Apple Pulls Advanced Data Protection in the UK with Matt Green and Joe Hall

Apple has pulled the availability of their opt-in iCloud end-to-end encryption feature, called Advanced Data Protection, in the UK. This doesn’t only affect UK Apple users, however.

To help us make sense of this surprising move from the fruit company, we got Matt Green, Associate Professor at Johns Hopkins, and Joe Hall, Distinguished Technologist at the Internet Society, on the horn.

Recorded Saturday February 22nd, 2025.

Watch episode on YouTube: https://youtu.be/LAn_yOGUkR0

Links:

This rough transcript has not been edited and may have errors.

Matt: Turn on advanced data protection. Go on your phone. It’s in the settings. Turn it on and then if it doesn’t work out well for you, just don’t come and me about it, okay? Please. No responsibility, but you should do it anyway.

Deirdre: Hello, welcome to Security Cryptography. Whatever. I’m Deirdre.

David: I’m David.

Deirdre: And we have two special guests joining us today. We have Matt Green. Hi, Matt.

Matt: Hello.

Deirdre: Returning three time champion. I think we have to go order you a smoking jacket now.

David: I think four time champion, I think.

Deirdre: Actually is it four time.

David: Okay.

Deirdre: Wow, we’re really behind. And new special guest, Joe Hall. Hi, Joe.

Matt: Hey everybody.

Joe: I look Forward to the 50th anniversary special.

Deirdre: We’re all looking real snazzy for 50th anniversary. We got Matt and Joe to join us because Apple has announced, or Apple has said that its advanced data protection feature for end to end encrypting, basically everything that gets synced up to your icloud is no longer available in the uk. Joe, can you tell us what the fuck’s going on in the UK and what is this thing that has been dubbed the Snoopers Charter?

Joe: Yeah. So I can try my best to tell you what the fuck is going on in the uk. And it’s a long, sordid story that starts with something called the Regulation of Investigatory Powers act, or ripa. It was one of the first laws that essentially had what we call an extraterritorial design mandate so built into the law that I don’t think, I’m not sure was ever used. I may just be ignorant, but would essentially allow the government to request a change to a system which is very different than like in the United States where things like calea, the wiretapping law, is very careful about access to keying material and not requiring you to have or create access to that kind of stuff. But that was updated because of modern times and technology in 2016 with what’s called the Investigatory Powers act, which was updated last year again, the Investigatory Powers Amendments Act. All these things in some form are referred to as the Snoopers Charter. And the coin being that there is a whole bunch of stuff that they allow, one of which are a series of secret notices to telecommunications providers and other kind of platform providers that can require them to do certain things to their systems.

And in this case we have no clue what this says, but leaks seem to indicate that they required access to ADP for global Apple icloud users or something like that.

Deirdre: But yeah, so this reminds me, I am a Little bit more familiar with kind of national security orders in the United States. Jurisdiction where people or businesses or entities in the United States may be served a national security order. And usually it says on it, you cannot talk about the existence of this national security order to either comply or help the national security mandate of the United States. So you either have to give us access or hand over information or you have to put a pen register, you know, the modern day equivalent of a pen register. Do they kind of map up with the, the whole snoopers Charter in the UK with that sort of stuff?

Joe: Totally different.

Deirdre: No, it could. Good.

Joe: So we have like secret courts, the FISA laws, we had a part of the National Security Letters and stuff like that. And well, we don’t have in any respect are things, you know, the individual courts may like. For example, Kentucky versus 141 domain names is one of my favorite cases. It’s just like a bunch of gambling domains. And what they did is they called it property and seized it and then told network solutions give us all those domains. But long story short, there’s nothing that is a sort of a systematic way of gaining bulk access or access or even what are called, you know, a general surveillance power. Right, right. We don’t have those.

Deirdre: And in the United States that’s exactly.

Joe: What this is because it’s not targeted to one individual.

Matt: Right.

Joe: Which is in the Formless Intelligence Surveillance Court and stuff like that. They try to, you know, make sure that things satisfy super warrant conditions, exhaustion, all these kinds of things that make it really, really hard to be able to do that stuff.

Deirdre: Oh boy. So it sounds like even when you had to comply with something sort of similar in the United States there was a lot more hurdles to climb before you could get anywhere close to this. And in the UK they just sort of passed themselves a set of powers that just let them serve Apple with something that’s like equivalent to an national security order that say quiet. You can’t talk about it or disclose exactly what was served or even exactly that it was served, but everyone’s really talking about it. So can you, can you button down what they’re supposed to not be talking about but everybody knows about?

Joe: Apparently it sounds like they have been served with essentially a capability notice which requires them to modify the design of the system to give them access to stuff that they wouldn’t have access to it. So I can, if they had actual technical Apple advanced data protection language in the thing, I could sort of speculate what it might say. But that’s probably better for talking about because I’ll mess it up.

Deirdre: All right, so we’ll hop over to what is adp, which is Apple’s advanced data protection. This is an opt in feature for people with Apple accounts, icloud accounts. Matt, can you tell us what, what this is as opposed to the other things that icloud does or does not do for you?

