Apple: Advanced Data Protection Service

Question

14:36:00

Asked by

To ask His Majesty’s Government what assessment they have made of the impact on the privacy of Apple customers of the company’s decision to withdraw their advanced data protection service in the United Kingdom.

I beg leave to ask the Question standing in my name on the Order Paper and I draw the House’s attention to the fact that I am chair of Big Brother Watch.

This Government take privacy very seriously. We have a long-standing position of protecting privacy while ensuring that action can be taken against child sexual abusers and terrorists. I cannot comment on operational matters today, including neither confirming nor denying the existence of any notices. This has been the long-standing position of successive UK Governments for reasons of national security.

Once again, the Home Office has demonstrated its disdain for the privacy and digital security of British citizens and companies. Strong encryption is essential to protect our data and our commerce from attack by organised crime and rogue states. Any weakness inserted into encryption for the benefit of the authorities is also available to those who would do us harm—yet that is precisely what the Government are demanding from Apple. Can the Minister please explain why the Home Office wants to make Apple’s British customers the most at risk in the world of being hacked?

I know the noble Lord has long had an interest in these matters, because we served together some nine or 10 years ago on the Investigatory Powers Act. But he has to understand that, today, I cannot comment on operational matters relating to any issue, including neither confirming nor denying the existence of any notices. That is standard government procedure, and I cannot comment upon it. I know that I will, I am afraid, disappoint the noble Lord, but that is the answer I have to give him.

The fact that Apple has withdrawn this level of encryption from the UK is in the public domain, even if the noble Lord does not wish to comment on whether a notice has been issued. Can he comment on the fact that, for whatever reason, Apple has withdrawn that level of encryption from the UK? It is reported in the United States newspapers that it is because of a technical capability notice issued by the United Kingdom Government. Has this come up, in any sense, in discussions His Majesty’s Government have had with the United States Government in relation to both trade arrangements that might exist between us in the immediate future and our ambition to be an AI superpower in the near future?

The noble Lord raises issues that I know he has an interest in. Decisions made by Apple are a matter for Apple, and the removal of any features is a matter for Apple. Again, for reasons of national security I cannot confirm or deny any conversations that we have had or any issues that are undertaken.

My Lords, I understand that my noble friend cannot comment, obviously, on any notice issued to Apple in this regard, but what he could, I am sure, comment on is the nature of the assessment made by His Majesty’s Government of whether or not such a notice might be issued. Can he confirm that the consideration will include a trade-off between the general weakening of security and the position of confidentiality, against the gains that will be obtained by the security services in any opportunity to de-encrypt materials? In so doing, can he comment on whether or not such an assessment also looks at what other capabilities the security services may have in respect of individuals on whom they wish to obtain information?

My noble friend makes interesting points. The Government take privacy very seriously and have a strong reputation internationally for protecting human rights. Access to data can happen only under specific circumstances and with strict safeguards, and it is taken, when it can be taken, against child sexual abusers or terrorists. I come back to the point that I cannot comment on the operational issues relating to points made in this House today, including neither confirming nor denying the existence of any notices, and that is the position that I will have to advise the House of during the course of this Question.

I understand the Government’s concern with their own privacy and secrecy, less so that of family group chats and journalists’ WhatsApp messages. To avoid that, does the Minister acknowledge that it is not possible for Apple to open doors to all its customers’ data and ensure that only the police and intelligence services walk through, when it is obvious that criminals, foreign adversaries and others would exploit that weakness? Also, at a time when the Government are seeking to establish the UK as a leading hub for innovation and technology, does the Minister agree that it would be baffling if the Home Office were to squander that advantage by trying to bully tech companies into undermining their users’ privacy, security, civil liberties and free speech?

The Investigatory Powers Act, on which I served during its legislative passage with the noble Lord, Lord Strasburger, contains robust safeguards. It contains independent oversight to protect privacy and ensure that data is obtained only on an exceptional basis and only when necessary and proportionate to do so. That is the only answer I can give the noble Baroness today. I cannot comment on the operational issues or on the case she has mentioned in relation to Apple. I cannot confirm or deny any notices, and I have to stick to that position today for the House and for national security issues.

I acknowledge that the Home Office has already said, as has been endorsed today by the Minister, that it does not comment on operational matters, but it has been widely reported that this decision by Apple was taken in response to a government demand to view users’ encrypted data both in the UK and abroad. Of course it is right that the Government act to keep people safe, but they must do so while respecting people’s privacy. Can the Minister comment on how the Government intend to engage with Apple and other tech companies going forward to make sure that future discussions on security do not result in another unproductive breakdown of relations?

The Government take privacy extremely seriously. We have a strong international reputation for privacy, and we continue to work with companies to ensure that privacy is respected, but I cannot comment on the issue the noble Lord has mentioned concerning any ongoing issues or operational matters. I cannot confirm or deny any notices, and I will, I am afraid, have to repeat that again for the House today.

On a non-operational matter, can the Minister confirm that all decisions of the kind that have been mentioned will routinely be referred to the Investigatory Powers Tribunal so that it can decide whether government decisions were proportionate or disproportionate?

All proceedings will be referred to the Investigatory Powers Tribunal, and the decision whether to hold the discussion in public or private is for the tribunal. Those matters will be examined and any judgments on any issue at any time will be made by the tribunal. I hope that is a non-controversial matter for the noble Lord.

Does my noble friend the Minister agree that while encryption gives great security, if you add a journalist to the distribution list you lose that security?

I can only say that to my knowledge, that is a matter for another nation and not this one, and not this Home Office.

My Lords, further on a non-operational matter, are the Government always clear that their actions conform to the judgment of Podchasov v Russia by the European Court of Human Rights last February? It held that weakening end-to-end encryption or creating back doors could not be justified. Therefore, the Government could be in breach of Article 8 of the European Convention on Human Rights, which guarantees the right to privacy. Are the Government happy to be in the same boat as Russia as regards individual rights and encryption?

The noble Lord will know that Russia and this UK Government are so far apart that there is no correlation between the two under any circumstances. In fact, we will also once again publicly condemn the illegal invasion of Ukraine by Russia. That is how far apart we are on these matters. Access to data happens only under specific circumstances and with strict safeguards, so that robust action can be taken against child sex abusers and terrorists. That is the position of the Government. If any data is accessed, it is accessed by the Investigatory Powers Act for the tribunal, and under strict regulation, for the purposes of stopping bad people doing bad things.