UK Removes Encryption Guidance from Government Sites

U.K. Government Removes Encryption Guidance

Recent actions by the U.K. government suggest a shift in its stance on encryption. Encryption advice has reportedly been removed from official government web pages, following demands for backdoor access to encrypted data held by Apple’s iCloud service.

Discovery of the Change

Security researcher Alec Muffett first identified the alteration. He noted in a blog post on Wednesday that the U.K.’s National Cyber Security Centre (NCSC) is no longer advocating for the use of encryption by individuals considered to be at high risk of cyberattacks.

Previous Recommendations

In October, the NCSC released guidance, specifically “Cybersecurity tips for barristers, solicitors & legal professionals.” This document explicitly recommended utilizing encryption tools, including Apple’s Advanced Data Protection (ADP).

How Apple’s ADP Works

ADP enables users to activate end-to-end encryption for their iCloud backups. This process effectively prevents unauthorized access to data stored on iCloud, including access by Apple itself and government entities.

Current Website Status

The web address that previously hosted the NCSC document now redirects to a different page. This new page omits any mention of encryption or ADP. Instead, it suggests that individuals at risk should employ Apple’s Lockdown Mode, a stringent security measure that limits certain device functionalities.

Document Removal Confirmed

Muffett’s research indicates that the original document has been completely removed from the internet, as evidenced by the Wayback Machine. A search of the U.K. government’s website by TechCrunch failed to locate any remaining encryption advice.

Lack of Response

Neither the U.K. Home Office nor the NCSC responded to inquiries from TechCrunch regarding this matter.

Connection to iCloud Backdoor Demand

This removal of encryption guidance occurs shortly after the U.K. government issued a secret order to Apple. The order requested the development of a backdoor to grant authorities access to users’ encrypted iCloud data.

Apple’s Response and Action

Following reports of the order, initially published by The Washington Post, Apple suspended its ADP feature in the U.K. The company confirmed to TechCrunch that ADP would no longer be offered to new U.K. users, and existing users would eventually be required to disable it.

Legal Challenge

Apple is currently contesting the U.K.’s data access order before the Investigatory Powers Tribunal (IPT), as reported by The Financial Times this week.