Security is hard. It’s even harder now that, apparently, the UK Government has secretly ordered Apple to reduce the security of its services. That’s why my colleagues and I had to take the government to court.
It’s an honest struggle to secure your organisation’s data. At Privacy International, like every organisation, we’re always struggling with decisions about where our data is stored, how it is secured, and how to ensure backups.
When our data is stored on servers elsewhere, like most organisations, we fret and take necessary additional measures. We take the natural position that the data should be secured. We use encryption to do so.
When I look at my phone, however, I worry. On there, amidst all my personal information, and my family’s, I also have my work data. On all our personal devices there are work emails, chats, contracts, reports, travel details, events, contacts… it’s nearly impossible to segment the two worlds. And yet that data also gets backed up. In my case, and for millions of people in the UK and billions across the world, our data ends up on Apple’s servers.
Named by Russia
For me, this became an urgent matter in August 2024. Since the Russian invasion of Ukraine, the Russian Government began listing individuals on the Ministry of Foreign Affairs website, ‘stop-lists’ of people. I was listed, amongst many others, as being part of ‘London’s hostile agenda’ against Russia.
Many UK parliamentarians (including ministers), and people working for academia, think tanks and the private sector have been similarly listed.
Sitting at home in August, seeing that listing, my heart sank. While I’m unlikely to visit Russia, and so the direct impact of that listing is limited, my name is nonetheless there to be seen by all, defined as an opponent of Russia.
My next response was to start hardening my home network and all my family’s devices. I turned on every security functionality I could, raising every bar there was.
Risks to family
Now those protections are being taken away from me, by the UK Home Secretary. On February 5th the Washington Post revealed that Apple had received an order from the UK Government to undermine the security of the very service I had turned on to directly control the encryption of my data on Apple’s servers. While Apple has said nothing publicly about this order, it soon thereafter announced that it would remove that service from the UK. As a result of that decision, I will at some point lose that ability to control my security.
I am again feeling exposed, targeted, and confused. I am worried about my family’s safety. And this time, it’s apparently because of the UK Home Secretary’s choices.
Unless the UK Government changes the course it seems to be on, my family and I will lose that layer of security on the private minutiae of our lives: the recipes we’ve saved to try at family mealtime, photos from my child’s school plays, videos from Christmasses past. Alongside are records of my work at PI with lawyers, journalists, and rights defenders across the world.
We stepped up and filed our case because everyone – including my family – has a right to privacy and security.
Oppressive governments
We believe that the UK’s apparent attempt to undermine encryption could have global consequences, opening up a back door to millions of people’s personal data that could be accessed by hackers and oppressive governments.
No government should have the power to suspend security, or to halt security innovation, affecting all users – whether in their country or affecting users world-wide. Yet that power exists in the Investigatory Powers Act, and it’s now purportedly been used, in secret.
This undermines the security of us all.
This is why we took our case to the Investigatory Powers Tribunal. For now, the UK’s secret order seems to have affected millions of people in the UK. Unless we all push back, it will affect billions of people across the world. The Home Secretary musn’t get to secretly decide the security fates of us all.
Dr Gus Hosein is executive director of Privacy International
