Apple expands end-to-end encryption for iCloud
In a press release published this week, Apple announced some big new security and privacy protections for users.
There were a few changes introduced, but by far the most important one for everyday users is expanded end-to-end encryption (E2EE) for iCloud data.
What is E2EE?
To see what Apple’s changes will mean for users, it’s important to have a basic understanding of what end-to-end encryption is.
E2EE is a way of encrypting data such that only the sending and receiving parties have access to the encryption key that can decrypt the data. The data is literally encrypted on one “end” of a data transfer chain all the way to its ultimate destination—the other end—where it can then be decrypted and read. But in between, it’s fully encrypted and completely unreadable to anyone handling, transferring, or storing the data.
With E2EE, data intermediaries like ISPs, telecoms, and cloud storage providers never even see the data that they’re handling. That’s great for user privacy and security, because with E2EE, these intermediaries don’t need to protect an encryption key—a key that might get misused, leaked, or stolen in a data breach. And importantly, if a government or law enforcement agency ever asks them to hand over some encrypted user data, they literally can’t do that even if they wanted to!
But wasn’t iCloud encrypted end to end before?
There has always been a bit of confusion about the encryption status of iCloud data, because Apple has historically encrypted some iCloud data end to end, but not all of it.
Previously, Apple offered E2EE only for what they deemed to be highly sensitive data types: passwords and Keychain data, Health data, payment and Apple Card data, and so on.
But other types of data were not encrypted end to end—crucially, iCloud backups, Photos, and Notes. Adding to the confusion was the fact that while iMessage communications themselves were E2EE, iMessage backups stored in iCloud were not!
There’s some debate as to why Apple didn’t simply apply end-to-end encryption to all iCloud data from the beginning, and there may be more than one answer to that question.
In part it was a decision driven by the users’ love of convenience. People like being able to ask Apple for help recovering their data if they lose a password. That’s possible if Apple holds the encryption key for the lost data, but not when E2EE is in effect.
In addition, some people believe that Apple’s decision not to encrypt iMessage backups end to end was an indirect concession to law enforcement agencies—who like being able to request iMessage data if they need it in a criminal investigation.
What has changed about E2EE for iCloud?
Apple will soon expand E2EE protection to far more iCloud data types than ever before. The feature will be called Advanced Data Protection, and will cover:
- iCloud Backups
- iCloud Drive
- Photos
- Notes
- Reminders
- Safari Bookmarks
- Siri Shortcuts
- Voice Memos
- Wallet passes
In fact, the only things Advanced Data Protection won’t apply to are iCloud Mail, Contacts, and Calendars, which Apple says is unavoidable due to “the need to interoperate with the global email, contacts, and calendar systems.” The feature is expected to be rolled out in the US by the end of the year, and everywhere else in early 2023.