Matt: Sure. So every time you set up a new iPhone, it urges you, I think it by default tells you to set up icloud backup and you know, set up an icloud account if you don’t already have one, and then you set up icloud backup. Apple really likes their cloud backup. And it’s a good thing, right, because people lose their phones and when you lose your phone, you lose all your data. And Apple wants this to be seamless and perfect for everybody so that like all your life’s photos don’t disappear. Totally, totally fine. That’s the problem is, and for many years, a lot of that data that gets backed up to icloud backup, including your photos and the backups of your text messages and so on, all of that stuff is backed up to Apple in a way that Apple can read it. Right.

It may be encrypted, but Apple has the keys to access it. And for many years people have been talking about that. How could Apple fix this to make that data end to end encrypted? And I really want to stress this is kind of the master, the root key of everything on an iPhone. So Apple has end to end encryption for Apple imessage and they have all these other features that are very secure. But if somebody can get your backups, which at this point is basically like learning your icloud password and getting through 2fa, they can basically access all of that data because all your text messages are backed up there. And so Apple very recently, just in 2022, introduced a new feature called advanced data protection. They don’t really urge you to do it. They don’t even mention it.

It’s kind of hitting away in a menu. It’s an opt in feature that suddenly activates full end to end encryption for all of that data. You turn it on. It does have a little, it’s a little thumpy. There are some things that you have to, you know, activate. Once you do that, though, the only way to get access to your backups is to know your iPhone passcode and that iPhone passcode is kind of the master key now for all your backups, and you only get 10 chances. So if somebody tries to brute force their way through your iPhone passcode. Even if it’s, you know, a six digit passcode, they don’t necessarily have a great chance to do that.

So it’s a big, big, big improvement in security. And here’s the thing. So the recent case is basically saying that as far as we understand, the UK does not want that to be end to end encrypted. They want Apple to go back to having the secret key to decrypt all those backups but not telling anybody. So you’ll think you have end to end encryption, but you won’t. That’s what I understand.

Deirdre: I hate it so much. Yeah, I remember I had to go dig to turn this on because for a very long time I just didn’t have icloud backups. But every time I set up a new Apple device, it really, really, really tries really, really hard to turn on syncing via icloud. And I basically turned it on because I don’t want to accidentally be syncing something that I just by not paying attention very well or by clicking through some install thing that’s like, hey, make sure you want to back up your flighty information. Because Flighty is the best flight tracking app in the world and it’s only on iOS and macrosos but it uses icloud syncing. So I turned it on too. And yes, it’s a little bit clunky and it’s definitely not on by default, unlike other end to end encrypted backups or other systems. Yeah, it’s unfortunate that this is not on by default.

Deirdre: Matt, can you tell us why it might not be on by default?

Matt: So there’s a really long history here and there’s a lot of conspiracy theories. I can tell you that Apple first rolled out the technology they need to do this. They rolled out something called icloud Key Vault back in 2013. I’m amazed it’s 2013. I can’t even believe that I’m actually wondering. That’s correct. It’s so long ago they rolled out the technology to store those keys on these hardware security modules so that only even Apple won’t be able to access the keys without your passcode. That’s how they built it.

And they then activated and so it would only protect your passcodes and your icloud keychain stuff. Maybe your web browsing history. I think they added that, but they never added full backups or photos or any of that. Years and years go by. We have some anonymous reporting from Reuters that I don’t remember the date, but like five years ago saying basically the FBI forced Apple or pressured Apple not to allow end to end encrypted backups. So that’s one reason we don’t have it. And then there’s, you know, like that is probably a very strong part of the reason there’s been a lot of government pressure on Apple not to activate this feature. But the other like, you know, the other possibility and really is true, these two things are going to be true at once is that end to end encryption is a little bit riskier.

Right. If you lose your passcode and you lose your phone, you’re in big trouble. Right. You’ll lose all your data. Now this doesn’t happen to most people, but Apple has like a billion devices out there. So when you have something that’s a very rare occurrence, you multiply it by a billion. That’s a lot of very sad people who like lose their entire digital life because of this stuff. And it’s very, very problematic.

And like Apple has tried to come up with some solutions. Now you can set up a recovery contact so you can nominate your friend or something so that if you lose your phone and you forget your passcode, they can save you and you can write down backup codes and it’s a work in progress. So there are some legitimate UX reasons for this. But at the end of the day this is something that should have been available even as an opt in many years ago.

Deirdre: Yeah, I know that if you are using the Google flavored version of Android, these things are kind of all tied in with your Google account rather than tied in with your devices. And I think that’s kind of where the rubber meets the road and why it’s harder for Apple to really offer full end to end because they’re pinning the root of trust to your devices, which makes sense. They own all their devices and they have like keys burned into every single Apple device and they can kind of do that. But Google basically is like we can do end to end encrypted backups and the recovery route is all via your Google account recovery and it’s a little bit easier for them to do it that way. They can’t just brute force it as easily. But if you lose all of your Android devices, there is still a theoretical possibility of getting into your account and getting the backups out. I mention that because if you use those kind of, especially those Pixel devices, this is on by default, you don’t have to go through this kind of bumpy enroll flow and be reminded that it exists it is on by default when you enroll new devices with your Google accounts. And so yeah, it’s unfortunate that Apple just couldn’t make this work, but to kind of point back to kind of why this hasn’t been rolled out kind of policy wise, iCloud backups that are handed over via a lawful court order or subpoena or something like that are very valuable to people, which is why, you know, end to end encrypting them is good for the owners of the data, the users.

