Root Causes 324: Apple Vs New UK Surveillance Bill

Hosted by

Tim Callan

Chief Compliance Officer

Jason Soroko

Fellow

Original broadcast date

August 7, 2023

The battle between government and encryption continues. The UK is attempting to build secret back doors into end-to-end encrypted services. In response, Apple has threatened to remove Apple services from the UK, including FaceTime and iMessage.

Podcast Transcript

Lightly edited for flow and brevity.

Tim CallanI'm looking at a BBC News article written by Zoe Kleinman. And the headline reads, Apple Slams UK Surveillance Bill Proposals. Maybe we should say what the article says and then we'll get into the way this ties into a lot of themes that we've already talked about. So this is the latest in the ongoing war between tech and government. Right, Jay?

Jason SorokoYou got it. To make it real simple, the UK government is looking to weaken security in encrypted products. So this is affecting more than just Apple. The article is about Apple because of Apple's responses, but this also affects things like Signal, which is an encryption messaging service and other things like that. But of course, within the Apple ecosystem, you buy yourself on iPhone, and iPad or Mac, part of those operating systems are iMessage and FaceTime, which are encrypted, and Apple claims, they don't build backdoors for one-off governments and this is where the friction really comes down to.

Tim CallanWe've covered that. Like we had an episode long ago about end-to-end encryption and the Apple platform. We covered it when Apple and FBI went up against each other trying to unlock an iPhone. This is a thing where Apple has staked out a position as a defender of consumer security and consumer privacy against government attempts to undermine that.

Jason SorokoThat is correct. And in fact all the way up to the CEO of Apple, they've made it really clear that privacy is an absolute priority at Apple. When asked questions about their architecture, do you have a backdoor, a front door, ways to compromise these things? Apple's like, look, we're just not in the business of handing these things out. We're not going to build products, we're not going to compromise products. And in fact, reading right from the article, like there's three bullet points here that I think are worth reading.

Apple says it would not make changes to security features specifically for one country that would weaken product for all users. Number two, some changes would require issuing software update, so could not be made secretly.

Tim CallanWhich is one of the requirements of the law.

Jason SorokoYou got it. And number three, the proposals, “constitute a serious and direct threat to Data Security and Information Policy that would affect people outside the UK”, which is probably true.

Tim CallanLet's unpack these because I think there's a lot here that's interesting.

One thing is, in general, if you are a company like Apple, you're going to say, look, I have an obligation to my users and I'm going to show strength against this kind of encroachment.

But then secondly, I think one of the important things that Apple points out is that the UK is attempting to enforce changes that would weaken security for everybody everywhere on the globe. This is something we see a lot where governments seem to be disconnected from the idea that technology platforms and the internet are bigger than their own borders.

Jason SorokoCorrect. Let's go back. I think Tim, I might have this wrong, but, I think the timing is pretty close to being right. Tim Cook, CEO of Apple, back in October 2015, apparently is quoted as saying privacy is a fundamental human right. I don't think he ever used terms like privacy absolutist or anything like that. That was the Apple way of saying that we're not going to compromise on privacy.

And Tim Cook even used himself as an example. His sexuality came up and other things he's brought up saying, look, for people who could very easily be targeted by a government or some sort of special interest group, nefarious or otherwise our products give people like that the confidence that they can communicate and use our products in a way where they don't have to necessarily worry about the jurisdiction that they're in, or other things like that. And, that's me paraphrasing a whole mishmash of messages that we've heard from Apple, and they're sticking to it. Tim, every time I hear any one of the five eyes, we've said this before, hey, let's make sure there's a backdoor. Let's make sure that encryption is seen as a bad thing. They always come up with that argument. And we've talked about this before - they always mention the very, very worst of the worst of the bad guys, the terrorists, the pedophiles, the other folks that just it's unthinkably bad if they had a capability to communicate securely with. But, then it comes down to the old question of well, good old fashioned police work is what always solved those problems and mass surveillance probably is not the answer.

Tim CallanAnd the potential for abuse of mass surveillance. So what are some of these countries we've seen? We've seen this kind of legislation attempted in the United States, UK, Canada, Australia. So that's at least four of the five eyes. I'm not aware of any from New Zealand, so maybe not them, but everyone else. Then you turn around and you say, but where have we seen sweeping privacy, vast, sweeping privacy violations where it was technically possible by them? Well, we absolutely have seen it in the United States. We all know about that one.

Jason SorokoTim, this is something we've talked about before, I don't think we can take this as me being subversive or anything. It's just a statement about governments in general, which is, we do know that amongst the five eyes, outside of Canada, and the United States, things such as freedom of speech laws aren't quite as distinctly enshrined. I'm not a lawyer, so I'm not even going to say what that means. But, Americans and Canadians have it written right in their constitutions about freedom of speech, and there's obviously limitations to that there's certain things you can or can't do. But in other countries, you just don't have the same kinds of rights. So can you imagine, Tim, uttering something across FaceTime, iMessage, or Signal or whatever, any one of these encryption tools, encryption capable tools, and these things are being mass surveilled to look for things that are said bad about a leader. Things that are said bad about a government minister. Things that are contrary to whatever. And you might say to yourself, awe, that'll never happen. That'll never happen.

