The UK government wants messaging services to seek approval for security features before releasing them to customers. The act lets the UK government demand that security features such as end-to-end encryption be disabled immediately upon request, without telling end users.
Many messaging services currently offer end-to-end encryption – so messages can be unscrambled by only the devices sending and receiving them.
WhatsApp and Signal are among the platforms to have opposed a clause in the Online Safety Bill allowing the communications regulator to require companies to install technology to scan for child-abuse material in encrypted messaging apps and other services.
They will not comply with it, they say, with Signal threatening to “walk” from the UK.
Apple has also opposed the plan.
The government has opened an eight-week consultation on the proposed amendments to the IPA., which already enables the storage of internet browsing records for 12 months and authorises the bulk collection of personal data.
Apple has consistently opposed the act, originally dubbed a “snooper’s charter” by critics. Its submission to the current consultation is nine pages long, opposing:
• having to tell the Home Office of any changes to product security features before they are released
• the requirement for non-UK-based companies to comply with changes that would affect their product globally – such as providing a backdoor to end-to-end encryption
• having to take action immediately if a notice to disable or block a feature is received from the Home Office, rather than waiting until after the demand has been reviewed or appealed against
Apple says:
• It would not make changes to security features specifically for one country that would weaken a product for all users.
• Some changes would require issuing a software update so could not be made secretly
• The proposals “constitute a serious and direct threat to data security and information privacy” that would affect people outside the UK
Cyber-security expert Prof Alan Woodward, from Surrey University, said technology companies were unlikely to accept the proposals.