But I can definitely understand why powers that be just don’t want that juicy source of information that can be used for, you know, whatever law enforcement purposes to go dark on them.

Matt: And I think we should just add, right like you know, we’re not talking about, you know, your icloud backups are super valuable. And you know, you might think that like some kind of like Tom Cruise hanging from the ceiling, mission impossible kind of adversary is what you have to worry about here. But really we’ve had hacks of icloud where all people did was guess your password. They get your account password or they reset your account password and they get in. And if you don’t have end to end encryption like that data is there two factor authentication, Multi factor authentication helps but even that is vulnerable to things like SIM swapping and you’re not safe. Like this is really a bad place to be.

David: Yeah, I set up ADP yesterday being inspired by Smash Matt’s tweet explaining where it was in the settings and I don’t know, it might have been possible to skip the recovery contact but it really pushes you towards that. And so I just set that up with, with like a family member. Figured it was a good thing to do. But I also had to go through and I have my Apple account connected to a couple of Windows machines and I had to go and like update the icloud software and all of those machines by which I mean actually install it instead of just like having like Apple Music inst. I assume because they’re like wanting to shove some key encrypting key in like Windows tpm. Yeah, I have venture a guess that it only works on Windows 11 too but I don’t know for sure.

Deirdre: Yeah, Joe, so we already talked about the Snoopers charter. How are they able to get away with the argument that you must give us access for any, not just UK residents, not just UK persons, not just UK Apple accounts or icloud accounts, but basically anyone that can be accessed from the uk, AKA the whole Internet, AKA the whole World.

Joe: I, I don’t know, I would love to see their argument like, like I don’t know how many pages. Pages. Like the more pages, the more interesting I suppose I’ll say in general, this is a genre that we sort of see around the world right now, this forum, shopping to find a court, this is a little different that will rule not only make a ruling but rule that it applies globally. And you saw this in the right to be forgotten cases in the past and stuff like that. France was like, you better damn believe that you’re taken out of the global DNS and stuff like that. And so extraterritoriality is sort of a feature of the British investigatory system, right? They’re very clear. I think this is, this is really the first time I’ve seen it used. I can find very little evidence of it used before.

But anyway, so, so I think they’re basically saying, look, we don’t, we may have someone who sets up a freaking French icloud account on a French phone and then comes here and is really a. I don’t know, whatever the heck. I’m sure they could, they could set something up like that. But they’re like, look, it’s not good enough to, to just deny this to these people. We, we need you to, to respond in a way that we could follow people throughout any given icloud account or something like that. But, but I would, I can’t wait to see that. And man, whoever’s leaking this, man, be real careful, I hope you know what you do it.

David: How, how is that different? Like, like in the US with like NSA for example, like they’re allowed to snoop on foreign nationals and not US Citizens to some extent with either no. Or like far less internal like court orders. And so how would, how would what the UK is doing now be different than that, if at all?

Matt: Yeah.

Joe: So in the US right non U. S persons and things on foreign soil just enjoy very few protections, right? And like the borders, the classic one where you know, even the things that you think of is like due process and stuff just sort of fall apart, right? That’s why they can plug something into your dam. That’s why you got to learn how to power wash Chromebooks if you’re traveling, you know, across hostile lines in the US Is one of them. So you know, I think that here it’s really, you know, there’s things like tromboning where traffic flows pop across the US border and that’s a really good place for the NSA to instrument routes and stuff. Like that to grab stuff that they couldn’t otherwise get right. And so there’s things like that. But we don’t have, I was going to say we don’t have laws that say you can go somewhere and do something else, but we do allow people to sue other people in our courts. So I have very hard to, like, I don’t know, I failed at answering that question.

Matt: Wait, wait, wait.

Deirdre: Go, go, go, go.

Joe: The secrecy blows me away. Like, can you imagine if this had not gotten leaked? Like you’d have like a few people in the home office and like I don’t know how many people at Apple knowing about it. And like it just blows me away how like we talk about like the values of zero days and zero click vulnerabilities and stuff like that, but this seems like orders of magnitude more sensitive and valuable to the extent that like, how could you even get to that point? How could a process get to the point of asking for that?

Matt: Yeah, I, I’m actually the, the leak is really interesting to me. Right. So this, this came out about two weeks ago. It was February 7th with Joseph. And then the actual news of the, the cancellation came out officially from Apple yesterday. And I’m sort of curious if it would have played differently if there hadn’t been a leak or if there had. I’m just curious if, like what, what people would have thought if Apple just said we’re canceling this feature, but there was no other context. I don’t know.

Deirdre: Yeah.

Joe: And many of you signed a letter that we have like 280 or something signatures on that just have some of the best people in the world. And I know, I’ve heard like things like that are freaking them out. But like, I don’t know if that means that they’ll do anything.

