US Legislators Complain About Secretive British Court and Apple Encryption (theguardian.com) 90
Bruce66423 shares a report from The Guardian: A bipartisan pair of American politicians is telling Britain's most secretive court to stop hiding its handling of Apple's legal fight against a government demand to break into its customers' encrypted data, warning that Whitehall's taste for secrecy is 'needlessly' straining relations between the two allies. The letter (PDF), shared with the Guardian ahead of being sent to the investigatory powers tribunal (IPT) on Friday, is signed by the Democratic senator Ron Wyden of Oregon and the Republican congressman Warren Davidson of Ohio.
The row dates back to January 2025, when the Home Office served Apple with a technical capability notice under the Investigatory Powers Act, which requires companies to assist law enforcement in providing evidence. The UK government demanded that Apple provide a mechanism to access encrypted iCloud backups worldwide, a call the company met by withdrawing its Advanced Data Protection encryption feature from UK users the following month. Apple's challenge to that order at the IPT was later thrown out after the Home Office withdrew the original notice and issued a narrower one targeting only British users' data. "It is wholly inappropriate for a foreign executive body to attempt to dictate the distribution of powers within the US government, nor should it be permitted to use secrecy directives under the Investigatory Powers Act to frustrate Article I powers under the US Constitution," the pair wrote.
Wyden and Davidson write that Congress "is not only a co-equal branch of government, it is the First Branch," and argue that no government can be allowed to place "its demands beyond the reach of legislative inquiry."
"The UK government," they write, "cannot champion legislative oversight at home while using administrative gag orders to kneecap the constitutional authority of the US Congress."
The row dates back to January 2025, when the Home Office served Apple with a technical capability notice under the Investigatory Powers Act, which requires companies to assist law enforcement in providing evidence. The UK government demanded that Apple provide a mechanism to access encrypted iCloud backups worldwide, a call the company met by withdrawing its Advanced Data Protection encryption feature from UK users the following month. Apple's challenge to that order at the IPT was later thrown out after the Home Office withdrew the original notice and issued a narrower one targeting only British users' data. "It is wholly inappropriate for a foreign executive body to attempt to dictate the distribution of powers within the US government, nor should it be permitted to use secrecy directives under the Investigatory Powers Act to frustrate Article I powers under the US Constitution," the pair wrote.
Wyden and Davidson write that Congress "is not only a co-equal branch of government, it is the First Branch," and argue that no government can be allowed to place "its demands beyond the reach of legislative inquiry."
"The UK government," they write, "cannot champion legislative oversight at home while using administrative gag orders to kneecap the constitutional authority of the US Congress."
Fair point (Score:2)
Re: (Score:2, Troll)
Re: Fair point (Score:2)
The French will be on Britain's side this time and the Germans too, probably...albeit coincidentally.
Perhaps, "Now you know how it feels!" is more likely.
Re: (Score:2)
Re: Fair point (Score:2)
Re: (Score:2)
As the UK still seems to like to suck up to the US, it will be interesting to see what happens.
No. it will all be quite boring wrt Apple ... (Score:2)
it will be interesting to see what happens.
No, it will be quite boring. The UK will issue "a technical capability notice under the Investigatory Powers Act, which requires companies to assist law enforcement in providing evidence" and Apple will say that they have no such technical capability if the user has not voluntarily shared their encryption key with iCloud.
Re: No. it will all be quite boring wrt Apple ... (Score:1)
Unlike e.g. grapheneos, apple can always issue device specific updates to instruct the firmware to hand over the keys, so yeah, they have the technical capability to assist.
Grapheneos also isn't within their jurisdiction, though theoretically the UK could do like France once did and kidnap and then imprison one or more developers until they cooperate. I.e. the wrench attack. On the other hand, the users would have ample warning to distrust the signing keys a long, long time before any device specific update
Re: (Score:2)
Re: No. it will all be quite boring wrt Apple ... (Score:1)
Either way, they can face stiff fines or an import ban because their product doesn't comply with their laws, which require them to be able to perform microagression audits.
