Aleksei - stock.adobe.com

WhatsApp seeks to join Apple in legal challenge against Home Office encryption orders

WhatsApp today applied to intervene in an Investigatory Powers Tribunal case that is considering the UK’s ability to issue a technical capability notice on Apple to ‘weaken encryption’

Encrypted messaging service WhatsApp is seeking to intervene to support Apple in its legal fight to challenge a secret Home Office order that critics say would undermine the privacy and security of its users.

WhatsApp’s CEO Will Cathcart has submitted evidence to the Investigatory Powers Tribunal today, raising concerns that the move by the UK government would undermine the security of people using encrypted communication and cloud services.

Cathcart argues that the secret notice, known as a technical capability notice (TCN), would set a “dangerous precedent for security technologies that protect users around the world”.

The head of WhatsApp also argues that the proceedings in the Investigatory Powers Tribunal, a court that frequently hears complaints over the misuse of surveillance powers behind closed doors, should be held in public because of the high public interest in the case. 

The technology company, which provides an encrypted messaging service that ensures messages can only be read by senders and recipients, is seeking to intervene in a case brought by Privacy International and Liberty, challenging the Home Office. The Investigatory Powers Tribunal will make a ruling on whether to accept WhatsApp’s application.

Apple is bringing its own case at the Investigatory Powers Tribunal, challenging the lawfulness of the Home Office’s TCN, which requires the company to provide UK law enforcement agencies with access to encrypted messages and data stored by Apple users who use its Advanced Data Protection (ADP) cloud service.

WhatsApp: Case sets dangerous precedent

WhatsApp warned that the case could undermine the security of people’s private communications and expose them to attacks from hackers and hostile nation states.

“We’ve applied to intervene in this case to protect people’s privacy globally. Liberal democracies should want the best security for their citizens. Instead, the UK is doing the opposite through a secret order,” said Cathcart.

“This case could set a dangerous precedent and embolden nations to try to break the encryption that protects people’s private communication,” he added.

WhatsApp’s intervention, if agreed by the tribunal, is likely to raise political tensions between the UK and the US, where the Home Office’s orders against Apple have attracted criticism from US President Donald Trump and Tulsi Gabbard, director of US National Intelligence.

Last week, US lawmakers on both sides of the political divide called on Congress to suspend US and UK law enforcement agencies’ data-sharing arrangements for 30 days unless the UK withdrew the order against Apple.

Security experts have criticised the UK

The UK’s move has also been criticised by leading cyber security experts and cryptographers, including Phil Zimmerman, inventor of email encryption software PGP; Ronald Rivest, one of the inventors of the RSA encryption algorithm; cyber security author Bruce Schneier; and David R Jefferson, former supercomputer scientist at the US Lawrence Livermore National Laboratory.

They argued in an open letter published in February – after the existence of the Home Office’s order against Apple was leaked to the Wall Street Journal – that the UK’s move would create a backdoor into personal data that would jeopardise the security and privacy of millions of people.

WhatsApp would challenge any law or government request that seeks to weaken the encryption of our services and will continue to stand up for people’s right to a private conversation online
Will Cathcart, WhatsApp

Apple withdrew its Advanced Data Protection service from UK users, rather than comply with the Home Office’s order. “As we have said many times before, we have never built a backdoor or master key to any of our products or services, and we never will,” Apple said in a statement at the time.

WhatsApp CEO Cathcart said today that the company would stand up against any government attempts to weaken the encryption of WhatsApp’s messaging service.

“WhatsApp would challenge any law or government request that seeks to weaken the encryption of our services and will continue to stand up for people’s right to a private conversation online,” he said.

Caroline Wilson Palow, director and general counsel at Privacy International, said WhatsApp’s intervention in the legal action brought by Privacy International and Liberty would make it harder for the Home Office to ignore opposition to government moves to undermine encryption.

“It demonstrates the breadth of impact of these orders, which could potentially undermine services used by billions of people. And it is remarkable that such different companies and civil society are uniting in opposition. This rising tide of dissent cannot be ignored,” she told Computer Weekly.

