In January, the United Kingdom served Apple with an order to force the company to create a backdoor for British law enforcement enabling access to the encrypted cloud backups of any Apple user worldwide. A technical capability notice issued under the UK’s Investigatory Powers Act, is unprecedented in both its legal and geographic scope, requiring Apple to create a backdoor that can access any user’s cloud backup, regardless of citizenship, residency or suspicion of wrongdoing. While Apple has filed an appeal, this move still risks creating significant vulnerabilities in Apple’s most secure cloud backup feature, generates a dangerous precedent for other governments and risks data privacy.
The UK’s recent moves are the latest in a long-running disagreement about how law enforcement should address the challenges posed by end-to-end encryption. In short, the technology frustrates law enforcement by making it more difficult for police to access the messages and data of suspected criminals by encrypting them with a user-controlled key.
What’s end-to-end Encryption?
End-to-end encryption is used to secure messages sent by services such as iMessage, WhatsApp and Signal, which only allow the sender and recipient to read the message. It can also be applied to cloud backup, where in contrast to most offerings where the provider controls the key, users have a key that only they control to prevent the cloud host, or anyone else, from accessing the encrypted data.
The UK’s order reportedly targets Apple’s version of this offering, called Advanced Data Protection. This feature is unappealing to many consumers as it makes data recovery after password loss difficult and disables features such as search. But this technology is vital to securing the data of those most likely to be targeted, such as dissidents, and is widespread when businesses want to ensure the security of sensitive data.
Backdoors introduce new potential vulnerabilities at risk of being exploited by hackers, such as malicious tradecraft that provide access to an otherwise “secure” system. And once the capability is there, it is a matter of time until a nefarious actor moves to illicitly gain access to the same tool.
Salt Typhoon Impacts
The most recent example of this is the so-called “Salt Typhoon” cyber-attack, in which Chinese attackers gained persistent internal access to U.S telecommunication systems. This gave them the capability to obtain text messages, listen to phone conversations and access other sensitive data for, reportedly, nearly every American, including cabinet secretaries.
The attack was so successful in its depth and breadth that the Federal Bureau of Investigation, a long-time critic of end-to-end encryption, joined the National Security Agency, Cybersecurity and Infrastructure Security Agency and Five Eyes partners to encourage everyday Americans to use end-to-end encrypted messaging platforms to protect themselves. Another FBI official later emphasized that the FBI had not, in-fact, changed its position.
The attack demonstrates the greatest danger posed by the UK’s order—creating a backdoor into sensitive user data worldwide whose use may not be limited to the authorized agents of a friendly nation-state, but to hostile actors. In their attack on U.S. telecommunications companies, the Chinese Salt Typhoon hackers gained access to some of the “lawful intercept” tools used by law enforcement to initiate electronic surveillance authorized by U.S. courts. These systems, the current-day cousins to what the UK has ordered Apple to create, not only allowed Chinese actors to access the sensitive messages of U.S. users but also helped them to understand what Chinese agents might be suspect.
The UK should Reconsider
Tulsi Gabbard, the newly confirmed Director of National Intelligence, highlighted the threat to American privacy in a recent letter to Congress. She wrote that the move would be “a clear and egregious violation of Americans’ privacy and civil liberties and open up a serious vulnerability for cyber exploitation by adversarial actors.”
Once the encryption bypassing capability is created, it will lead governments around the globe, to order Apple and its peers to afford them the same access to a wide variety of sensitive encrypted data.
As a former prosecutor, judge and senior law enforcement official, I am sympathetic to the challenges that encryption can pose to investigations, but it is not worth creating an exploitable vulnerability when a variety of other investigatory techniques are available. Law enforcement already leverages flaws in mobile devices to access encrypted data via tools like GrayKey and has gained control of encrypted messaging platforms used by criminals like EncroChat. Law enforcement can also track criminal movements and mobile devices and use more traditional investigatory techniques such as surveillance and confidential sources. The UK should reconsider and seek a solution that will not open such a dangerous precedent that risks doing far greater harm than good.
Michael Chertoff served as the U.S. Homeland Security Secretary from 2005-2009. He served as a federal judge on the U.S. Court of Appeals for the Third Circuit from 2003-2005. He is co-founder and executive chairman of The Chertoff Group, which advises clients relative to technology and encryption.
