US lawmakers criticise UK backdoor order to Apple, warn of cybercriminal risks

By Foo Yun Chee

BRUSSELS (Reuters) -U.S. House Judiciary Chair Jim Jordan and Foreign Affairs Chair Brian Mast warned Britain on Wednesday that its order to Apple to create a backdoor to its encrypted user data could be exploited by cybercriminals and authoritarian regimes.

Apple, which has said it would never build a so-called back door into its encrypted services or devices, has challenged the order at the UK's Investigatory Powers Tribunal (IPT).

The iPhone maker withdrew its Advanced Data Protection feature for UK users in February following the UK order. Users of Apple's iPhones, Macs and other devices can enable the feature to ensure that only they — and not even Apple — can unlock data stored on its cloud.

"Creating a backdoor into end-to-end encrypted systems, as the TCN does, introduces systemic vulnerabilities that can be exploited by malicious actors, including cybercriminals and authoritarian regimes," Jordan and Mast wrote in a joint letter to Britain's Home Secretary Yvette Cooper.

TCN (Technical Capability Notice) refers to the UK order.

"These vulnerabilities would not only affect UK users but also American citizens and others worldwide, given the global nature of Apple's services," they said.

They urged Cooper to allow Apple to disclose the existence of the order to the U.S. Department of Justice so it can evaluate whether it complies with the U.S.-UK agreement made under the CLOUD Act which prohibits orders requiring companies to decrypt data.

Under UK laws, American companies would commit a criminal offence if they disclose or confirm such an order, even to their home government.

"We urge the Home Office to reconsider the issuance of TCNs that require the weakening of encryption, as such measures conflict with international human rights standards, including the European Court of Human Rights' ruling that undermining encryption violates privacy rights," the lawmakers said.

Britain's Home Office has said a warrant would be needed for any individual's data to be accessed.

(Reporting by Foo Yun Chee; Editing by Richard Chang)