alecm<p><strong>Alec’s Personal, Utterly Speculative Opinion: Why does the UK Government want a Backdoor into Apple iCloud Encryption? Answer: “Corporate & Foreign Government Espionage for Five Eyes”</strong></p><p>In case this is not clear enough from the headline, I’ll repeat: <em>the following is utterly personal and very speculative speculation re:</em> why the UK Home Office are pursuing a backdoor into Apple’s iCloud product, a privacy weakness that will be local in scope but global in nature — <a href="https://alecmuffett.com/article/112801" rel="nofollow noopener" target="_blank">although we can all be reassured that they pinky-promise to be nice and not abuse that privilege</a>.</p> <p>All this said: since ~1990 I have, almost non-stop, sought to promote adoption of — and prevent restriction upon — cryptography, so maybe my opinion now carries a bit of weight. </p><p>Therefore:</p><p><strong>I believe that the purpose of the UK TCN backdoor into iCloud is primarily to enable Corporate, Government, & various other Espionage across Five Eyes</strong></p><p>That’s it. There’s also a bit of historical baggage which the late and lamented Professor Ross Anderson used to describe along the lines of:</p><blockquote><p><em>“…[elements within] the UK Home Office believe, and have always believed, that they have a god-given right to read all message content…”</em></p><p>(personal communication) </p></blockquote><p>— and they’ve been trying to hold back the flood of encryption for 40 years, so why stop now? But…</p><ul><li>It’s <em>certainly not</em> about Labour vs: Conservative; the demand for a backdoor has been in the pipeline / rumoured in civil society for more than a calendar year, so it predates the Labour government by some margin.</li><li>Maybe it is <em>a bit, but not greatly</em> about preventing CSAM or terrorism; CSAM can be very effectively combated by user-reporting, <a href="https://www.youtube.com/watch?v=LBTOKlrhKXk" rel="nofollow noopener" target="_blank">metadata analysis fanout</a> plus tracking-down abusers who have installed <a href="https://endsexualexploitation.org/articles/kik-a-predators-paradise/" rel="nofollow noopener" target="_blank">various sketchy apps</a>, not to mention the ongoing social campaigns to prevent grooming and abuse “at source”; and the big end-to-end-secure apps like WhatsApp and Messenger <a href="https://www.youtube.com/watch?v=LBTOKlrhKXk" rel="nofollow noopener" target="_blank">already work on this basis</a> in a content-privacy-preserving manner</li><li>Similarly, terrorism: back in the 1990s the UK Police (i.e. the security services) would regularly demand, e.g. from telcos like <em>Vodaphone</em>, lists of calls to-or-from a watchlist of certain (i.e. IRA) phone numbers for anti-terrorism purposes</li><li>So if today GCHQ don’t already demand/obtain lists of people who have installed niche, less-safety-focused communications apps on a similar basis, and then <a href="https://en.wikipedia.org/wiki/XKeyscore" rel="nofollow noopener" target="_blank">cross-correlate them</a> against cookie-tracking and other semi-public surveillance technologies, I will be <em>very surprised</em> — because <a href="https://endsexualexploitation.org/articles/kik-a-predators-paradise/" rel="nofollow noopener" target="_blank">that’s how and where the abuse really happens</a>, and how it is best combated.</li><li>So: abusers and terrorists are already both well-surveilled by other means, and Apple iCloud seems a niche means to pursue them.</li><li>But who would a backdoor in iCloud <em>really</em> help target?</li></ul><p>Answer: Corporations & Governments using MDM.</p><p><strong>Rationale</strong></p><p>ADP is both a nerd technology, and a niche technology; it’s not the default. It <em>might</em> provide a protective blanket for content generated and shared by a bunch of terrorists or abusers who are simultaneously <em>smart enough</em> to enable it, but yet <em>stupid enough</em> to open themselves to seriously well-resourced tracking and analysis of their metadata footprint.</p><p>But you know who will really be making <a href="https://support.apple.com/en-gb/108756" rel="nofollow noopener" target="_blank">major, mass use of ADP</a>?