Your questions answered on Apple removing its Advanced Data Encryption feature in the UK
Plus, almost $1.5 B in cryptocurrency losses, DOGE posting data not meant for release, and Ukraine
The Internet is currently under hot debate on whether Apple sacrificed UK users’ security last week on the altar of maintaining business in the UK. Here’s the reality.
What happened: As a concession to the UK’s hidden request for a backdoor into the cloud backups of Apple users, Apple is pulling its Advanced Data Encryption (ADE) feature from Britain. The Advanced Data Encryption feature allows users to encrypt their iCloud backups with their own set of encryption keys, making the data inaccessible to even Apple. Apple built this feature to more thoroughly secure users' data and ensure that even if a government has a warrant for a user's information, Apple cannot provide it (since the user is the only one with the necessary information to recover the data). Removing ADE from the UK market is a setback for user privacy and security.
Take note: If the UK is able to follow through and get backdoor access, it has much more significant implications than just for UK citizens. The UK wants global access to iCloud backups, not just access to UK citizens’ data — so everyone who uses iCloud is at risk here. This also positions the UK in a future battle with the EU over user privacy. The order from the UK directly contradicts the EU policy that privacy is a human right.
Frequently asked questions about Apple pulling its ADE feature from the UK market
Does pulling Advanced Data Encryption remove Apple’s end-to-end encryption?
Apple removing the ADE feature does not remove its end-to-end encryption capabilities. End-to-end encryption (E2EE) is the encryption of data during the transmission of that data. For example, say you take a photo and it gets backed up in the cloud. With E2EE, the photo is encrypted before it is sent to the cloud and then unencrypted when it arrives at the cloud. Removing the Advanced Data Encryption feature does not change this, since ADE allows users to encrypt data in the cloud at rest (after transmission is complete).
Does this mean the files stored in Apple’s cloud are unencrypted?
No, this does not mean the files stored in Apple’s cloud are unencrypted or stored in plaintext (without protections). Apple encrypts all data in its cloud using its standard data protection features. The key here: since Apple encrypts the data, it can also decrypt the data. For example, if Apple is served with a warrant, it can decrypt the data and share that data with law enforcement if it so chooses. Contrast that with the Advanced Data Encryption feature, which lets individual users encrypt their data instead. This feature takes Apple out of the process, so Apple cannot decrypt the data even if it is served a warrant. Only the user can. It’s extra protection for the user that takes out the middle man (Apple), so you personally can ensure your data is secure.
Does this address the UK request for a backdoor into the cloud backups of Apple users?
No. Removing ADE is a sacrifice, but it is not one that resolves the UK order. This change means that if the UK government requests access or issues a warrant for data, Apple can give access to the UK at its discretion. However, what the UK actually reportedly wants with the order is a backdoor into the cloud data of Apple users, which Apple has not introduced and has stated it never will introduce. It’s unclear what is happening behind the scenes here since the UK request is hidden and any appeals are also hidden, but it’s likely Apple is using the removal of ADE as a stopgap and is trying to appeal the order. This fight is most certainly not over.
How will this affect other countries?
If the UK is able to take this as far as it wants and get a backdoor into Apple users’ data, it doesn’t only aid the UK. First, it establishes a precedent for what access governments (especially Western ones) can have to user data. But second, at the end of the day, the UK is part of the Five Eyes, an intelligence-sharing alliance between the UK, US, Australia, Canada, and New Zealand. Any information the UK deems as relevant signals intelligence could also pass to the other countries. It’s more than just the UK with skin in the game here.
Cryptocurrency is a great way to lose billions to hackers (in addition to just being a form of gambling!)
What happened: Cryptocurrency exchange Bybit had almost $1.5 billion in cryptocurrency stolen by the Democratic Republic of Korea (DPRK) this past week. This is the largest amount of cryptocurrency stolen by - at the very least - North Korea, though it’s likely the most significant amount stolen via a hack in history. North Korea typically hovers between stealing up to $100 million in cryptocurrency, with a few exceptions that are higher.
Take note: The Democratic People's Republic of Korea is the most prolific nation-state to target organizations with economic attacks like stealing cryptocurrency. Iran and China have also employed similar methods to steal funds. This is especially effective for countries that are under heavy sanctions, do not participate in the global economy, or have no respect for international law.
Surprising nobody, DOGE posts data not meant for public release
What happened: As part of its claimed efforts to provide transparency to US citizens about federal government spending (even though much of that transparency has been provided since 2006, and the numbers DOGE is providing are incorrect), the group released information on the headcount and total wages for the National Reconnaissance Office (NRO). According to the NRO, this data was never supposed to be made public, and for good reason - the NRO is an intelligence agency that builds spy satellites.
Take note: This comes on the heels of the CIA sending an unclassified email to comply with a Trump executive order containing a list of employees. Talk about operational security failure after operational security failure. The US government does not typically disclose this type of information because they are protecting their operatives. Otherwise, enemy nations can use the data to blackmail, kidnap and torture, bribe, or otherwise influence members of our intelligence apparatus.
One last comment - a lot of disinformation has been spread in the past week about Ukraine, particularly about who started the war and why. Ukraine is a sovereign and independent nation and has been one since 1991. Ukraine did not start the Russo-Ukrainian war — Russia has been an active instigator for years, dating back to at least the illegal annexation of Crimea by Russia in 2014. Ukraine joining NATO isn’t a threat to Russia, in part because it’s a sovereign nation, but also because NATO is a defensive alliance meant to protect its members against others. And lastly, President Zelenskyy's approval rating is 63%, not 4%. Those kinds of statements are a clear attempt to degrade the legitimacy of the administration in Ukraine, likely in light of how effective it has been during the war.
I want to hear your perspective!
⬇️⬇️⬇️ Share a comment with me below. ⬇️⬇️⬇️
Great breakdowns of big topics. You could do an entire month of newsletters about the misinformation we’re seeing regarding Ukraine. Thank you for posting!