Apple plans to tighten iCloud data encryption

Apple has long promised that what’s on your iPhone stays on your iPhone. But that pledge came with the caveat that if law enforcement had a warrant for someone’s iCloud account, Apple could provide a file of unencrypted messages, photos, and notes.

Now the company plans to close that loophole.

On Wednesday, Apple announced that it was extending its end-to-end encryption system so that most iCloud data remains undecipherable, even when stored in data centers. Enhanced protections, which are optional, aim to make sensitive data inaccessible to hackers and governments. Previously, encryption only covered certain information, such as passwords, payment and health data.

The change creates a potential conflict with the US government and other governments that have clashed with Apple over access to data on criminals’ iPhones. Although Apple has refused to help law enforcement unlock iPhones over the years, it has responded to thousands of requests for iCloud backups that include unencrypted messages and photographs each year.

Law enforcement has been able to obtain confidential messages in high-profile cases, including the prosecution of former President Donald J. Trump’s 2016 campaign chairman Paul Manafort. In the first six months of last year, the company received requests for 7,122 iCloud accounts in the United States. These security upgrades would close that access.

“It’s great to see companies prioritizing security, but we have to keep in mind that there are trade-offs, and one that often goes unaddressed is the impact ‘it’s about reducing law enforcement’s access to digital evidence,” said Sasha O’Connell, an executive-in-residence at American University and a former section chief at the Federal Bureau of Investigation. “The big question is: who decides on this compromise? It continues to be in Apple’s hands.

Apple hadn’t fully encrypted iCloud data because it wanted to make it easier for customers to retrieve information from users who are locked out or have lost access to their accounts. But data breaches have tripled in the past seven years as more data migrated to the cloud, prompting Apple to want to tighten its security.

Apple’s new protections are part of a broader push by tech companies to improve customer safety. Google recently introduced end-to-end encryption for group chats in its Messages app, and Facebook’s WhatsApp started offering encrypted backups a year ago.

Users who opt for increased encryption for iCloud, which Apple calls Advanced Data Protection, can also separately increase their account security by obtaining a hardware security key, Apple said. The extra protection can be used by anyone, but was designed to protect the data of public figures who can be targeted by hackers, including celebrities, journalists and government officials.

Only three categories won’t be covered — Apple’s mail, contacts and calendar systems — because they’re plugged into legacy technology, the company said.

The program will roll out later this year in the United States and globally starting next year, Apple said. It will be available for customers in China, where a Chinese company manages the storage of their iCloud accounts.

A separate plan to scan iPhones for child sexual abuse images has been dropped, Apple said. This proposal, which was presented last year, was rejected by privacy activists.

Instead, Apple said it will update its messaging system in the future to cover nudity in videos. This will also make the technology behind these protections available to other messaging apps.