Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Government

Apple Pulls Advanced Data Protection for New UK Users Amid Backdoor Demand

Apple says it can no longer offer end-to-end encrypted cloud backups in the UK and insists it will never build a backdoor or master key.

Apple vulnerabilities

Apple has pulled its privacy-themed Advanced Data Protection (ADP) feature from new users in the United Kingdom, a move clearly linked to UK government demands for a backdoor into encrypted cloud storage. 

“Apple can no longer offer Advanced Data Protection (ADP) in the United Kingdom to new users and current UK users will eventually need to disable this security feature,” Cupertino said in a brief statement.

The company did not explicitly say why it removed a crucial feature that protects iCloud data with end-to-end encryption, but said it was “gravely disappointed that the protections provided by ADP will not be available to our customers in the UK given the continuing rise of data breaches and other threats to customer privacy.”

“As we have said many times before, we have never built a backdoor or master key to any of our products or services and we never will,” Apple declared.

This wording provides a hint that the move is linked to a secret order from British authorities for Apple to provide blanket access to all encrypted content stored in iCloud — a request that would force the company to undermine its longstanding privacy protections. The UK order was first reported by the Washington Post.

The change means that while current UK users who have enabled ADP will eventually need to disable the feature to keep their iCloud accounts active, new customers in the region will only have access to Standard Data Protection. ADP, which offers end-to-end encryption for a wide range of iCloud data, now remains available only in markets outside the UK.

Advertisement. Scroll to continue reading.

Starting Friday, Apple said, UK customers attempting to access ADP will encounter a user interface message stating, “Apple can no longer offer Advanced Data Protection (ADP) in the United Kingdom to new users.” 

The company stressed that while the withdrawal affects nine iCloud data categories—such as iCloud Backup, iCloud Drive, Photos, and Notes—the 14 categories that are encrypted by default, including iCloud Keychain and Health data, remain protected.

Apple said it cannot disable ADP automatically for these users. Instead, UK users will be given a period of time to disable the feature themselves to keep using their iCloud account.

Advanced Data Protection for iCloud is pitched as Apple’s highest level of cloud data security that protects the majority of iCloud data using end-to-end encryption. 

It is an optional setting that comes with a promise that “no one else can access your end-to-end encrypted data, not even Apple, and this data remains secure even in the case of a data breach in the cloud“. 

Related: Apple Fixes “Backdoors” With Release of iOS 8

Related: Apple Backs Panel to Consider Encryption Compromise

Related: Industry Reactions to FBI’s Request for iPhone Backdoor

Related: Encryption Battle Reignited as US Govt at Loggerheads With Apple

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Organizations are investing heavily in third-party risk management, but breaches, delays, and blind spots continue to persist. Join this live webinar as we examine the gap between how organizations think their third-party risk programs are performing and what’s actually happening in practice.

Register

Explore how attackers are using AI to scale threats and how security teams can respond with AI-driven defenses. Protecting against unmonitored use of generative AI (Shadow AI) in business units and building and enforcing AI governance frameworks.

Register

People on the Move

Cyera has appointed Naveen Palavalli as Chief Marketing Officer.

Connie Devine has been promoted to Chief Information Security Officer at Phillips 66.

Jeff Lunglhofer becomes Chief Security Officer at Coinbase, replacing Philip Martin.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.