries that try. If that actually happens then we're all screwed anyway. Until it does actually happen, why roll over and allow it to happen without even trying?

    • matthewdgreen

      yesterday at 9:55 PM

      If Apple gives in, it will certainly happen in dozens of countries. China alone would be a dealbreaker.

      • madeofpalk

        yesterday at 10:38 PM

        Apple gave in to China years ago. Apple gave operation of iCloud servers to a chinese company.

        • matthewdgreen

          today at 2:23 AM

          According to Apple, everything in their system still works the same and they still have control of their own hardware, even if it’s in a Chinese data center. Systems like iMessage are still fully end-to-end encrypted even in China. Maybe they’re lying but it would be a huge opportunity for devastating leaks if that’s true.

          • throwaway2037

            today at 6:03 AM

                > Systems like iMessage are still fully end-to-end encrypted even in China.
            

            I do wonder about this. How can an authoritarian state allow a (very!) large foreign corporation to operate an important communications network without data transparency to their domestic spy agency? I am not normally a tin-foil-hatter, but I just assume that the domestic spy agency has a copy of the private encryption keys used for HTTPS/TLS. Then, Apple can continue to advertise "end-to-end encrypted" (in Mainland China), but the local spies can read the comms.

            • momo_hn2025

              today at 6:44 AM

              The simplest answer to your question is "it exists" and "iMessage isn't important," but instead, you chose to write a whole fiction for your brain. If that's critical thinking, I'd call it hallucination.

    • madeofpalk

      yesterday at 10:37 PM

      See, I don't see just withdrawing from the country as 'standing up to'. It's just giving up in a more disruptive way, especially when It seems very likely to me that other countries will start demanding the same.

      Actually taking them to court and objecting seems more productive to me.

      • autoexec

        yesterday at 10:47 PM

        > I don't see just withdrawing from the country as 'standing up to'. It's just giving up in a more disruptive way...actually taking them to court and objecting seems more productive to me.

        "objecting" alone does nothing. Objecting + lawsuits or objecting + withdrawing might accomplish something.

        I'd agree that lawsuits are a good idea but they are also entirely dependent on the courts (of the same country that already wants to violate people's rights) to do the right thing. If the lawsuit works and the government forces the government to back off it's a good thing, but if not a company keeps the power to take their technology and leave. They can choose to do that regardless of what the laws or courts of another country thinks.

        Walking away might be seen as a company "giving up" on the corrupt country that wants to violate people's rights, but it's certainly not a company giving up on their principles. A nation full of people angry that they won't be able to get highly sought after products and services can change policy too.

  • bigfatkitten

    today at 12:46 AM

    I wish this issue were playing out in Australia right now, rather than the UK. It would be hilarious to see Apple walk out of the Australian market right before a federal election.

• nickthegreek

  yesterday at 7:04 PM

  Isnt that their soft plan? They plan on just removing the encryption for all UK users to make the point moot domestically if this gambit doesnt bare fruit. If they want to continue to push that they want it for all users globally, Apple can attempt to leave the market fully.

  Apple pulls data protection tool after UK government security row (bbc.com) - 1769 points , 1105 comments https://news.ycombinator.com/item?id=43128253

• surgical_fire

  yesterday at 6:50 PM

  I hope for the same. Likely not for the same reason as you, but we are together in hoping.

• inglor_cz

  yesterday at 8:05 PM

  I wish they placed a red warning on every phone instead: "Your government is forcing us to weaken your security because it wants to snoop on you."

  One of the problems of digital surveillance is that is doesn't feel intrusive, indeed it can be fully hidden from the users. With a message like this displayed every time you unlock your phone, plenty of people would start asking questions.

  • zimpenfish

    yesterday at 10:12 PM

    > "Your government is forcing us to weaken your security because it wants to snoop on you."

    They're not allowed to actually tell you about the UKGOV order. That's the point of it being a secret order.

    • genewitch

      today at 7:01 AM

      And yet

  • bigfatkitten

    today at 12:49 AM

    Apple can't discuss any of the details, but I'm sure they could point their customers to a person who can.

    "This feature is no longer available in the UK.

    For further information, contact:

    Mr Xxxxx Yyyyyy

    UK Home Office

    02070 xxx xxx

    xxxxx.yyyy@homeoffice.gsi.gov.uk"

    • jodrellblank

      today at 6:48 AM

      > Mr Xxxxx Yyyyyy

      *Mrs

      https://en.wikipedia.org/wiki/Home_Secretary

  • cakealert

    yesterday at 8:15 PM

    > red warning on every phone instead

    This is silly. The average consumer will just avoid Apple products.

As they should. You can’t throw an ultimatum for something that benefits nobody but the govt. and kick everyone around.

Would like to see other companies who were affected by similar situations also take this to court

• aryan14

  yesterday at 6:40 PM

  How well it’ll do in court is debatable, could go for either side, but regardless of the outcome it’s always good to see resistance and pushback

• immibis

  yesterday at 10:28 PM

  Apple will lose, because the government didn't break any law.

How do you guys interpret the fact that the UK hasn't requested such backdoors for Android-based stuff ? Ie. is this an indication that they already have such thing ?

The UK "laws" are extremely evil when it comes to violating basic rights, they can essentially force companies to shut up, "gagging orders", etc...

Until people start to really feel what losing privacy mean, nothing much will happen.

Right now, there is still a strong support in the UK for the gouvernement crusade against encryption and overall ending of privacy.

Because "why should I care, i have nothing to hide". It takes time and tragedy for populationd to educate themselves on matter, maybe in a few years or a decade the trend will invert.

Until then, there isn't much apple can do. They haven't the law with them, they haven't the population with them, they got the money but they aren't going to spend it on educating people.

Taking UK gouvernement to court is just the best they can do right now, a big pr stunt, like a giant ad to say to the rest of the world 'we care about your privacy, buy iphone'.

It's completely disgraceful what the U.K. is doing to freedom of expression. Very happy to see Apple like this.

smells like PR/marketing

• Jaydeep7

  yesterday at 10:07 PM

  [flagged]

Imagine a Chinese company sued a Westoid nation over some national security feature.

HN would be calling for world war.

any qualified opinions here on tresorit? i'm using them now for about three years and the service is alright and reliable afaiac. supposedly they don't have the private key. that makes using it sometimes a little slow compared to other options. but i decided to go with them after reading numerous horror stories about dropbox et al.

• cantrecallmypwd

  today at 6:59 AM

  Was Tarsnap evaluated? Those behind it are well known and the construction is simple and explained clearly. My general rule: never make technology recommendations without throughly vetting/testing multiple candidates and digging deep into support, the company, and demoing close to intended use.

Fuck the UK government

[dead]

Apple should be celebrating Stammer for his proud tradition of freespeech not taking him to court.