British human rights groups challenge the UK’s Apple backdoor order

A pair of human rights groups are challenging the UK government’s shockingly intrusive order for Apple to create a backdoor into its encrypted user data, as first reported by Financial Times. Privacy International and Liberty have filed a legal complaint with the country’s Investigatory Powers Tribunal (IPT), which is reportedly scheduled to hear Apple’s appeal on Friday.

The complaint argues that Apple’s appeal to the order should be publicly heard. In addition, the groups’ challenge contends that the government’s move violates customers’ free expression and privacy rights by forcing the company to neuter its product security.

“The UK’s use of a secret order to undermine security for people worldwide is unacceptable and disproportionate,” Caroline Wilson Palow, legal director at Privacy International, told The FT. “People the world over rely on end-to-end encryption to protect themselves from harassment and oppression. No country should have the power to undermine that protection for everyone.”

UK media outlets (including the BBC, Reuters, Financial Times, The Guardian and more) have also filed complaints with the IPT, arguing that the case should be heard publicly. Ditto for the advocacy organizations Big Brother Watch, Index on Censorship and the Open Rights Group.

The UK order requires Apple to give the government blanket access to private user data encrypted through its Advanced Data Protection (ADP) feature. Introduced in iOS 16.2 in 2022, ADP applies end-to-end encryption to iCloud data like device backups, Messages content, notes and photos. Even Apple can’t access it.

Apple removed ADP in the UK in response to the order before issuing its own legal challenge. But since the backdoor would also apply to users outside the UK, the private data of anyone with an Apple account would be vulnerable. Security experts (and common sense) warn that the backdoor would needlessly expose anyone with an Apple Account to foreign spying, hackers and adversarial countries.

We only know about the UK order because of a leak last month. That’s because it was issued under the country’s Investigatory Powers Act 2016, which expanded the surveillance powers of British intelligence agencies and law enforcement (earning its, uh, term of endearment, the “Snooper’s Charter”). The rules also prevent Apple from commenting on or publicly acknowledging the existence of the privacy-eviscerating order — or using its appeal to delay compliance. Apple said last month, “We have never built a back door or master key to any of our products or services, and we never will.”