Re: (Score:2)
So, getting massive fines levelled on Apple UK would do nothing for Apple US, you think? Think again.
A Mac CPU cannot see encryption key (Score:2)
apple can always issue device specific updates to instruct the firmware to hand over the keys
Apple designed their secure enclave hardware to prevent such hypothetical orders.
"The Secure Enclave is a hardware-based key manager that’s isolated from the main processor to provide an extra layer of security. When you protect a private key with the Secure Enclave, you never handle the plain-text key, making it difficult for the key to become compromised. Instead, you instruct the Secure Enclave to create and encode the key, and later to decode and perform operations with it. You receive only the
Re: (Score:2)
Sure. But there is a thing called an "decryption oracle". Apple can definitely push an update to this specific device that decrypts all the message that the attackers want decrypted and send them back. It may require the user to decrypt something else and then they just use that unlock. Unless the secure enclave directly communicates with the user and asks the user about every individual message, this type of attack is possible.
Also note that this type of attack is well-known to cryptographers and competent
Re: No. it will all be quite boring wrt Apple ... (Score:1)
As I read the article, Apple already pulled the sophisticated encryption from consumer iPhones, so the data on Apple iPhones in UK is no longer protected by anything that intelligence agencies can't crack (in other words, UK iPhone users can't secure their data from gov't access).
Re: (Score:2)
As I read the article, Apple already pulled the sophisticated encryption from consumer iPhones....
I am unaware of Apple remove the Secure Enclave from anything? Was it perhaps something else that was removed?
"The Secure Enclave is a hardware-based key manager that’s isolated from the main processor to provide an extra layer of security. When you protect a private key with the Secure Enclave, you never handle the plain-text key, making it difficult for the key to become compromised. Instead, you instruct the Secure Enclave to create and encode the key, and later to decode and perform operations
Re: (Score:2)
Re: (Score:2)
Just tell the US to look in a mirror...
Re: (Score:2)
Re: (Score:2)
This is unrelated to the topic at hand, but that thing you said there needs to be seen as a warning. If we push the tax burden too much to one side, that argument will be made, and it will have traction. If one party keeps pushing for lower taxes, and the other keeps pushing for higher taxes only on the rich, at some point we'll end up with only 10% (or less) of the population paying for everything. They will have a valid grievance that the rest of the population is simply robbing them. That can e
Re: (Score:2)
I wonder what the UK's response will be.
I think they are responding adequately already. The statement about US laws doesn't even warrant a response since this has nothing at all to do with US laws, congress, or the USA in the slightest. The Constitution of the USA affects the USA only, and even then it seems lately no one gives a shit about it anyway.
Re: (Score:2)
The administration can go to the Court and argue that this is a foreign affairs issue, and Congress doesn't have the authority they've claimed in the letter, but does the ad
Re: (Score:2)
Why does the UK need to respond to what some American politicians think?
Re: (Score:2)
Or because they have a point. Absent a treaty, the UK can't tell the White House to hide something from Congress. That is what has happened here, according to the letter.
Golly that kettle is dark! (Score:4, Insightful)
It is wholly inappropriate for a foreign executive body to attempt to dictate the distribution of powers within the US government, nor should it be permitted to use secrecy directives under the Investigatory Powers Act to frustrate Article I powers under the US Constitution
1) The UK is not subject to Article I of the US constitution.
2) How's Nicolas Maduro doing these days?
3) Whence derives our right to unilaterally impose economic sanctions against foreign companies, banks, and even governments?
Re: (Score:2)
Its like an evil version of the "heads I win, tails you lose" game, spun instead as "Do as I say, not as you do".
Re: (Score:3, Interesting)
I'll bite:
1) The UK is not subject to Article I of the US constitution.
1. The colonies fought a war to ensure that the USA is not subject to the jurisdiction of the UK. The UK may not regulate US entities without the consent of the US government, and the US politicians object to some of the terms of the regulations the UK is applying.
2) How's Nicolas Maduro doing these days?