Home Office: We can have privacy and security

The Home Office has not commented on WhatsApp’s move to intervene in the case. However, a spokesperson previously told Computer Weekly that “the suggestion that privacy and security are at odds is not correct – we can and must have both”.

“Privacy is only impacted on an exceptional basis, in relation to the most serious crimes, and only when it is necessary and proportionate to do so,” the spokesperson said.

The Home Office said it would not comment on “operational matters”, including confirming or denying the existence of TCNs.

Timeline of UK government’s order for a backdoor into Apple’s encrypted iCloud service

7 February: Tech companies brace after UK demands backdoor access to Apple cloud – The UK has served a notice on Apple demanding backdoor access to encrypted data stored by users anywhere in the world on Apple’s cloud service.

10 February: Apple: British techies to advise on ‘devastating’ UK global crypto power grab – A hitherto unknown British organisation, which even the government may have forgotten about, is about to be drawn into a global technical and financial battle, facing threats from Apple to pull out of the UK.

13 February: UK accused of political ‘foreign cyber attack’ on US after serving secret snooping order on Apple – US administration asked to kick UK out of 65-year-old UK-US Five Eyes intelligence sharing agreement after secret order to access encrypted data of Apple users.

14 February: Top cryptography experts join calls for UK to drop plans to snoop on Apple’s encrypted data – Some of the world’s leading computer science experts have signed an open letter calling for home secretary Yvette Cooper to drop a controversial secret order to require Apple to provide access to users’ encrypted data.

21 February: Apple withdraws encrypted iCloud storage from UK after government demands ‘backdoor’ access – After the Home Office issued a secret order for Apple to open up a backdoor in its encrypted storage, the tech company has instead chosen to withdraw the service from the UK.

26 February: US intelligence chief Tulsi Gabbard probes UK demand for Apple’s encrypted data A secret order issued by the UK against Apple would be a ‘clear and egregious violation’ if it provides back door access to Americans’ encrypted data, says US director of national intelligence.

5 March: Apple IPT appeal against backdoor encryption order is test case for bigger targets – The Home Office decision to target Apple with an order requiring access to users’ encrypted data is widely seen as a ‘stalking horse’ for attacks against encrypted messaging services WhatsApp, Telegram and Signal.

11 March: Secret London tribunal to hear appeal in Apple vs government battle over encryption – A secret tribunal is due to meet at the High Court in London to hear tech giant Apple appeal against a Home Office order to compromise the encryption of data stored by its customers on the iCloud service worldwide.

13 March: US Congress demands UK lifts gag on Apple encryption order – Apple and Google have told US lawmakers that they cannot tell Congress whether they have received technical capability notices from the UK.

14 March: The Investigatory Powers Tribunal holds a day-long secret hearing into an appeal brought by Apple against a government notice requiring it to provide law enforcement access to data encrypted by its Advanced Data Protection service on the iCloud, despite calls for the hearing to be opened to the public.

24 March: Gus Hosein, executive director of Privacy International – Why I am challenging Yvette Cooper’s ‘secret backdoor’ order against Apple’s encryption.

31 March: Apple devices are at ‘most risk’ in UK following government ‘backdoor’ order, Lord Strasburger tells the House of Lords as a Home Office minister declines to give answers.

15 April: The Investigatory Powers Tribunal is a semi-secret judicial body that has made significant legal rulings on privacy, surveillance and the use of investigatory powers. What does it do, and why is it important? 

02 April: Apple appeals to the Investigatory Powers Tribunal over an order by home secretary Yvette Cooper to give the UK access to customers’ data protected by Advanced Data Protection encryption. What happens next?

7 April: Investigatory Powers Tribunal rejects Home Office arguments that identifying the ‘bare details’ of legal action by Apple would damage national security, leaving open the possibility of future open court hearings.

5 June: US politicians are calling for Congress to rewrite the US Cloud Act to prevent the UK issuing orders to require US tech companies to introduce ‘backdoors’ in end-to-end encrypted messaging and storage.

11 June: Government using national security as ‘smokescreen’ in Apple encryption row – Senior conservative MP David Davis says the Home Office should disclose how many secret orders it has issued against telecoms and internet companies to Parliament.

Read more on Privacy and data protection