So today I saw an article that was posted which pointed out the fact that the surveillance
stayed more or less to some degree suffered a setback, which I always like to see.
Like Louis Rossman.
I think I tend to focus on the bad most of the time here on this channel.
And in this video I wanted to discuss the latest defeat that happened.
Like after months of kind of secret legal warfare, the UK government has been forced to abandon its
demand that Apple actually build a global encryption backdoor into iCloud data.
And this really represents the most significant privacy victory since Apple told the FBI to go
screw during the San Bernardino case way back in 2006.
Now how this actually affects everything no doubt will echo far beyond just one company or one country
for that matter for a while.
This victory in a way, even though it's like really small, it still demonstrates that resistance
actually works.
That corporations can be forced to choose sides and that even surveillance states will back down
when faced with determined opposition.
More importantly, it shows us exactly how the next phase of the encryption wars will
actually be fought.
Just as a quick note, I am not pro-Apple.
Like I have two laptops that are Apple computers, but I'm a Graph EOS fan all the way, 100% in,
it's no doubt the way to go.
The UK government demanded blanket access to end-to-end encrypted cloud data
for users on a worldwide scale.
They still want to build that massive surveillance infrastructure that will compromise the
privacy of every iPhone user on the planet, including millions of Americans.
The demand came through something called the Technical Capabilities Notice under the
Investigatory Powers Act of 2016.
Definitely a mouthful.
Most people know this law by its nickname, which is the Snoopers Charter.
And how creepy is this ship?
And so the legislation passed with really minimal opposition when it did pass and it grants the
UK government really sweeping powers to demand backdoors from technology companies.
Now Section 217 specifically allows governmental entities to force companies to remove
encryption protections and install deliberate security weakness into their actual products.
So when a country does this, they are in fact telling you that you are the enemy.
That's it.
There's no side-stepping that.
The technical details do matter here.
So when the UK issued the secret order in January of 2025,
they weren't asking Apple to just unlock specific devices for like specific investigations.
They demanded that the company fundamentally redesign
iCloud's advanced data protection feature to include a permanent governmental backdoor access,
right?
Like advanced data protection encrypts backups, photos,
notes, and other iCloud data so that even Apple can't access it.
My point is the UK government wanted that protection just eliminated globally.
And in February of 2025, the company disabled advanced data protection for all new
iCloud users in the UK.
And this meant that British iPhone users could no longer actually access the
highest level of encryption protection for their cloud-stored data.
Apple appealed the order through the investigatory powers tribunal with the UK government
attempting to keep the entire case secret from public scrutiny.
And when that failed, the demand would have created a systemic security flaw
that would have affected Apple's global infrastructure on a global level.
The technical implementation would have absolutely been devastating.
It would have created a backdoor for UK authorities.
And I say authorities because I dislike the term authorities.
For those of you that are new viewers, it's just distasteful to say.
Because they're not really authorities of anyone.
They're like, we're all free.
And most of us are free.
Moving on.
Basically, this was meant as a backdoor for them.
And it would have mean building in this vulnerability into the core encryption
systems that actually protect all iCloud data.
And there's no such thing as a backdoor that's selective
or that only works for the good guys,
which is the thing that governments love to try and sell.
Once that weakness exists, it comes to target for criminal hackers,
foreign intelligence services, and authoritarian regimes worldwide.
Now, this connects directly to the pattern of government encryption attacks
that we've seen in the past.
Like remember the 2006 San Bernardino case,
where the FBI actually demanded Apple create custom software
to break into a terrorist's iPhone.
And Apple flat out refused arguing that creating
such a tool would actually establish a dangerous precedent in general.
I absolutely agree with that.
And undermine global security at the same time.
And the FBI eventually did find a third party hacking firm
to supposedly break the encryption,
but the legal precedent remained unsettled in actuality.
And the UK demand represented an escalation beyond
even the San Bernardino one that we just talked about,
where the FBI wanted to access like that one specific device.
The UK demanded a permanent backdoor access
to cloud services used by hundreds of millions of people.
They wanted to normalize government mandated
vulnerabilities that were being made,
essentially be manufactured in this civilian encryption infrastructure.
And as weird as it sounds, American intervention
actually proved decisive in actually stopping this overreach, right?
So the US National Director of Intelligence here in the US,
Tulsi Gabbard actually confirmed that the Trump administration
directly pressured the UK government to abandon the mandate.
And Gabbard stated that protecting American citizens and crypto data
became a priority for US intelligence leadership
with Trump himself reportedly comparing the UK demand
to surveillance tactics that are actively used by China.
Now, while that is true, I'd also point out that here in the US,
the government also regularly seeks to
erode our privacy rights as well.
I have to like completely reset here.
This is supposed to be like a positive we one kind of video
and I'm completely going off track with it.
The US and the UK both share really extensive intelligence
under agreements like Five Eyes,
but American officials recognized that allowing the UK
to weaken Apple's encryption would compromise American users' privacy as well.
We should definitely not be so short-sighted
as to believe that this was all done for our benefit or our security
or they care about us.
That is idiotic at best, right?
