Apple plans to launch Advanced Data Protection, offering E2EE on iCloud backups, Notes, Photos, and more, in the US in 2022 and globally including China in 2023

‘Advanced Data Protection’ will offer end-to-end encryption on iCloud backups, Notes, Photos and other services—a step that may draw ire from law enforcement

Wall Street Journal 2022-12-08

Context & Ripple Effects

Apple’s move reverses the posture described in coverage of its earlier abandoned plan to encrypt iCloud device backups after FBI objections. It also extends a privacy-oriented iCloud strategy that had already added Private Relay and Hide My Email to paid plans.

The planned global rollout, including China, sits against Apple’s earlier agreement to store Chinese users’ iCloud keys in China to meet local requirements. That makes key control—not simply encryption marketing—the central policy issue.

First-order effects

iCloud users gain end-to-end encryption for backups, Notes, Photos and other covered services, limiting Apple’s ability to access that protected content.
The FBI has already said the change hinders its work, while privacy advocates including the EFF have welcomed the feature.

Second-order effects

Apple must reconcile a service designed around user-held recovery access with country-specific data-access requirements, particularly in China.
The decision sharpens the contrast between Apple’s encrypted cloud offering and cloud services whose providers retain keys or can furnish stored content to investigators.

Third-order effects

If major consumer cloud platforms make end-to-end encryption a standard option, lawful-access disputes will increasingly focus on account recovery, metadata and device-level evidence rather than providers’ stored-content access.
China’s inclusion would make encryption policy a test of whether global cloud services can maintain one privacy architecture while complying with divergent national data-control rules.

The trend: Consumer cloud platforms are moving privacy controls toward stronger encryption while governments and law enforcement contest the resulting loss of provider-held access.