2. He is doing OK, for a political prisoner. His capture was a smokescreen for the theft of Venezuelan oil production.
3) Whence derives our right to unilaterally impose economic sanctions against foreign companies, banks, and even governments?
3. WWII. The USA emerged from WWII as the strongest and most stable power remaining in the world. The other allied
Re:Golly that kettle is dark! (Score:4, Insightful)
But we both know you're intentionally sidestepping the common thread to those three points. Well, that, or I'm being naive in not just assuming the answer is "might makes right".
Re:Golly that kettle is dark! (Score:4, Insightful)
That's a non-sequitur. The USA is not subject to the jurisdiction of the UK, but US citizens physically in the UK are, and companies based in the US but doing business in the UK have to comply with UK law as it affects their operations in the UK or accept the corresponding penalties as the cost of doing business there.
Re: (Score:2, Informative)
Not a non-sequitur, but the actual point of the complaint:
-The complaint by the US congressmembers was that the UK ordered Apple explicitly not to disclose the details to the US Congress.
-As Apple is a US company the US Congress has original jurisdiction. It is improper to order Apple not to respect that jurisdiction.
Someone posted more details farther downthread, with links to the actual text of the complaint letter.
Re: (Score:1)
As Apple is a US company the US Congress has original jurisdiction. It is improper to order Apple not to respect that jurisdiction.
AAPL may be a US company but its subsidiary Apple UK is not.
Re: (Score:3)
Re: (Score:2)
Re:Golly that kettle is dark! (Score:5, Insightful)
Yes, and?
Countries, including America, have investigatory rules where you are not allowed to talk about it at all. Want to do business in a country? You need to obey their rules. And you don't have a leg to stand on complaining if you have similar roles because then you're not saying the rules are morally wrong, you're saying you're special.
It is absolutely not improper for the UK to do such a thing and the US would have no qualms about using a national security letter (is that the right term?) on an American subsidiary of a UK company. It's how laws and jurisdictions work. Having a foreign ownership doesn't give you special dispensation to break a country's laws. Apple UK are absolutely subject to every single one of the UK's laws. They're also subject to quite a lot of American ones, having an American owner, but that's their problem not the UK's, and doesn't give any special treatment other than what America can force on the world under the universal law of might is right.
Note this is all orthogonal to what I personally think of the RIPA (my quite strong opinions are in other much older Slashdot posts).
Re: (Score:2)
Countries, including America
America is not a country.
Re: (Score:2)
Re: (Score:3)
-The complaint by the US congressmembers was that the UK ordered Apple explicitly not to disclose the details to the US Congress.
So? It's very common for details of legal proceedings to be kept secret. And not just for limited times, either. When there are settlements it is very common to not reveal them ever.
-As Apple is a US company the US Congress has original jurisdiction.
If Apple doesn't want to be subject to the UK's original jurisdiction (this works exactly [cornell.edu] the opposite of how you think it works) then they don't have to do business in the UK. That is voluntary on their part. If they don't want to be subject to the law there, they can simply not operate there. But now it's too late, and they
Re: (Score:2)
Re: (Score:2)
I don't disagree that what the UK wants to do is offensive, but that doesn't change the fact that Apple has to obey the law in order to operate there. They have the option not to do so.
Re: Golly that kettle is dark! (Score:2)
The irony is the at if Apple and Google do leave the uk and eu market, meaning no more iOS or Android, then the ones filling the gap are not going to be Nokia or some other crippled EU startup, but it will be mostly Chinese companies with a Chinese made OS.
If you believe the US is evil and China is benevolent that's fine. More and more governments around the world criminalize failure to "goodthink".
With the stories of LG TVs constantly recording you even when the screen is turned off, I would hope that poli
Re: (Score:2)
The irony is the at if Apple and Google do leave the uk and eu market, meaning no more iOS or Android
This will not happen. Apple and Android do not want to abandon whole markets to competitors, they want to dominate these markets. This is a weird fantasy that keeps popping up, usually from people who are proud of being from the US and champion a weird understanding of freedom of expression and freedom of choice. Apple and Android are not interested in freedom; they want your money, brain bandwidth, and everybody else's. Give it to them in a totalitarian society and they will happily take it.