But this created a rare instance where
US intelligence agencies actually prioritized
civilian privacy over extended surveillance capabilities
probably because it would have messed with them, right?
Again, they're not doing any of this to look out for us
or to have our back or anything along those lines.
Like, I can't, I'll stop my head.
You're really going to think of an example
where the US intelligence agencies have tried to advocate for user privacy.
It seems more like an anathema to them.
Like, Senator Ron Wyden and Representative Andy Biggs
had written to Gabbard warning that UK backdoor demands
constituted effectively a foreign cyber attack
waged through political means.
They argued that if Apple built backdoors for the UK,
those same vulnerabilities would exist in American phones,
in our tablets, and in the computers,
undermining the security of federal, state,
and local government agencies that actually rely on Apple products.
And at that point, they weren't advocating for you and me.
They were advocating for those local, state, and federal agencies
even though they are meant to represent us.
That's who they were actually thinking about
when they wrote these letters.
The fact that they had to explain this
to the US director of national intelligence,
in my opinion, is kind of telling, but whatever, right?
Anyone can tell you that encryption doesn't work
through geographical boundaries, right?
Like, your PGP isn't contingent on if you're in XYZ country.
And intelligence agencies understand this perfectly well,
considering the fact they do a lot of exploitation.
Snowden basically showed that the NSA and GCHQ
deliberately targeted encryption systems
because breaking them once provided access to vast amounts
of civilian communications.
And the UK demand followed this exact same logic
that we've seen in the past,
which is force one company to weaken their protection,
then exploit that weakness for something like mass surveillance
disguised as protection.
And once the first company does it, it starts a trend, right?
And starting with Apple kind of would have been
a great running start for that specific surveillance state.
Meta and Google said that they received no requests
and similar backdoor demands from the UK authorities.
And I have to wonder if that's because they already
get all the user data just by acting like an advertiser
and paying those companies for it, that makes sense to me.
If we give Meta and Google the benefit of the doubt, though,
which is stupid, but let's just do that.
We can hypothetically then say that this suggests
that the government targeted Apple specifically,
possibly because iCloud's advanced data protection
was among some of the strongest consumer encryption
that's available by forcing Apple to weaken
this protection of feds across the pond
would have essentially eliminated one of the highest standards
of privacy protection that's used by mainstream consumers.
And that last part was very important.
The Investigatory Powers Act contains the legal framework
for this type of coercion.
The law requires companies to notify the government
about new security features before deployment.
And that gives the government an ample opportunity
to demand modifications or block the implementation entirely.
And this represents a really premeditated, prior restraint
on privacy innovation in general, where government approval
becomes necessary before companies can actually strengthen
their products or strengthen user protection.
Ian, Section 253 of the Act specifically empowers
governmental entities and agents to issue technical capability
notices requiring companies to remove encryption
or install surveillance capabilities.
These demands can target foreign companies operating in the UK
as long as they provide services to British users.
The law deliberately constructs a global reach
for British surveillance demands.
And people have been talking about this
since the Act's passage in 2016.
The technical capabilities notices could be used
to actually undermine encryption globally,
not just within the UK borders,
which is kind of the whole point of all this.
The Act also expanded bulk surveillance capabilities,
allowing the government to collect internet connection records
for the entire population.
Metadata surveillance combined with backdoor access
to encrypted communications really would have created a perfect storm.
Comprehensive monitoring infrastructure, so to speak,
comparable to authoritarian surveillance states.
Now, government officials constantly dismiss these concerns
during legislative debates.
Of course, they would absolutely make sense.
Like, if you want more power, why actually acknowledge
that you could become a tyrant with said power?
So instead, they just claimed that the safeguards
would prevent abuse and that surveillance powers
would only target legitimate security threats.
Who's deeming what a security threat is?
It absolutely makes no sense
if you have an IQ of room temperature, right?
The Apple backdoor demand really demonstrates
how quickly those kind of assurances of like,
oh, there won't be neighbors really prove worthless
when the government's gain legal tools
for coercing compliance.
Apple's resistance strategy was really effective
because it basically imposed real costs
on the UK government by disabling
advanced data protection for British users
instead of putting a backdoor in it.
So Apple basically made this surveillance demand
visible to the public by actually doing this.
British iPhone users had suddenly lost access
to the strongest encryption protections,
which obviously created immediate awareness
of governmental actions
that would have otherwise remained secret.
And like this is kind of a boss move on their part,
in my opinion, like good deeds are done in the light, right?
So this kind of transparency really forced
political accountability and the UK government found itself
kind of explaining why British citizens
deserved weaker privacy protection
than other users in other countries.
And media coverage really highlighted
kind of the global security implications,
which made it difficult to try and frame them
as demands that were just trying to
save you from the evil terrorists
and focused only on British law
and the needs of law enforcement there.
The legal challenge through the investigatory powers
tribunal added another pressure point.
Apple's appeal forced the government
to defend their demand in proceedings
that despite secrecy attempts,
generated public documentation of the surveillance overreach.
It would be great to see some of these ridiculous laws
and acts that have been enabled
have people move to actually abolish them as well
with this kind of momentum that it exists right now.
