{"id":22748,"date":"2022-12-20T03:01:32","date_gmt":"2022-12-20T11:01:32","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=22748"},"modified":"2024-01-23T22:16:22","modified_gmt":"2024-01-24T06:16:22","slug":"apple-icloud-privacy","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/apple-icloud-privacy\/","title":{"rendered":"Apple Updates: Better iCloud Security"},"content":{"rendered":"\n

Apple has made two important announcements that will enhance privacy for its users, and that could have important beneficial knock-on effects around the world:<\/p>\n\n\n\n

    \n
  1. Wired reported that Apple has dropped plans to bring in client-side scanning of images<\/a> stored in iCloud Photos, which it announced last year.<\/li>\n\n\n\n
  2. Apple aims to bring end-to-end encryption to iCloud.<\/li>\n<\/ol>\n\n\n\n

    While the first would have been a terrible setback for individual privacy, the second\u2026 is the very opposite. Most notably, governments and official authorities around the world are pushing back against individual privacy in the name of law enforcement. <\/p>\n\n\n\n

    Strangely enough, tech giants are also pushing back against authorities being able to access individual communications whenever they deem necessary. <\/p>\n\n\n\n

    What Is Apple Planning?<\/h2>\n\n\n\n

    First off, Apple scanning images stored in your iCloud would set a terrible precedent \u2013 it would mean that Apple can take control of people\u2019s phones without asking permission. Client-side scanning was also being held up by governments as an example of technology that could be used to detect child sexual abuse material (CSAM). <\/p>\n\n\n\n

    Naturally, everyone agrees CSAM is an extremely serious problem that needs tackling urgently, but client-side scanning is not the way to do it because it suffers from serious drawbacks<\/a>, as we previously reported. The fact that Apple has discontinued its plans to develop this technology will make it harder for governments to claim that it is a solution that already exists, and therefore should be implemented widely. <\/p>\n\n\n\n

    Second, Apple\u2019s other major announcement concerns end-to-end encryption<\/a>:<\/p>\n\n\n\n

    \n

    iCloud already protects 14 sensitive data categories using end-to-end encryption by default, including passwords in iCloud Keychain and Health data. For users who enable Advanced Data Protection, the total number of data categories protected using end-to-end encryption rises to 23, including iCloud Backup, Notes, and Photos. The only major iCloud data categories that are not covered are iCloud Mail, Contacts, and Calendar because of the need to interoperate with the global email, contacts, and calendar systems.<\/p>\n<\/blockquote>\n\n\n

    \n
    \"\"<\/figure>\n<\/div>\n\n\n

    The most important addition to the list of data categories using end-to-end encryption by default is iCloud Backup. This is essentially a copy of all the data on a user\u2019s device, and therefore of great interest to law enforcement, since it potentially allows them to search through the contents of a device without needing the device itself. <\/p>\n\n\n\n

    In the wake of Apple\u2019s latest move, even if the company agrees to share the iCloud data with the authorities, it will be encrypted in such a way that only the owner can decrypt it \u2013 Apple doesn\u2019t hold the relevant key.<\/p>\n\n\n\n

    Governments Want Access to Your Individual Privacy<\/h2>\n\n\n\n

    Governments around the world are fighting to undermine end-to-end encryption. They claim that law enforcement must have ready access to everything, if necessary, but end-to-end encryption makes that impossible. <\/p>\n\n\n\n

    One of nations in the vanguard of the attack against individual privacy is\u2026 the UK. The Online Safety Bill<\/a> is in the final stages of the legislative process, and contains measures that would seriously undermine encryption. A legal analysis<\/a> commissioned by Index on Censorship explains what the law says in this area:<\/p>\n\n\n\n

    \n

    Companies in scope will be forced to monitor and analyse private communications en masse to avoid the risk of facing fines of up to \u00a318 million [around $22 million] or 10% of a company\u2019s global annual turnover \u2013 whichever is higher. This inevitably will include the choice of whether to comply with back-door requests and give just UK users less protection for their private messages, or to pull out of the UK altogether if the requirements are incompatible with companies\u2019 own red lines on encryption technology and the services they provide.<\/p>\n<\/blockquote>\n\n\n\n

    The UK Is Not The Only Country Against Individual Privacy <\/h2>\n\n\n\n

    One of the most vocal critics of the proposed law is WhatsApp, owned by Meta. Its UK boss, Will Cathcart, has said<\/a>: \u201cThe hard reality is we offer a global product. It would be a very hard decision for us to make a change where 100% of our users lower their security.\u201d The only alternative would be to withdraw WhatsApp from the UK altogether. Although that is a drastic move, it reflects the fact that there are no magic solutions whereby governments can be given access while ensuring that users\u2019 privacy is fully protected.<\/p>\n\n\n\n

    Unfortunately, the UK is far from alone is bringing in a new law that would effectively ban end-to-end encryption. As we reported<\/a> in October, the European Union is well advanced with its own plans to require providers to search all private chats, messages, and emails for \u201csuspicious content\u201d. What has been dubbed \u201cchat control<\/a>\u201d by its opponents would require companies to break end-to-end encryption in order to carry out those searches. <\/p>\n\n\n\n

    Abandoning the UK market is perhaps something that companies might contemplate, given its relatively small size, but leaving the much larger EU is probably not something they would be willing to do.<\/p>\n\n\n\n

    Another key market is India, not least for its future potential as a new economic superpower alongside the US, EU and China. It, too, is discussing a new law that would require Internet companies to make the contents of currently encrypted conversations available to the authorities. As the Hindustan Times explains<\/a>, Section 24 of the draft law \u201cempowers the government to be able to intercept messages, calls on platforms such as WhatsApp and Signal, which are encrypted \u2014 meaning that they are not stored and remain private between users, according to company policy.\u201d<\/p>\n\n\n\n

    The US Might Lead the Fight For Individual Privacy <\/h2>\n\n\n\n

    In the US, things are not quite so bad, but there is still a threat to end-to-end encryption in the form of the \u201cKids Online Safety Act<\/a>\u201d (KOSA), currently under discussion. At the end of November, a coalition of over 90 organizations sent a letter to Congress explaining why KOSA is likely to be harmful to children<\/a>. It includes the following reason:<\/p>\n\n\n\n

    \n

    by creating strong incentives to filter and enable parental control over the content minors can access, KOSA could also jeopardize young people\u2019s access to end-to-end encrypted technologies, which they depend on to access resources related to mental health and to keep their data safe from bad actors.<\/p>\n<\/blockquote>\n\n\n\n

    Against that background, Apple\u2019s move to add end-to-end encryption to its iCloud Backup is significant. It will alert many people to the need for this feature \u2013 Google seems to have noticed<\/a> \u2013 and make it harder for governments to call for its weakening or removal. <\/p>\n\n\n\n

    Quite how this epic battle between trillion-dollar companies and national law enforcement agencies will conclude is still unclear; but what is certain is its importance for the future of digital privacy.<\/p>\n\n\n\n