Deirdre: Yeah, I don’t know if it means that they’ll do anything. Yeah, we got this leak. It was reported in the press and it was kind of a waiting game until yesterday to see what Apple was going to do about it because basically they seem to be put in the position of either comply, like allow, don’t allow. Matt, can you, can you explain the dilemma that Apple was in until they made a choice yesterday?

Matt: Well, I mean, it’s complicated, right? Apple. So, okay, let’s, let’s take a different, let’s take two scenarios. One of the things we’ve been hypothesizing is that Apple has been asked for this global capability. So think about how incredible that capability is. Right. So Apple the UK is now announcing it is going to be the global arbiter of cybersecurity for the entire world. It is going to announce basically that it will decide for every company and for every security system they offer, what the maximum level of security that will ever be allowed to be offered on that system is for anybody in the world. Whether you’re a US customer, a Japanese customer, EU customer, it doesn’t matter.

And they will determine that. And not only that, but they’re going to say, by the way, company, you can’t tell anyone that we’ve downgraded your security. You know, people think they’re using encryption. The documents they’re reading, the PDFs, say we use encryption, we don’t have access to the keys, we do all this stuff, put our cards in a blender, and then it actually turns out that none of that’s true. And like, so this is crazy. So you have to think in this, you know, hypothetical world, Apple is going to look at this request and it’s going to say, oh, my God, you know, we can’t even engage with this. We can’t, we can’t go forward with this. We engage on this, like, you know, we’re toast.

So you have to imagine that they have to do something that kind of flips the table and they have to, I guess, try to do something that makes this issue somewhat moot, at least in the uk. Think about it this way, right? If ADP is no longer offered in the uk, maybe the UK government or the UK courts will have a harder time pushing on, demanding, you know, global downgrading of adp. On the other hand, not true, right? Maybe they just disabled ADB in the UK and the UK government just says, you know what? We still want access to everyone in the US and we don’t know what that looks like. I mean, Apple could leave the UK entirely. I’m not sure what the law looks like. I don’t know.

Thomas: Yeah, yeah. So, like, fill me in a little bit here on how, like, I get the point that you’re making there about, you know, the UK assuming the role of being the global arbiter of things. How is that different from California being the United States arbiter for car emissions standards? Right? Is it, is it so much that Apple wants to be the global arbiter, or is it that they’re asserting on their, you know, for their, within their own jurisdiction? Here’s the limit of what they’re going to allow. To me, to me, the question is interesting because, you know, how long is it going to be before the US follows them on this, and I think not very long.

Matt: Well, so. So first of all, keep in mind that what the UK has already gotten, with no objections from Apple at all, is they’ve gotten ADP completely disabled in the uk.

Deirdre: Y.

Matt: And so, like, again, in this hypothetical where that was not really what the UK wanted, the UK wanted something more, right? Like an Apple is giving this to them as kind of the offering. Like, this is our way out of this, right? So, so think about that. Like, first of all, individual jurisdictions like California or the UK could say we ban X and that would be fine. But there’s a different ask. If you’re saying I also want to ban it everywhere else, right? If California was saying, you know, you can’t have certain fuel efficiency standards in a completely different country, that would be crazy.

Thomas: And you’re saying that because in theory, the UK’s demand here could be that if, if there’s a, you know, a legitimate, according to the uk, courts investigation that involves a US person on US soil with only us, you know, territoriality. Right. That the UK has the right to demand that information from Apple. Which seems whack, right? It seems like just as a matter of, as a matter of law. That seems whack, right?

Matt: This is, this is the problem. So the, the Apple filings from 2024 say this. They say these laws can be interpreted as allowing the UK to request, you know, changes in security for UK customers. And to me, that reads like a lawyer, you know, a very, very staid lawyer jumping up and down with their hair on fire saying this. You don’t write this stuff down if it’s not for real. So, like, that’s a possibility they recognize. And to me, that’s them saying, look, we’re actually being asked to do this. But again, it’s a hypothetical.

Thomas: And do you see giving up ADP as a concession that the, you know, this is Apple’s trying to, like, placate the uk, or do you see it as, you know, Apple’s not in a position to give them what they want with regards to adp, that the only way they can move forward at all is to disable ADP just because of the end to end properties of how ADP works. Right. And for them to subvert ADP in the way that the UK would demand here, like they would need to do. They’d probably need to do hardware modifications given the sophistication of the reverse engineering community on iOS.

Matt: Yeah, it would be. I don’t think there’s any way that they could do this secretly and not get caught in a way that would completely damage them. So I think secretly doing this the way the UK is asking is just out of the question. And so what do you do? You could disable the ADP for the entire world and just announce it, or you could disable it for the uk or you could pull out of the entire UK as a company and just have no phones sold there at all. Like all of these options are bad. And right now disabling ADP for the UK seems like the least bad one, but it doesn’t mean that’s the last one we’re going to see.

