Two-tier encryption in the UK
Apple's withdrawal of Advanced Data Protection for new UK users, following a secret government surveillance notice, has created a two-tier encryption system among British iPhone owners.
read it Offers a thorough, well-contextualized breakdown of how secret surveillance notices forced Apple into a fragmented security posture in the UK.
summary
Following a secret Technical Capability Notice from the UK government in January 2025 demanding backdoor access, Apple stopped offering Advanced Data Protection to new UK users. Because Apple cannot remotely strip encryption keys from existing users' devices, this created a two-tier system where legacy users retain end-to-end encryption while newer users do not. The piece details the history of tech companies resisting government decryption demands, the limitations of standard versus end-to-end encryption, and ongoing legal challenges regarding secret non-disclosure orders.
key points
- Apple removed Advanced Data Protection for new UK users in February 2025 to bypass a secret Technical Capability Notice demanding decryption capabilities.
- Because ADP settings are strictly controlled by user devices rather than Apple servers, existing UK users who enabled the feature beforehand retained their end-to-end encryption, creating a two-tier user base.
- Basic iCloud categories like Keychain and Health remain end-to-end encrypted by default, but major categories like Backups and Photos revert to Standard Data Protection for new accounts in the UK.
who should read it
Security-conscious engineers and privacy advocates tracking the ongoing clashes between tech companies and government surveillance mandates.
discussion skeptical
consensus
Commenters heavily criticize both the UK government's authoritarian overreach and Apple's selective resistance, noting that Apple readily complies with oppressive regimes like China while pushing back only when financially or politically advantageous.
pushback
Some push back on the idea that the UK is uniquely authoritarian, while others argue that consumers over-rely on Apple's closed-source promises without verifiable security audits.
"Withdrawing ADP in the UK did not affect the 14 iCloud categories that were already end-to-end encrypted by default, including iCloud Keychain and Health. ADP increases the total from 14 to 23 categories. For UK users without ADP, the additional categories (iCloud Backup, Photos, Notes, iCloud Drive and so on) revert to Standard Data Protection. ↩
"
Unfortunately this first phrase is not strictly true in the sense that UK customers have their e2ee secrets exposed under common use cases, without requiring a passcode. My copresenter and I published some research at DEF CON 34 this year …
A researcher points out that Apple's default end-to-end encryption claims in the UK are practically weaker than advertised due to underlying platform vulnerabilities.
Generated by an LLM from the article and thread. Check the sources before relying on it.