UK Government Removes Encryption Guidelines from Official Websites: What You Need to Know

The recent actions of the U.K. government regarding encryption advice have raised eyebrows, especially in light of its push for backdoor access to encrypted data on Apple’s iCloud. This alteration in policy, noted by security expert Alec Muffet, reflects a significant shift in the government’s stance on data protection for high-risk individuals.

Encryption Advice Disappears from U.K. Government Websites

In a surprising move, the U.K.’s National Cyber Security Centre (NCSC) has removed its recommendations for using encryption tools from its official guidelines. This change was highlighted by Muffet in a blog post, noting that the NCSC no longer advises high-risk individuals to utilize encryption for safeguarding their sensitive data.

Previous Recommendations on Encryption

Just last month, the NCSC published a document titled “Cybersecurity Tips for Barristers, Solicitors & Legal Professionals,” which included strong recommendations for employing encryption tools. One of the highlighted tools was Apple’s Advanced Data Protection (ADP), which enables end-to-end encryption for iCloud backups.

• End-to-End Encryption: This feature ensures that data stored on iCloud is inaccessible to anyone, including Apple and government bodies.
• Lockdown Mode: The NCSC now suggests that at-risk individuals use Apple’s Lockdown Mode, an extreme security measure that limits access to specific functionalities.

Document Disappears from the Internet

The URL for the original NCSC document now redirects to a different page that omits any mention of encryption or the ADP feature. Muffet discovered that the original document has been “wholesale deleted from the internet,” although it remains accessible via the Wayback Machine. A search by TechCrunch revealed that no encryption guidance is currently available on the U.K. government’s website.

The Implications of Encryption Policy Changes

This removal of encryption advice aligns with a controversial order from the U.K. government for Apple to implement a backdoor into its systems, allowing authorities access to encrypted iCloud data. This information was first reported by The Washington Post.

As a result of the order, Apple has temporarily halted the availability of the ADP feature in the U.K. and informed TechCrunch that new users in the region will no longer have access to this encryption option, with existing users anticipated to disable it eventually.

Ongoing Legal Challenges

In light of these developments, Apple is challenging the U.K.’s data access order through the Investigatory Powers Tribunal (IPT), as reported by The Financial Times this week. This legal battle may have significant implications for user privacy and encryption policies in the U.K. moving forward.

For further insights on cybersecurity and data protection, visit our cybersecurity resources page.