Joe: And it gets worse, right? The amendments act last year now requires companies to notify the government before you make a security upgrade, before you, you put a new feature into your thing and they can tell you to not do it. And not only that, one of the things that I think is probably at play here when they issue you one of these notices to modify your system in some way while you appeal it, you cannot not do what it says. So like, it is the worst. And like, I’m not even talking about bulk equipment interference, which is hacking flows at scale and like bulk data. I mean, there’s other things that we’re not even talking about that are just a horrific zoo of shittiness that is built into the uk. UK is a surveillance state. I mean, not that we aren’t, but I mean times 10.

Deirdre: Oh my God, I hate that. So like, like you could, you could basically be like, I’m, I’m adding support for, for web auth and for Fido to authentication and you basically have or.

Joe: Default ET Facebook messenger in 20 whenever that was.

Deirdre: Right.

Joe: They could have BL that from barely.

Deirdre: Like a year ago or whatever. Yeah, you, you basically have to like get approval from the uk even though like Meta is incorporated in California and Apple is incorporated in California. I hate it so much.

Matt: So there is a possibility, I mean, one possibility is we could have a set of laws in the US that say like, actually, you know, you can’t downgrade your security secretly for. Okay, you can’t do these things. And if we had those laws, then, well, there’d be a big conflict, right, because you’d have like two different jurisdictions and like a company like Apple would then have to, you know, they couldn’t just do it quietly, they’d have to figure out a way. And so that would be an interesting solution. Although unfortunately, I’m not sure that our government is in any mood to be passing laws right now.

Joe: So.

Matt: We’ll see.

Deirdre: Yep.

Thomas: I’m still, I’m having a little bit of trouble here in that Apple already operates and gets significant revenue from a bunch of jurisdictions that have even less. I mean I’ve said for a long time and I think, Matt, you probably agree with me that the UK’s kind of, you know, intelligence community and signals intelligence in particular is among the most unhinged in the Western world like GCHQ and all that. There’s like it’s anything that people have ever said about nsa, multiply it by five for gchq. In fact, a lot of the worst of what happens in NSA operations is actually really done by gchq. But like Apple operates in China, right? Like Apple cares probably more about, you know, operating in Chinese markets than they do in the uk, just given the economic impact of it. But China wants everything China has not.

Matt: As far as I understand. I have to double check this. As far as I understand what China has asked for is for Apple to move its hardware into Chinese data centers. But as far as Apple is saying, and I do believe them at this point because they’ve been pretty credible, they are saying that they offer end to end encryption that Apple, they’ve not disabled their end, end encrypted products, that the ADP I think is even available in China, not in the UK anymore. And so you think about this. When the UK is asking for more than China, first of all that’s very bad. And then second of all, the really scary thing is if they give into the uk, I mean, of course China’s going to ask for it. Right.

Like you cannot possibly give into the uk.

Deirdre: Yeah.

Matt: And then not give exactly the same thing to every other jurisdiction, especially China because like, you know, you’re dead, you’re just, it’s over.

Deirdre: Like that’s kind of, you know, we’ve kind of discussed the rock and the hard place that Apple has put in and the choice they made. And it’s unfortunate not just for Apple and its users but because, well one in the Apple’s users via the uk, they don’t even have to be in the UK of course, but there are users all over the world because like if you will not kowtow, but like you had to make a choice and this was the choice you made per, per the uk. Like all these other countries have asked and they tend to rank lower in terms of, I don’t know, human rights or pushing this. Not even human rights, just pushing this than say these. Some of these countries in the G7. Yeah, like there seems to be a non trivial fallout all over the world for Apple, but not just Apple, for any technology company that operates worldwide, which is basically any of them that operate via the Internet that offers anything similar to this sort of end to end protection that theoretically, you know, if it’s done correctly and honestly and well would not give access to the service provider Apple’s icloud or whatever else. What.

Joe: So I have a crazy theory salt typhoon. Oh yeah, that the fact that we have like the FBI and others saying please, please don’t use your phones as phones, please use encrypted things over the top of your phones to talk to people. I wonder if this is like seeing the window of opportunity for using these kinds of things to make sort of big systematic changes is shrinking. And so they’re sort of seeing the writing on the wall even with their own five eyes partners. And I think even within the US there’s probably some dissonance. But it makes me wonder have was there a flurry of TCNs and this is the one that leaked and who would the others be? But you know, that’s probably just exercising conspiracy bone in my body.

Matt: My theory is that, you know, forget about TCNs, I don’t know anything about TCNs. But like my, my general impression from watching this encryption debate over the last 10 years is first it was device encryption, like built in device encryption, like encrypting drone error storage. And there was a huge amount of pushback on that. You remember Apple versus FBI. Like we saw this all happen and I’ve noticed that that case has kind of gone away. People no longer ask for you to disable that because they’ve kind of recognized like you can’t have unencrypted devices. So they just moved on from that debate. Plus everyone’s devices are encrypted.

And then the next thing was, and.

David: We also got really good at owning people’s devices. Right? Like some people make a lot of money out of bypassing the need for that legal question.