Re: (Score:2)
Re: (Score:2)
Now, note the second paragraph of the letter where they point out that Apple was told they could talk to the White House, but not Congress. That's a problem. Congress has oversight and investigations powers. They can call
Re: (Score:2)
That's what these members of Congress are complaining about. The UK telling Apple and the White House that they can't talk to Congress about something.
Re:Golly that kettle is dark! (Score:4)
The UK can certainly regulate US company operations within the UK. It obviously can't regulate them outside the UK.
If the UK does decide to regulate US company operations within the UK, it doesn't have to agree to anything asked by US lawmakers because it's not their jurisdiction.
Re: (Score:2, Informative)
The complaint by the US congressmembers was that the UK ordered Apple explicitly not to disclose the details to the US Congress.
That is regulating Apple in the USA.
Re: (Score:3)
Well, there's a clash of jurisdictions there. The UK is within its rights to punish Apple in the UK if it discloses information from the UK without permission. The US is also within its rights to punish Apple if it doesn't disclose the information, I suppose, but the US government can't really do anything directly against the UK and vice-versa.
I'm sure if the situation were reversed---if there was something the US government wanted kept secret that a foreign government wanted to know---the US would be q
Re: (Score:3)
Yes I'm aware that sounds odd, but I deal with these situations fairly regularly (although am not any form of lawyer, this is absolutely not legal advice etc.). C
Re: (Score:2)
The complaint by the US congressmembers was that the UK ordered Apple explicitly not to disclose the details to the US Congress.
That is regulating Apple in the USA.
No it's not. That's regulating Apple in the UK. The thing everyone seems to forget is that Apple isn't an American company. It's a "multinational" company. And it is very much possible to legally compel a company to not share details internally with other business units. Apple can still talk to congress, but congress isn't automatically privy to the details of a "foreign" company in a "foreign" market.
Sure the CEO probably knows more, but hey, you want to be the head of a multinational, that's why you have
Re: (Score:2)
It can, lots of countries, especially America regulate things outside their borders.
Laws can be enforced against local subsidiaries or any foreign executive who happens to wander into an area you have an extradition agreement with. Or in Americas case, any country you can successfully invade to kidnap someone. And in Putin's case anywhere you can get an assassination squad in. Also Israel's Mossad unit is notorious for plausible deniable foreign enforcement.
This isn't a question of should, it's a question o
Re:Golly that kettle is dark! (Score:4, Interesting)
It's rather rapidly becoming "worth the pain" since 2022. In 2021 over 95% of international trade was conducted using the USD, in 2025 it was just over 70% and this year will be lower. Just the CIPS and mBridge are replacing SWIFT, and after only two years A7 is already handling tens of billions of dollars in exchanges every month. Combine that with Bessant's panic at failure of recent Treasury sales and the upcoming sell-offs of Treasury bonds as the Gulf States try to stay financially afloat and we're looking at a whole new financial paradigm coming up.
Your answer 1 is wrong (Score:2)
The UK can wholly regulate US entity doing commerce in the UK on what they can or cannot do while selling to UK citizen, and their modality of information being saved UK data information for later access in UK.
And the US government can do diddly squat on that except trying political pressure (thus the article), and the company can go out of the UK market if they don't like the modality of it. Which in this case they did not,
Re: (Score:2)
Re: (Score:2)
Our govt isn't complaining because the UK is somehow subject to our constitution like you falsely state.
You pretty much had me nodding along in agreement until that line. To be clear, my original three points weren't meant as sarcasm (though #2 was admittedly snarky), I meant them more-or-less at face value - i.e., the polar opposite of "the UK is somehow subject to our constitution".
Sure, governments in peacetime tend to extend each other various courtesies by default. At the end of the day, though, the UK has absolutely no obligation to care what the US thinks about its own proceedings (up until the poin
Re: (Score:2)
International relations are entirely amoral. The answer to your third question is then simple. Might.
