Privacy changes set Apple at odds with UK government over online safety bill

Apple is on a collision course with the UK government over the online safety bill, after the company announced sweeping new privacy changes that will limit the ability of law enforcement organisations to access user data.

The new privacy feature, called “advanced data protection for iCloud”, lets users apply end-to-end encryption to all their data stored in the cloud, including device backups, message histories and photos. It is already available for users in the US who are signed up to the company’s beta programme, and will be shipped worldwide in early 2023, Apple says.

End-to-end encryption is a form of security that means that no one apart from the intended recipient has the ability to decrypt the files – not even the service provider itself, even if they are asked or compelled to by law enforcement.

Apple’s iMessage service has been end-to-end encrypted since 2014, a fact that has caused some consternation for police and spy agencies around the world. But until now, they have had another route to access the communications of targets: demanding Apple hand over unencrypted user backups. That option may now also disappear.

Related: Apple should scan iPhones for child abuse images, says scanning technology inventor

It could put Apple in opposition to the government. The forthcoming online safety bill requires companies to act to limit the spread of child sexual abuse material and content promoting terrorism in messaging apps, and gives Ofcom the power to issue technical notices forcing changes to products if they do not comply. Neither the Department for Digital, Culture, Media and Sport nor the Home Office commented for this article.

But the change has been welcomed by civil liberties groups. “The Home Office should stop asking companies to place their customers at risk and support encrypted technologies, rather than trying to undermine them,” said Jim Killock, director of the Open Rights Group.

“Mass insecurity is a boon to criminals who want our personal information for malware and fraud. The Home Office and DCMS should drop their efforts to control, limit and compromise encryption through the online safety bill or through threats to use other secretive powers such as technology capability notices.”

Alongside the move to encrypt backups, Apple also quietly dropped another proposal: to scan shared photos on devices for known instances of child sexual abuse material. Child safety groups have called on it to reverse that decision, arguing that the introduction of encryption for backups makes such “on-device scanning” more valuable.

“Apple had devised a world-leading, privacy preserving, non-intrusive way of detecting criminal content where scanning would only take place when the software is confident child sexual abuse imagery is there,” said Dan Sexton, CTO of the Internet Watch Foundation, which coordinates removal of such imagery from the web.

“The introduction of end-to-end encryption is an opportunity for them to revisit this solution. If companies are looking to introduce further encryption to their services, they need to make sure children have at least equivalent protection.”

Instead, Apple said, it would be focusing on a different child protection feature, “communication safety”, which acts to intervene when a child attempts to send or receive an explicit message. “We have … decided to not move forward with our previously proposed CSAM detection tool for iCloud Photos,” the company said in a statement.

“Children can be protected without companies combing through personal data, and we will continue working with governments, child advocates, and other companies to help protect young people, preserve their right to privacy, and make the internet a safer place for children and for us all.”