Apple's encryption row with UK should not be secret, court rules

A judge has sided with a coalition of civil liberties groups and news organisations - including the BBC - and ruled a legal row between the UK government and Apple over data privacy cannot be held in secret.

The Home Office wants the right to be able access information secured by Apple's Advanced Data Protection (ADP) system, citing powers given to it under the Investigatory Powers Act.

At the moment Apple has no such capability - such data can only be accessed by the user - and says it does not want to create what it calls a "backdoor" into ADP because of concerns it would eventually be exploited by hackers and criminals.

The government's request prompted fierce criticism from privacy campaigners and some US politicians.

In February, Apple pulled ADP from the UK and in March it launched legal proceedings against the government, in a case which is being heard by the Investigatory Powers Tribunal.

The government argued it would damage national security if the nature of the legal action and the parties to it were made public - what are known as the "bare details of the case".

In a ruling published on Monday morning, the tribunal rejected that request - pointing to the extensive media reporting of the row and highlighting the legal principle of open justice.

"It would have been a truly extraordinary step to conduct a hearing entirely in secret without any public revelation of the fact that a hearing was taking place," it states.

"For the reasons that are set out in our private judgement, we do not accept that the revelation of the bare details of the case would be damaging to the public interest or prejudicial to national security," it later adds.

In a statement the Home Office said it would not comment on legal proceedings or individual notices but said its "first priority is to keep people safe."

"There are longstanding and targeted investigatory powers that allow the authorities to investigate terrorists, paedophiles and the most serious criminals and they are subject to robust safeguards including judicial authorisations and oversight to protect people's privacy," it added.

It stressed it was not seeking blanket data access - and any requests to view individual accounts protected by ADP would need a court approved warrant.

Civil and digital rights organisations in the UK, which criticised the Home Office request, have welcomed Monday's ruling.

They, along with news organisations - including the BBC - made legal representations for the case to be heard in public.

"This is bigger than the UK and Apple," said Jim Killock, executive director of Open Rights Group.

"The Court's judgment will have implications for the privacy and security of millions of people around the world."

The Open Rights Group campaigned alongside Big Brother Watch and Index on Censorship against the proposal to hold the hearing in secret.

Big Brother Watch interim director Rebecca Vincent says the judgement is "effectively chipping away at the pervasive climate of secrecy surrounding the Investigatory Powers Tribunal's consideration of the Apple case".

"The Home Office's order to break encryption represents a massive attack on the privacy rights of millions of British Apple users, which is a matter of significant public interest and must not be considered behind closed doors," she adds.

Apple declined to comment.

In a previous statement it told the BBC: "Apple remains committed to offering our users the highest level of security for their personal data and are hopeful that we will be able to do so in the future in the United Kingdom.

"As we have said many times before we have never built a backdoor or master key to any of our products or services and we never will."

ADP is an opt-in data security tool designed to provide users of devices such as iPhones with a more secure way to protect data such as photos and notes stored in their iCloud accounts.

It uses what is known as end-to-end encryption (E2EE), meaning only the user has the "key" unnecessary to unscramble and access the data.

E2EE is also used to protect data on messaging services including WhatsApp and Signal.

It makes the data very secure - but poses a problem for law enforcement agencies.

They can request to view information stored with lower levels of protection - but companies such as Apple have no way of allowing them to view files secured with E2EE because they do not possess such a capability.

Campaign group Privacy International said the right of individuals also needed to be protected - and welcomed today's ruling.

"Executive decisions affecting the privacy and security of billions of people globally should be open to legal challenge in the most transparent way possible", it said.

Additional reporting by Chris Vallance