Once again, for the clueless (Score:5, Insightful)
There are only two choices, strong security or weak security.
It's impossible to have security that's strong against the bad guys and weak against the good guys.
It's impossible to precisely define who the good guys are and to guarantee that they will always be good.
It's impossible to stop the bad guys from corrupting or threatening the good guys.
Re: (Score:2)
Yes. Any expert and anybody that actually looked at the facts knows that. But these are people that are soo deeply afraid of what other people may think, they are not rational. For a reference, look at the religious fuckups that had to invent a vengeful God that punishes all wrongthink. These people are the same, just without that God but with technology that may even get them there partially. So they go for it and consequences and risks be damned.
Also note that the UK has not had full-blown fascism in newe
Re: (Score:2)
There are only two choices, strong security or weak security.
It's impossible to have security that's strong against the bad guys and weak against the good guys.
It's impossible to precisely define who the good guys are and to guarantee that they will always be good.
It's impossible to stop the bad guys from corrupting or threatening the good guys.
And those in power by definition need their power, hence, everyone else is only permitted weak security.
What matters is managing and adjusting the relative weaknesses, to maintain the pecking order.
There will always be back doors.
Re: (Score:2)
There are only two choices, strong security or weak security. It's impossible to have security that's strong against the bad guys and weak against the good guys. It's impossible to precisely define who the good guys are and to guarantee that they will always be good. It's impossible to stop the bad guys from corrupting or threatening the good guys.
CGPGrey summed it up nicely [youtu.be]:
"The nature of a keyhole is to be cracked, and the nature of the Internet is to bring demons to the door. No matter how much we might wish it, there is no way to build a digital lock that only angels can open and demons cannot. Anyone saying otherwise is either ignorant of the mathematics, or less of an angel than they appear."
Annual Report of the Investigatory Powers Commissi (Score:2)
IPCO
“Striking the right balance between upholding fundamental rights and the State’s need to deploy investigatory powers to protect national security or to prevent serious crime is difficult and the role IPCO plays is vital to achieving this. There is no system without its flaws or drawbacks and, as the Home Office’s reform of the IPA over the last fe
Secret Orders, Selective Oversight (Score:3, Informative)
The letter checks out. Some of the shorthand needs unpacking. The September 11, 2026 letter [guim.co.uk] names Ron Wyden and Warren Davidson and contains the quoted passages. It says Apple told Congress that the UK allowed briefings for the US attorney general, vice president and their staff, while prohibiting further discussion with Congress. That is the lawmakers' account of Apple's communications. Their constitutional objections are arguments in the letter, not a court ruling.
I checked the letter [guim.co.uk], and the quotes are there. The detail that caught my eye is the alleged distinction between briefing the US executive branch and briefing Congress. According to Wyden and Davidson, Apple was allowed to talk to the attorney general, vice president and their staff, while Congress was specifically excluded. Their constitutional objections are still arguments they are making; the letter doesn't establish that a court has agreed with them.
"Thrown out" needs procedural context. According to Computer Weekly's reporting on the October 6, 2025 order [computerweekly.com], Apple and the Home Office agreed that the original case should end because circumstances had changed. That followed reports that the worldwide demand had been withdrawn and replaced with one covering British users. The dismissal does not establish that the tribunal upheld the original demand on its merits. The notices themselves remain secret, which limits independent verification of their exact terms.
I'd also be careful with "thrown out." Computer Weekly reported [computerweekly.com] that Apple and the Home Office agreed to end the original case after circumstances changed. The government had reportedly withdrawn the worldwide demand and replaced it with one covering British users. Reading that dismissal as "Apple lost, so the backdoor was legal" goes further than the record supports. We still can't inspect the actual notices.
The tribunal had also already rejected the government's attempt to conceal the basic details of the case in its April 7, 2025 judgment [investigat...nal.org.uk]. However, paragraph 39 said it lacked the power to grant the earlier request for permission to discuss an alleged notice with Congress, directing that request to the Home Office. Public court proceedings and permission to brief Congress are distinct issues.