Discussion

@matthew_d_green Matthew Green on x
Why Apple's announcements today are a big deal, a thread. 1/
@joannastern Joanna Stern on x
BIG NEWS: Apple is finally bringing end-to-end encryption to most of iCloud, including backups, Photos, Notes and more. Apple's calling it Advanced Data Protection. Full story here, including my exclusive interview with Craig Federighi: https://www.wsj.com/...
@fredericjacobs Frederic Jacobs on x
“For users who enable Advanced Data Protection, the total number of data categories protected using end-to-end encryption rises to 23, including iCloud Backup, Notes, and Photos.” https://www.apple.com/...
@bobmcmillan Robert McMillan on x
Apple is end-to-end encrypting the iCloud. Big time. https://www.wsj.com/... This could force another showdown with law enforcement, which is unhappy about the company's strong device-level encryption. Until now Apple had been able to provide full iCloud backups.
@paulbernaluk Prof Paul Bernal on x
Apple here choosing people over governments. Good directly, and good in that it suggests they think *people* haven't been fooled by governments' anti-encryption propaganda over the last few decades. https://twitter.com/...
@wcathcart Will Cathcart on x
Glad to see Apple definitively cancel their previous plans to scan people's private photos. Credit to them that they were willing to reverse course and do the right thing. https://twitter.com/...
@wcathcart Will Cathcart on x
Also excited to see Apple bring end-to-end encrypted backups to iCloud. We launched this on WhatsApp over a year ago and have seen more than 100 million users turn it on already. People want privacy. https://twitter.com/...
@sethforprivacy @sethforprivacy on x
This is actually a huge deal, both for Apple users and for Google users as it will inevitably cascade to other companies who are competing with Apple. Very surprised they actually pulled the trigger on this. https://www.wired.com/... Great thread on it below 👇 https://twitter.com…
@davemorin Dave Morin on x
Always doing the right thing. Bravo, Apple. https://www.apple.com/...
@kashhill @kashhill on x
Apple is going to offer opt-in end-to-end encryption, which means the iCloud workaround that law enforcement has had for getting access to iPhone data would be cut off for those that opt in: https://t.co/7Zg0FopvHA Would also mean Apple couldn't scan iCloud... https://t.co/fwUPi3…
@ahess247 Arik Hesseldahl on x
Good to see Apple throwing its weight behind hardware-based authentication. I'm a big @Yubico fan and if you value your security you should be too. https://www.techmeme.com/... https://twitter.com/...
@mer__edith Meredith Whittaker on x
Big credit to the privacy advocates who pushed back on troubling surveillance practices and made this happen! This kind of win often gets framed as a company's choice, when smart and difficult campaigning did so much of the work behind the scenes. https://www.washingtonpost.com/ …
@samfbiddle Sam Biddle on x
This is a huge deal and major privacy win as far I can tell—iCloud backups have always represented a pretty big loophole through Apple's encryption efforts, looks like that will end next year. https://twitter.com/...
@rsgnl Joe Rossignol on x
Joanna Stern has an interview with Apple's software engineering chief Craig Federighi about the expanded end-to-end encryption for iCloud Backups, Photos, Notes and more. https://twitter.com/...
@scobleizer Robert Scoble on x
This will be very important next year in the augmented reality headset which will scan your home. https://twitter.com/...
@brandonbutch Brandon Butch on x
Apple is upping its security game once again! 🔐 - End-to-end encryption for iCloud backups (available now) - Contact verification in Messages (available in '23) - Physical security key support for logging in to Apple accounts (available in '23) https://www.apple.com/... https://t…
@zollotech Aaron Zollo on x
Apple previews some future iOS updates to iCloud backups and major security updates. https://www.apple.com/...
@ericgeller Eric Geller on x
Apple is adding end-to-end encryption to iCloud, closing what has been a major loophole in the tech company's promise to shield user data from prying eyes. https://www.apple.com/...
@matthew_d_green Matthew Green on x
Looks like Apple is rolling out opt-in end to end encryption for iCloud backups. https://www.apple.com/...
@w7voa Steve Herman on x
Despite objections from law enforcement, @Apple has decided to offer fully encrypted backups of photos, chat histories and most other user data in its cloud storage system. https://www.apple.com/...
@justinamash Justin Amash on x
Good. If government can access this data, then so can criminals, and often the criminals are the government. https://twitter.com/...
@matthew_d_green Matthew Green on x
This will cover every kind of data except for iCloud Mail, Contacts, Calendars: features that require server access.
@joannastern Joanna Stern on x
And the full video is now on YouTube: https://www.youtube.com/... Go watch!
@shiraovide Shira Ovide on x
Apple will offer end-to-end encryption for iCloud for the first time, @josephmenn writes. Privacy advocates will love this but there are always HUGE tradeoffs. (Criminals including child abusers can shield their actions, too.) https://www.washingtonpost.com/ ...
@mabb0tt Michael Abbott on x
excited to launch this for our users! -> Apple's new Advanced Data Protection option, available starting by year-end, will offer end-to-end encryption on services including iPhone backups and Photos https://www.wsj.com/... via @WSJ
@mqsullivan Michael Quinn Sullivan on x
The same Apple that cooperated with the CCP to stop AirDrop between protesters? Seems like Apple's commitment to confidentially only applies to terrorists attacking US targets. https://twitter.com/...