Matt: True. And actually let’s come back to that in a second because I think that’s interesting. But okay, but then we saw end to end encrypted messaging, right? We had people saying that needs to have backdoors. And we even saw the CCAM scanning debate in 2021 and I’ve kind of noticed except for content scanning like that debate, the actual we need warrants in your encrypted messaging has kind of pulled back a little bit. And now you know, and I think the reason is like it’s become so ubiquitous and people recommend it even at the FBI. So what’s happening now is you look at the thing that isn’t fully deployed. I think ADP is probably below 2% anywhere. Right? Like actual numbers of people turning on ADP is like one point whatever.

It’s like, you know, pets. Stepping on your phone could probably, you know, give you higher numbers of ADP than actually deliberately turning it on. And because of that, it’s vulnerable right now in a way that the other technologies are not. Yes, but once ADP type technologies become ubiquitous, then, I don’t know, we’ll move on to the next thing that we have to attack. So we’ll see. But, but coming back to what David said, right? Like the actual question is why, if we have this amazing, you know, Pegasus style compromise your phone technology, why does the UK want this so bad? I guess that’s an interesting question.

Deirdre: I’ll give a wager that the zero day market, the serve the, the service based like I go to my favorite company in Israel or somewhere else and they give me a contract for a deployable exploit such as Pegasus.

Thomas: Probably not an Israeli company or.

Deirdre: Yeah, not anymore, but Pegasus was from an Israeli company. It is expensive. The market is expanding. The, you know, the, we’re getting better at hardening platforms like Android and iOS. It is expensive and you can get a lot of bang for your buck. But that keeps evolving. Icloud if you can get a warrant or national security order, you know the name, I forget the name already from the uk that’s real easy like that. If it’s open, you just fulfill your order.

Thomas: Yeah, it’s a super interesting question. Right. Because they’ve created an international incident, they’ve picked a huge fight with one of the most important companies in technology. But the expense of breaking into a phone can’t be it. Even at current rates, where you’re talking about full chain for modern iOS costing low seven figures, that’s a rounding error, right? That’s like, you know, the cost of health insurance for the human people that would do that work otherwise is orders of magnitude higher than that. It doesn’t seem like expense could be the reason. It seems to me that there should be a real reason for this.

Matt: There’s got to be a kind of a retrospective case, right? Like let’s say you have a bad guy and they have a phone and then they take that phone offline, you’re toast, right? Like your online attacks are not going to work against that phone. But any backups they made are still going to be there. So there is a difference, at least in that sense.

David: Yeah, it just seems operationally much, much easier to have like a consistent, reliable mechanism to say, hey, I would like this backup versus like even if you have like an unlimited supply of, of odys into phones, like you still need to like deploy those and like run the server side infrastructure and like get it to that person’s phone.

Matt: Right?

David: Like that’s just a lot more operational work that is arguably more like spy work versus like I’m just going to send a, we go to my desk and we’ll fill out the forms and I get back your icloud backup. And like no one who’s nominally a field officer.

Thomas: Right.

David: Is like involved to me.

Thomas: I just wonder if the, if the subtext here is dragnet or if it’s just politics.

Joe: Like this is the thing. Like, you know, I like given how the British government runs, it’s like there’s all sorts of dumb things that could result in and the number of people who, who can ask for these things is, is crazy compared to the things that we allow. It’s going to be interesting to see how they turn it off. Right. It sounds like it’s a whole lot of cajoling. Yeah.

Matt: So I mean, the good news is they’re not changing the software to turn it off. So they’re, they’re basically saying we won’t let you sign up starting yesterday. And then anyone who’s already signed up has like 12 months, I think, or some amount of time where they can, you know, like turn it off themselves and re upload their data without encryption or, you know, their data disappears. I don’t know. I’m not sure what that’s going to be. I don’t know what Apple’s plan is. It’s going to be something like that.

David: Where do we go from here?

Matt: I think, unfortunately, and I don’t want to get political, I think the answer depends a lot on US politics and I don’t even have to expand on this, but I want to just say that, I mean if we want to go down that road, we can.

Joe: Well, we’ve seen, you know, complaints from Congress members saying, you know, this is a grave national security threat and Ron Wyden obviously, when the very, very first thing story.

Thomas: But I love Ron Wyden, but if you’re talking about Ron Wide, you’re not talking about real US politics. Right. He’s like 15 steps past where the, the center is or what the mainstream is. There’s a weird streak of Antifisa in the this is not a political podcast, so I’m catching myself. But there is a strain of Antifisa among intelligence people that have just been brought into the new administration. It depends on whether you take them at their word on that though.

Deirdre: That’s interesting.

Joe: Also subject to the salt typhoon stuff like, you know, like they’re directly victims of that.

Matt: So I guess what I would say is, by the way, there is a co sponsor. I can’t remember who it is. So there was an update to the Cloud act that was proposed by Wyden. But another I think there are some Republican co sponsors. I don’t know who they are. So I do think it’s somewhat bipartisan. Doesn’t mean it’s big. So I think that there is some hope that it is really bipartisan.