The tribunal deserves some credit here: it already rejected the demand to hide even the basic details of the case [investigat...nal.org.uk]. That same judgment said it couldn't grant the earlier request to let Apple discuss an alleged notice with Congress, and pointed that request toward the Home Office. Getting a hearing into public view doesn't automatically lift the gag on Apple.
The crypto distinction is who holds the keys. Apple confirms [apple.com] that new UK users cannot enable Advanced Data Protection, while existing users were to receive time to disable it themselves. This did not remove every form of iCloud encryption. Under standard protection [apple.com], backups remain encrypted in transit and at rest, but Apple holds the keys. Health data and iCloud Keychain remain end-to-end encrypted. A demand for access is also not evidence that Apple built a master key.
There's also a small date problem in the full Guardian article: it says Apple filed the new complaint in August.
this is funny.... (Score:3)
ok so maybe a little general knowledge helps...
This looks to me like a copy and paste from the a USA legal team to the UK... why ?
the USA courts routinely ask for backups from ANYWHERE in the world and even when they are encrypted they appear to use standard tools to decrypt
when you consider the number of American FISA (Foreign Intelligence Surveillance Act) requests to APPLE number over 500 and cover over 77,000 USERS
this starts to look a little silly and if I was to guess the legal team at Apple pushed ba
Re: (Score:2)
It's not ours.
'needlessly' straining relations (Score:2)
I actually agree with the US government's point here, but - Trump does exactly this (needlessly straining relations with an ally) on an almost-daily basis! He's done damage to US international relations that may take decades to repair... if repair is even possible!
Re: (Score:2)
Still worth calling out. Things are needlessly strained enough.
But (Score:2)
Whatyagointodoaboutit? Encryption is here to stay.
hypocracy (Score:2)
"we demand our sovereignty, and also demand you relinquish yours!"
lolol (Score:2)
"The UK government," they write, "cannot champion legislative oversight at home while using administrative gag orders to kneecap the constitutional authority of the US Congress."
The constitutional authority of the US congress ends with our waters, unless of course we decide to invade your country. But it seems unlikely we'll invade the UK. Not enough oil.
Re: (Score:2)
Re: (Score:2)
My question is whether or not England comes in as one single State, or if it should be broken up a bit. Will it be the States of Wales, Scotland, Northern Ireland, and England, or ...I dunno, Wales, Scotland, Northern Ireland, Wessex, East Anglia, Mercia, and Northumbria?
Where's AniMoJo? I want his input on what we'll call where his home.
Re: (Score:2)
B. Agreed. I too remember the indignity Dolly Madison was forced to endure as she rescued priceless works of art from the White House as the filthy Brits set it aflame. We should have taken it quietly in '44, but that's in the past. States 51-54 are the future.
3. This is the best damn idea you've ever had!
What the USA 'wanted' (Score:2)
I'm from the US (Score:2)
Five Eyes (Score:2)
When Five Eyes partners no longer trust the US with secrets demonstrates how far our reputation has fallen.
Re: (Score:2)
hmmm (Score:2)
This reminds me of a case where a British court and an American court each ordered litigants not to litigate a case in the other's court.This was in law school decades ago and I'm too lazy to look it up, but it's the same kind of issue where if you want to do business in either country you can get easily screwed.
Haha, got their own medicine! (Score:2)
Straining relations? (Score:2)
Never mind the thin skinned orange man baby and the effect heâ(TM)s having on relations with all his back stabbing and attacking of allies! Perhaps look a closer to home and fix your own house first.
The only appropriate response is to: (Score:2)
Rename the North Atlantic to the English Pond, and have King Charles scribble his name in a giant black marker on the bill when it makes its royal ascent.
Make UK data plaintext. (Score:2)
Instead of giving the British government a backdoor key, however, make all data from UK phones plaintext in UK data centers. Degrade TLS so that an Arduino could find the keys for decryption in a matter of seconds.