Apple wobbles on encryption

I’ve always been a bit uneasy about Apple’s willingness to comply with local laws in order to do business overseas.

Take China, for example, where Apple uses government-controlled data centers (operated by a Chinese state-owned company called Guizhou-Cloud Big Data Industry Development Co.) to store user data.

This complies with Chinese law, and there’s an argument to be made that it’s entirely appropriate to conform to local rules and regulations. After all, we expect Apple to comply with U.S. law — why shouldn’t that apply overseas?

On the other hand, Apple has long maintained that privacy is a fundamental human right — a stance I wholeheartedly agree with — and it’s disappointing to see those principals compromised in order to sell a few more trinkets.

But China is one of Apple’s biggest markets, responsible for about 20% of annual revenue (about $21 billion in 2024), so realpolitik obviously trumps.

Now Apple is capitulating to the U.K. government’s demands to open up a backdoor to U.K. customers’ iCloud backups.

Well, capitulating is too strong a word, but Apple is halfway complying by turning off Advanced Data Protection, the end-to-end “double encryption” that protects everything sent to iCloud.

Advanced Data Protection is particularly strong because the encryption keys are stored locally on the user’s devices. Nobody, not even Apple, can break in without direct access to those keys.

By contrast, regular iCloud backups are only partly encrypted, with Apple storing the encryption keys on its servers. This is mostly to help customers when they lose access to their devices and want to retrieve their data. But of course, law enforcement can subpoena Apple for those keys during investigations.

And that’s what Apple is doing in the United Kingdom. It’s turning off the strongest protections and leaving the door open for British law enforcement and security services to potentially access users’ iCloud data — although under what circumstances and using what mechanisms remains unclear.

So, instead of creating a backdoor as the U.K. government demanded, Apple is making it possible for U.K. authorities to just use the front door instead.

It’s disappointing, and I’m very curious to see if, and where, Tim Cook plants his feet on this slippery slope.

In the meantime, we’re working on a how-to post for U.K. readers that will detail exactly how to end-to-end encrypt everything sent to the cloud for backups. Look for it next week.

Also in today’s newsletter:

• If you’ve got your eye on a shiny new iPhone 16e — good news! Apple just opened up preorders ahead of next Friday’s retail launch.

• This looks like a great deal on a portable CarPlay screen. I bought a smaller screen for about the same price, and am now suffering terrible buyer’s remorse!

• If you want to get Apple Intelligence early — or access it in the European Union or on Vision Pro — here’s how.

• More buyer’s remorse! I bought a fancy cooler last year, which now looks like a primitive polystyrene box compared to this crazy smart cooler from Anker.

• This is a nice-looking setup. Jealous!

— Leander Kahney, EIC.

^{A message from the Cult of Mac Deals team}

^{A message from the Cult of Mac Deals team}

Tweets of the day

Wallpaper of the day

One more thing ...

Today’s poll

Results from yesterday’s poll: Did you have an iPod Shuffle?

Best reader comments

Subscribe to The Weekender — Get the week's best Apple news, reviews and how-tos from Cult of Mac, every Saturday morning. Our readers say: "Thank you guys for always posting cool stuff" -- Vaughn Nevins. "Very informative" -- Kenly Xavier.