Britain’s dispute with Apple over encrypted data has produced an unusual argument in court.
The government will not confirm that the order being challenged exists.
Apple and civil-liberties groups say that position has become “farcical”.
At an Investigatory Powers Tribunal hearing on Thursday, lawyers challenged the government’s continued refusal to confirm or deny whether it has ordered Apple to provide access to encrypted cloud backups belonging to UK users.
The reported demand concerns Apple’s Advanced Data Protection system.
ADP uses end-to-end encryption for categories of information stored in iCloud, meaning the encryption keys necessary to recover that data are held on trusted user devices rather than by Apple.
That prevents Apple itself from simply handing readable copies of protected data to authorities.
The security benefit is also what creates the law-enforcement problem.
A government investigating terrorism, child exploitation or serious organised crime may obtain lawful authority to access someone’s data.
But a provider cannot produce information it does not possess the technical ability to decrypt.
Britain’s answer has reportedly been a Technical Capability Notice.
Such notices can require communications providers to maintain technical capabilities necessary to comply with lawful surveillance demands under the Investigatory Powers Act.
The dispute began earlier this year when Britain reportedly issued Apple with a notice seeking access that could extend beyond UK users.
That generated an extraordinary confrontation with Washington.
US officials objected to Britain potentially seeking access to data belonging to Americans, and the broader demand was subsequently withdrawn following negotiations between the two governments.
But the dispute did not disappear.
Reuters reports that Britain issued another Technical Capability Notice in July.
This one reportedly applies only to UK users.
The British government will neither confirm nor deny that.
That is what Thursday’s hearing was principally about.
The government argues that secrecy is itself part of the surveillance system.
Confirming whether particular companies have received technical notices could reveal intelligence capabilities to criminals, terrorists and hostile states.
Someone trying to evade British surveillance could potentially choose communications services based upon what government disclosures reveal about their accessibility.
Apple and the civil-liberties organisations challenging the government see a different problem.
How can the public scrutinise an extraordinary surveillance power when the government will not even acknowledge whether it has used it?
Ben Jaffey KC, representing Privacy International and Liberty, told the tribunal that the government’s position had “become farcical”.
The criticism points to a democratic problem separate from the technical encryption dispute.
Surveillance necessarily requires secrecy in individual investigations.
Nobody expects police to notify a suspect that their communications are about to be intercepted.
But secrecy surrounding the existence and legal scope of surveillance capabilities raises a different question.
Citizens cannot debate the boundaries of a power they are not permitted to know has been exercised.
The technical argument is equally difficult.
Apple’s position is that there is no way to create exceptional access exclusively for legitimate authorities.
A mechanism capable of bypassing end-to-end encryption is still a mechanism capable of bypassing end-to-end encryption.
Apple argues that creating one introduces a weakness that hackers, hostile governments or other attackers could eventually attempt to discover or exploit.
The British government does not accept that strong privacy should prevent lawful access to data needed in serious investigations.
That conflict has existed since encrypted communications became widespread.
Governments describe the problem as “going dark”: investigators may possess legal authority to obtain information while encryption makes exercising that authority technically impossible.
Technology companies describe the proposed solution as creating a security weakness for everybody in order to make particular investigations easier.
Neither side’s concern is imaginary.
Encryption protects ordinary users from criminals, foreign intelligence services and data theft.
Encryption can also protect criminals from legitimate investigation.
The hard question is whether technology can reliably distinguish between the two.
Apple has already responded to Britain’s actions commercially.
Earlier this year it withdrew Advanced Data Protection from new UK users rather than create the access capability reportedly sought by the government.
Existing UK users were subsequently required to disable the feature.
Apple has repeatedly said it will never build a backdoor or master key into its products.
The tribunal now has two disputes to resolve.
The immediate one concerns secrecy.
Should the government be allowed to maintain its neither-confirm-nor-deny position when the existence of the reported notice has already been widely reported and is itself the subject of litigation?
The larger case concerns the notice itself.
That substantive challenge is not expected to be heard until 2027.
No court has ruled that the government’s conduct is unlawful.
Nor has the tribunal yet decided whether the reported notice should be publicly acknowledged.
But the case already exposes the peculiar difficulty of governing encryption.
The government wants the ability to obtain information when the law says it should have access.
Apple says creating that capability weakens security precisely because encryption cannot know whether the person trying to bypass it has legitimate authority.
And before a court can determine where that balance should lie, Britain and Apple are arguing about whether the public is even entitled to know that the government asked.
Sources
Join the Dissenting Citizen Newsletter
Independent news and commentary delivered directly to your inbox.
Breaking stories, analysis and commentary throughout the day.
Follow @VoxDissent →