I still don’t see Congress working together super effectively right now to pass a lot of legislation. I guess the really question is whether the US Administration is going to sort of push hard to, you know, keep companies like Apple independent from the UK law or if they’re going to kind of continue the historical trend of unfortunately kind of politically. This is something you have to like. If you look over the last 10 years, if you look at what like the DOJ has been doing, it’s been working very hard to kind of come up with exceptions to encryption. And it’s really bipartisan. It doesn’t matter who’s in office as president, it’s been more or less the same thing. Bill Barr was a big, you know, encryption backdoors proponent. And during, you know, Obama and also during Biden, we had the same kind of policy.

And so the question is, will we have the same kind of continuance of that in the current administration? We’ll see.

Thomas: Can we be in a stable equilibrium right now where just going forward, UK users just don’t get that feature and then we just stay like that for the next 10 years maybe.

Joe: Something else you’ll see I think is folks trying to adhere to the Amendments act and saying hey, we want to introduce end to end encryption in Slack. Right. Give me a break. And they might just say no. And then I think then you may actually see folks rolling out things without including the UK in their offerings. But and you’ll have to sort of intuit that either they made a decision to not do that or they were told not until we find a version of that that meets our own. Whatever.

Deirdre: That seems brutal.

David: The UK was already kind of on that route just because of the UK cma. Right. Like if you look at figma, Adobe like that ended up working out pretty well for, for figma because AI happened, I think. But like you’re talking about a country with a GDP less than California blocking like, you know, a double digit billion dollar acquisition. Like if you’re starting a company now, like why would you, like just don’t do as little business with the UK as you want because like all they’re going to do is screw you up on encryption or screw you up in the competition authority or screw you up some other way. And like we already see a bunch of AI models not making it to Europe. It just seems like this is another way that Europe and the UK are heading to be left out of technological advancements in products that the rest of the world was getting.

Matt: But at least the EU’s regulations make a little bit of sense, right? I can kind of see why they’re doing this. And whereas the UK just seems bonkers.

Joe: There’S really cool opportunities here for natural experiments, economics and econometrics. We wrote this 80 page paper, very long on the Australian system, right, which includes technical assistance requests, technical assistance notices and technical capability notices. Anyway, if you need to put yourself to sleep, you’re welcome to read it, but the whole point of it was to try and figure out has this meant that there’s been a ton of flight of businesses from the Australian market and yeah, long story short, don’t have the baseline data to measure that yet. But the stuff that we’re seeing here I think is a really good opportunity to actually sort of see the market voting in some way and you know, controlling for tons of variables and making some clutches that I don’t understand.

Thomas: If you’re a UK user really unhappy with the new UK policy and for all we know like the median UK person doesn’t care at all, right? But like if you’re, if you’re really unhappy with it, if you’re a market actor that’s going to respond to this, right? What do you do? What’s like, what’s your next step here?

Joe: You lobby. I don’t know if you’re going to.

Thomas: Be very successful just from like a, you know, an adoption perspective, like what technology you choose, like what programs you install, like is there a set of like recommendations that we have for don’t use iPhones.

Matt: And iCloud Backup is number one because unfortunately iCloud Backup can’t be unbundled from its encryption provider, which I think is a mistake on Apple’s part. If they had, you know, if they let you use any backup provider you wanted, then maybe this wouldn’t be such an issue. Or you could re register your iPhone as a US iPhone. I’m not sure if that’s even possible. But yeah, don’t use iPhones. Yikes.

Thomas: We can like not use icloud.

Matt: Yes, you cannot use icloud. You can back up to your laptop and then hope you don’t lose your laptop.

Thomas: Yeah, it’s what I do because I’m terrified of icloud.

Matt: But yeah, it’s not. It’s an option. Yeah, that will be the option. So I do have one last topic and the last topic would be, is.

Thomas: It about how ADP and device protection uses xts on a per file basis?

Matt: Oh, no, talk about that. I do have another topic, but if you want to talk about like the nuts and bolts of the crappiness of that encryption. Yes, let’s do it.

Thomas: That’s all I’ve got is they’re using xts.

Matt: Well, that’s better. They’re using convergent encryption. Right. Like it’s. The idea is that every file encrypts to its like encrypt using hash. Yeah. Which is not great. I tend.

I’m curious, I would love to know if that’s actually a big vulnerability. How many people have a lot of shared files that like really leak stuff? But whatever. I think that’s not a huge deal. I think it’s a crummy legacy decision they made. But like, whatever. But actually the thing I wanted to talk about is what do we do if we are about to be in a world where like all of a sudden we can’t trust these big device manufacturers to deploy encryption for us and we’re headed back to the, you know, CryptoCat and PGP.

Joe: Yeah.

David: I was gonna say, I swear to God, if you recommend that we buy one of those Android privacy forks, I’m gonna go jump out a window.

Thomas: Pine phones.

Matt: This may be the way we’re going. Right. Like imagine that, you know, signal gets pulled out of the app stores and imagine that like imessage is no longer encrypted. Imagine that all this end to end stuff goes away because of these stupid laws. We’re heading back to the cypherpunk future and it’s not a great future.

Joe: No, it’s very hard to resource as someone who has a foundation. Right. As part of the Internet society where I work. Holy crap. Like trying to fund the production of software products is really rough. Yeah.

Matt: We go from basically huge amounts of encryption deployment to like nothing Very little time. And then it’s, you know, on people to actually do things right. And it never works out right.