@film_girl @film_girl on x
Huge scoop from @JoannaStern and @bobmcmillan: Apple planning encrypted iCloud Backups! Also, company confirms it stopped the CSAM scanning plans! https://www.wsj.com/...
@film_girl @film_girl on x
My stance on this remains as it was in 2016: if governments, LEO, and three letter agencies want access to stuff, they can hack and find the backdoors themselves. Companies should not be required to make it easy for them.
@alexeheath Alex Heath on x
Wow. Long time coming. And will be available in China! https://twitter.com/...
@anthony Anthony DeRosa on x
With these new security enhancements, Apple would no longer have the technical ability to comply with certain law-enforcement requests such as for iCloud backup—which could include iMessage chat logs and attachments https://www.wsj.com/...
@markgurman Mark Gurman on x
In a major security upgrade, Apple will offer end-to-end encryption for iCloud backups for the first time, support contact verification in Messages and allow physical security keys for logging in to Apple accounts. Story now on @TheTerminal.
@joannastern Joanna Stern on x
What took Apple so long? Federighi says the tech pieces had to be put in place, including tools to make user data recovery easier. Full story and video here: https://www.wsj.com/...
@dnvolz Dustin Volz on x
Big NEWS: Apple is expanding its end-to-end encryption system to include the iCloud, a significant step that will prevent the company from being able to provide data from iCloud phone backups in response to law-enforcement requests. https://www.wsj.com/...
@joannastern Joanna Stern on x
It's coming in beta today and to all in U.S. by the end of the year. Global release is set for 2023. Federighi confirmed it's coming to China. https://www.wsj.com/...
@dnvolz Dustin Volz on x
New: FBI responds to Apple's encryption announcement today, says it needs “lawful access by design” in tech to do its job effectively https://twitter.com/...
@eff @eff on x
A year ago, EFF supporters spoke up to Apple and said: Don't scan our phones. Today, privacy won. https://www.eff.org/...
@riana_crypto @riana_crypto on x
To paraphrase Gibson: The past is here, it's just not evenly distributed. Apparently, inside the FBI building it's still five years ago. https://www.justsecurity.org/ ... https://cyberlaw.stanford.edu/ ... https://twitter.com/...
@jakelaperruque @jakelaperruque on x
Is the FBI saying they haven't been doing there job effectively for the past decade? Because we've been encrypting average Americans' phones, laptops, and communications for a very long time. Chicken Little makes this complaint every year but the sky still hasn't fallen https://t…
@josephmenn Joseph Menn on x
You have to feel for them. There's the political pressure of recent years, the awesome responsibility of catching terrorists, and on top of that they have to take the extremely lonely position of arguing there is too much internet security.
@josephmenn Joseph Menn on x
https://twitter.com/...
@charliehrysmith Charlie Harry Smith on x
When the FBI find something like this “deeply concerning” you can probably bet it's a net-good for society. (Unless it's all performative and they have a back door 😜) https://www.macrumors.com/...
@josephmenn Joseph Menn on x
Our updated Apple encryption story adds comment from a displeased FBI. https://www.washingtonpost.com/ ...
@naomibrockwell Naomi Brockwell on x
HUGE news, Apple is finally rolling out E2EE for iCloud! I've reported in the past about how FBI pressure reportedly caused Apple to back out of e2ee years ago. They're now pushing ahead anyway, and this is going to mean a MASSIVE increase in privacy for a LOT of people. 👏 https:…
@runasand Runa Sandvik on x
Glad to see Apple drop its CSAM detection tool and instead acknowledge that protecting young people on the internet requires preserving their right to privacy. https://www.wired.com/... https://twitter.com/...
@privacymatters @privacymatters on x
1/ Apple Kills Its Plan to Scan Your Photos for CSAM. Here's What's Next https://www.wired.com/... BUT. Apple prescreens and scans content you upload to Apple for potentially illegal content & CSAM. On what basis I hear y'all ask. Their legitimate interests. Do you have a choice …
@lilyhnewman Lily Hay Newman on x
Apple told @WIRED that it's killing the iCloud Photos CSAM scanning plan for real and is instead investing in its opt-in family features for protecting kids and attempting to disrupt exploitation before it happens/escalates https://www.wired.com/...
@parkerortolani Parker Ortolani on x
Hoping Apple makes their own physical security key 🤞🏻
@ericgeller Eric Geller on x
Apple is also (1) letting people use physical security keys to access their Apple ID accounts and (2) alerting users when someone they're texting might have had their account compromised by hackers who added their own device to the person's account for eavesdropping purposes.
@blowdart Barry Dorrans on x
Interesting positioning from apple that physical fido keys are really meant for “users who, often due to their public profile, face concerted threats to their online accounts, such as celebrities, journalists, and members of government” https://www.apple.com/...
@rsgnl Joe Rossignol on x
In addition to expanding end-to-end encryption to many new iCloud categories, Apple has also previewed new “iMessage Contact Key Verification” and “Security Keys for Apple ID” features that will be available globally on the iPhone and other devices in 2023. https://twitter.com/..…
@seanwrightsec Sean Wright on x
This is great news. It might even help drive adoption perhaps? https://9to5mac.com/...

Chronicles