And again, like we established,
like this wasn't about the American users, right?
Like that's the narrative.
Apple's willingness to disable services
rather than build back doors
combined with the US government's intervention
really created a perfect storm
and sufficient pressure to force the UK's humiliating U-turn,
which is what has been dubbed.
So this victory really kind of establishes
important precedents for future encryption battles
that I'm sure we'll see.
It shows that tech companies
can successfully resist backdoor demands
by making the cost of actually imposing it
have real consequences on the governmental policies
and the governments that are trying to impose it.
It also demonstrates that international pressure
can be effective when surveillance demands
actually affect users across a bunch of different borders.
But again, like one thing we should not get twisted is like
this is not something that was done for your or my benefit, right?
This was done for the God level people, right?
The ones who can commit federal crimes
and not get charged for it.
So this is bigger than just this specific case, right?
Governments worldwide have been watching
to see whether Apple would actually buckle
and comply with the UK backdoor demands
and success would have absolutely encouraged
similar mandates from other countries
creating a race to the bottom, so to speak,
in kind of a global encryption standards.
And this defeat really sends kind of the opposite message
that backdoor demands will face determined resistance.
And more importantly, that if you're in politics,
you'll get bad PR.
Like the technical precedent that was set really matters
and it matters equally.
By maintaining that encryption backdoors
are fundamentally incompatible with security,
Apple really reinforced in concrete
the cryptographic community's consensus
against engineered delivery of vulnerabilities
being put into the stuff that they use.
The fact that there's even a debate is insane.
Now the technical stance kind of becomes harder
for other companies to abandon
when industry leaders like Apple demonstrate
its importance through costly resistance.
Now the UK's Investigatory Powers Act remains fully operational.
So like that's not done or destroyed.
And it of course encapsulates that
not the technical capability,
notice powers intact with that.
So they still have the ability to demand
these encryption backdoors from other companies
or to target different technologies with similar mandates
and to see like we're starting encrypting user data
and the companies have to disclose that to the UK government
before they actually give users that privacy.
So all this kind of invasive stuff still exists
and still active, that's important to know.
These attacks are going to be ongoing
like and it could have already happened.
Like someone could have already given it
and we just don't know.
And recent amendments to the act
have actually expanded those surveillance powers
in several areas.
So the 2024 Investigatory Powers Amendment Act
actually weakened some of those safeguards
while giving government new tools
for accessing communications data.
The UK government will continue pushing
for surveillance expansion
despite this specific defeat.
And like in turn everyone has to keep pointing out
how screwed up that actually is.
Like the European Union's ridiculous regulation
to spy, which they've tried a hard sell
on the backs of the empathetic
is that it's about child safety
and it includes provisions that could require
chat control, which is a PC term
for total spying basically.
It's actually require messaging scanning
for encrypted communications
and Australia's Assistance and Access Act
already allows their government
to demand technical assistance from companies
including potential backdoor installations.
So the kind of global trend that's really creepy
that we're seeing right now
towards surveillance legislation
means this UK victory represents one battle
in a much larger war.
Like privacy protection requires sustained resistance
across multiple jurisdictions and technologies.
Governments learn from each attempt
adapting their kind of legal strategies
and creepy methodologies
and technical demands basically
based on previous success and failures.
And we see like the stupid ID requirements now
hitting the shelves in other countries
and the technology companies face
increasing pressure to choose between compliance
with surveillance demands
and protection of user privacy.
Apple's resistance in this case
really kind of demonstrates
that principled opposition can succeed
but it requires willingness
to really accept a significant business cost
and legal risks.
But the most important lesson
from this victory that's what it is
is that resistance works.
Like the devious mentality
that I think a lot of people have
is really uncalled for.
Government surveillance expansion
is not inevitable
and privacy is possible
but only with a lot of effort.
Like when corporations refuse to comply
when users demand privacy protection
and when diplomatic pressure reinforces
those kind of technical resistance
that already exists
it undermines the surround state's will
and they as we saw in this
retreat from that overreach
and they should.
It's like reaching across a fire
and getting burnt
and you pull your hand back.
It's just what it is.
It's a natural reaction.
Now I will say like
if I didn't already use Graphino S
this move would give me a
ton of inspiration
to actually change over
but Graphino S is the go man.
I do hope to see people build
on this momentum
if they want to go with support
companies that actually
resist surveillance demands
that oppose legislation
that mandates crazy stuff
like encryption backdoors
and mandates technical solutions
that preserve user privacy
in the end.
Basically I think that's a big W for them.
The surveillance apparatus
will definitely regroup
and try a different approach
and that's just kind of what it does
like they'll target other companies
and other technologies
and use other legal frameworks
and in fact they probably already have.
Every government that considered
similar backdoor demands
just watched the UK government
basically get kicked to the teeth
and forced into a humiliating retreat.
Every tech company now has a blueprint
for resistance.
Now if they actually use it
as a totally different thing
but consumers can ultimately choose
their fate and this again
this is far from the end of this war
like it's just confirmation that
we can actually win against them.
Thank you for watching to the end
as always I'll see you in the next video.