Well, this is what I think privacy folks make the argument strongly about. You might think you're a good person, therefore, you're never going to be targeted, or you're the underdog, nobody cares about what you have to say. That may not always be true. Tim, there are other things going on in the world right now and I won’t even mention certain jurisdictions, but there seems to be a bit of a scary trend for even in countries where there is a high law something like a constitution that might be interpreted by a Supreme Court. There is now this pulling back of rights within these jurisdictions to say, hey, the Supreme Court has too much power. The government itself should have those powers and some members of the populace are like, well, I voted for you. So yeah, I agree. But what happens though, when the government goes after certain special interest groups, and targets them and wants to survey them.

Tim CallanOr what we talked about in the past in previous episodes, I know that's worth repeating here is the government isn't even a single monoculture. You could have individual organizations. You have individuals in law enforcement, or individuals in spy agencies who feel that the ends justify the means or have some argument about the greater good, who will go ahead and do these things unilaterally if they have the capability to do so. We've seen that as well.

Jason SorokoThose are all great big, highfalutin issues that are way, way above my paygrade and so I'm going to stop talking about those things and stop getting into trouble and get into things that you and I know about a lot more, which is business. Business doesn't work without being able to keep secrets. Business needs secure transactions. Business needs secure communications and when I hear about various five eyes countries wanting to reduce or eliminate encryption, within the business realm as well, it really sends a shiver down my spine because of the chilling effect it has within commerce, which it's not a good thing. You might think, then, well, well, once again it doesn't affect me, therefore, blah, blah, blah, but it's like, no, you can't run modern businesses without that kind of encryption, and the ability to keep secrets. The ability to have privacy. It's just the way it works. It's not the same as like liable laws, and all these other targeting special interest groups. It's not even what we're talking about the full implication of wanting to weaken encryption, and create backdoors has wide, wide, wide implications. I absolutely hear the argument about, hey, we got to go after terrorists, we gotta go after sex traffickers, we gotta go after the really bad, bad people in society. Agreed. And you should. I think police has been doing that since day one. I'm scared about mass surveillance because of what it sometimes ends up leading to.

Tim CallanThat give an inch take a mile thing that just always seems to always be a threat. So let's just make sure we're clear. Apple’s response to this was that Apple has said that if it comes down to it, it will remove services, like FaceTime and iMessage, rather than complying with this law, because first of all, it's technically impossible to comply with this law, technically impossible. And second of all, it is actually a global issue and their obligation to the rest of the world is greater than their obligation to people inside the UK. So Apple is taking a pretty strong stance. We've seen this happen with companies like Facebook in the past, where they threatened to pull things out in order to not have to comply with a local law that hurts everything. This is one of the things I think we see in the big tech companies’ toolkit, which is to say, you know what, we're gonna call your bluff. Are you really willing to let your citizens live without FaceTime? Are your citizens going to vote you back in if you force them to live without FaceTime? Let's see how committed to this you really are.That seems to be happening here again.

Jason SorokoYes, Tim. Absolutely. A completely different subject, but just showing you how the big tech companies are having are choosing to operate and being very absolute like this, in Canada, Google and Meta removing news from Canadians because of laws and additionally, Tim, this is one for you - I still cannot use Bard on my Canadian IP address.

Tim CallanThere you go. We've seen Google and Meta doing this against Canada. They've also had similar conflicts with Australia over laws for web services that they felt were an unworkable and unacceptable and we have seen the threats at least of pulling - - I think in the case of Australia, the last one I remember was about three years ago. I'm pretty sure Australia backed down, but we'd have to look that up. Don't send me an angry email if I got that wrong. But it's one or the other. But that conflict occurred. Right now it's going on big time in Canada. I find it interesting to see that these tech companies are very cognizant of their power and the idea that they have power that rivals the power of the government, of the national government of a reasonably large country, and that they're prepared to go toe to toe with those governments. I find that very interesting.

Jason SorokoIt absolutely is. It's one of the reasons why we're bringing it up. We're just covering the news. I know you heard some opinion here, but in reality, this is about just covering this because from an identity standpoint, a privacy standpoint and things like that intersect this podcast is in terms of subject matter, it's very interesting. We've covered it before. We're just giving you the update.

Tim CallanIt seems to be, this is one of those stories that doesn't go away. Like, we will return to this again because there'll be more activity in this regard, because this is the thing that governments try to do and governments want to do and the major tech companies seem to have a pretty consistent playbook, which is to push back very hard. Once again, we're watching that drama play out.

Stay informed with expert insights

Subscribe to Root Causes for engaging discussions on PKI, digital security, and best practices for protecting your organization's critical assets. Don’t miss an episode!