</p><p>Answer: <em>big corporations and governments which switch it on for hundreds, perhaps even many thousands of iPhones at a time, by means of Mobile Device Management (MDM).</em></p><p>Brazilian mining companies <a href="https://www.theguardian.com/world/2013/oct/08/brazil-accuses-canada-spying-nsa-leaks" rel="nofollow noopener" target="_blank">that compete with Canada</a> and <a href="https://www.theguardian.com/world/2013/sep/09/nsa-spying-brazil-oil-petrobras" rel="nofollow noopener" target="_blank">the USA</a>, the UK <a href="https://www.theguardian.com/uk-news/2018/sep/21/british-spies-hacked-into-belgacom-on-ministers-orders-claims-report" rel="nofollow noopener" target="_blank">spying on Belgian Telcos</a>, there are legion reasons for spying on corporates around the world, and as GCHQ puts it:</p><p><a href="https://www.gchq.gov.uk/information/investigatory-powers-act" rel="nofollow noopener" target="_blank">https://www.gchq.gov.uk/information/investigatory-powers-act</a></p><blockquote><p>These grounds are that interception is necessary:</p><ul><li>In the interests of national security; or</li><li>In the interests of <strong>the economic well-being of the UK</strong>; or</li><li>In support of the prevention or detection of serious crime</li></ul><p>IPA also requires safeguards to be in place to limit the use of intercepted material and related communications data.</p></blockquote><p>The <a href="https://www.legislation.gov.uk/ukpga/2016/25/section/20" rel="nofollow noopener" target="_blank">act itself</a> constrains those powers:</p><blockquote><p>A targeted interception warrant or targeted examination warrant is necessary on grounds falling within this section if … in the interests of the economic well-being of the United Kingdom so far as those interests are also relevant to the interests of national security</p></blockquote><p>But continues… </p><blockquote><p>A warrant <strong>may</strong> be considered necessary … only if the information which it is considered necessary to obtain is information relating to the acts or intentions of persons outside the British Islands.</p></blockquote><p>…which (“may?”) does not strike me as a terribly onerous nor an insurmountable barrier to operation, especially if this is all hush-hush top-secret.</p><p><strong>tl;dr</strong></p><ul><li>There is a long history of economic espionage of corporations & foreign governments</li><li><a href="https://en.wikipedia.org/wiki/Five_Eyes" rel="nofollow noopener" target="_blank">FVEY</a> (pre-Trump?) pursue and share corporate/economic espionage</li><li>Once one FVEY country obtains access to a resource, <a href="https://www.aclu.org/news/national-security/british-spying-our-problem-too" rel="nofollow noopener" target="_blank">all of them have it</a>, <a href="https://www.theguardian.com/world/2013/nov/20/us-uk-secret-deal-surveillance-personal-data" rel="nofollow noopener" target="_blank">bidirectionally</a></li><li>Popular adoption of ADP at-scale is most likely via use of MDM, which is mostly an enterprise/institutional tool</li><li>To understand who is being surveilled, look at who most uses the technology</li></ul><p>I can’t see any incremental benefit to the pursuit of abusers and terrorists to be worth the necessary expenditure of political capital necessary to obtain a backdoor into Apple iCloud.</p><p>But: I can totally see an <em>“economic well-being”</em> cost/benefit argument.</p><p></p><p><a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://alecmuffett.com/article/tag/apple" target="_blank">#apple</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://alecmuffett.com/article/tag/end-to-end-encryption" target="_blank">#endToEndEncryption</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://alecmuffett.com/article/tag/feed" target="_blank">#feed</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://alecmuffett.com/article/tag/fvey" target="_blank">#fvey</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://alecmuffett.com/article/tag/home-office" target="_blank">#homeOffice</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://alecmuffett.com/article/tag/surveillance" target="_blank">#surveillance</a> <a rel="nofollow noopener" class="hashtag u-tag u-category" href="https://alecmuffett.com/article/tag/tcn" target="_blank">#tcn</a></p>