Deirdre: Do we, like, is there a world where there’s sort of a balkanization of companies like Apple, Google or whatever where there’s like there’s Apple products for Europe and there’s Apple products for the US and there’s Apple products for wherever you loop in the uk, China, anything. Like is that, is that even theoretically a world and is it a world that companies like Apple would even entertain.

Matt: Doing for large blocks like the EU and China? Yeah, definitely.

Deirdre: What does the UK count us? I know they’re not.

Joe: I would love to hear you spend time in product teams. Like I’ve always heard people say, well we can’t make two products. And like I guess this is the case where you’re making two products.

Matt: Yeah, well, in fairness, they’re making a product that has some switches on it. Right?

Deirdre: Yeah, it’s easy enough. Well, it really depends if there’s operating constraints and interoperability constraints between these sort of Balkans. Yeah, I don’t know. Like Apple’s interesting because they’ve made really opinionated choices about their cryptography and their deployments and their devices to support those things so that they can be compliant with US cryptography and they can be. They’re all fips. They want to be usable by people who care about fips. Like not everything that they deploy is fips, but they all the choices that they make, you know, So I don’t know, like they, I really don’t know. But that doesn’t sound like a very good world either.

Deirdre: On the other side of that, like should we all race to deploy end to end backups on by default, like ASAP?

Matt: Yeah, we can get that 50% in the US somehow. I mean that would be huge and I think it would be very hard to turn off.

Deirdre: Yeah. So we’ve got Google, but it has.

Thomas: Implications for users, which is one reason why the adoption is so low. Right. Is, you know, like they’re, when you sign up for that, when you go through that flow, they’re basically telling you not to do it. Right. Like you need a backup contact and all this other stuff. Just because they can’t deal with the support of like a third of their users losing access to all of their data.

Matt: I do tend to think that, you know, like it’s harder to lose your iPhone password and your contact iPhone password. I think there is some user experience here that we can get that is going to be 99.9% as safe as the regular thing. And like there’s got to be a point where Apple starts saying look, it’s a little risky, but turn it on anyway.

David: Especially if they can get people to have two devices. The like iPhone to iPhone or iPhone to iPad transfer flow these days is like so incredibly well done that it, like I didn’t believe that it worked the last time I did it.

Joe: Yeah, well, and deutero, you know, the Internet protocol works in China work. But like what is the, the thing that the authoritarians have to speak for this. Like what’s the Internet protocol for this? I don’t know if that even makes sense. But you know, like something that, that is too good that you, you, you have to use it even if you bastardize it for your own Balkanization.

Matt: Right.

Joe: So that the inter, the interoperability problems may be. Aren’t as bad.

Deirdre: Although they do have their great firewall. So they’ve figured out a way to do what they want to do with it. Even though yes, they interrupt to a certain point. But yeah, part of the whole value prop of the end to end encryption is you can’t inspect. You can’t just sort of be like, well, you block the way that you interrupt with it in the way that you want Izzy block. Yeah. Or throttle or you know, censor the things that look like Tor or look like bridges or look like, you know, the thing you don’t like and only let in the things that you do. Like that might be the China compatible version of icloud or whatever, whatever it may be.

Matt: And we’re all thinking about peacetime, right? Like if we’re about to be in.

Deirdre: Some kind of war, turn around three times and spit. But you’re not wrong.

David: On that note, Joe and Matt, anything that you want to plug on your way out?

Joe: Yeah. Join the Global Encryption Coalition if you care about strong encryption. 211 papers at NDSS if you care about network security starting next week. There’s some crazy stuff in there, man. I am getting to the point where I can’t understand academic research. But that’s amazing.

Matt: None of us actually understand anymore. Turn on advanced Data Protection. Go on your phone. It’s in the settings. Turn it on. And then if it doesn’t work out well for you, just don’t come and about it, okay? Please. No responsibility, but you should do it anyway.

Thomas: You heard it here and Matthew Green has all of your tech support answers for any problems you may run into with advanced data protection. Turn it on immediately. And he is Matthew D. Green on all of the socials.

Deirdre: All right, Joe Hall, distinguished technologist at the Internet Society, and Matt Green, professor at John Hopkins University. All around crypto expert. Thank you very much for joining us on short notice. Cheers. Bye.

Security Cryptography Whatever is a side project from Deirdre Connolly, Thomas Ptacek, and David Adrian. Our editor is Netty Smith. You can find the podcast online at CWPOD and the host online at @durumcrustulum, @tqbf and @davidcadrian.

You can buy merch online at merch.securitycryptographywhatever.com. if you like the pod, give us a five star review wherever you rate your favorite podcast. Also, now we’re on YouTube with our faces, our actual human faces. [Human face is not guaranteed on YouTube.] Please subscribe to us on YouTube if you’d like to see our human faces. Thank you for listening.

Apple Pulls Advanced Data Protection in the UK with Matt Green and Joe Hall

Latest Posts

Apple Pulls Advanced Data Protection in the UK with Matt Green and Joe Hall

Cryptanalyzing LLMs with Nicholas Carlini