The White House could end UK's decade-long fight to bust encryption
(2025/08/12)
- Reference: 1754987406
- News link: https://www.theregister.co.uk/2025/08/12/could_the_white_house_put/
- Source link:
Analysis The Home Office's war on encryption – its most technically complex and controversial aspect of modern policymaking yet – is starting to look like battlefield failure after more than ten years of skirmishes.
First tabled by former prime minister David Cameron in 2015 following a terrorist shooting at the offices of French satirical magazine Charlie Hebdo, vague wording alluded to a potential ban in the Investigatory Powers Act 2016.
The roots of the government's anti-encryption agenda were deeper and older, though. As early as the year 2000, the UK government's stance on encryption was marked by a push for the ability to intercept encrypted comms, namely via the Regulation of Investigatory Powers Act [1](RIPA). .
[2]
Recent reporting suggests, however, that after a decade-plus losing battle to break the fundamental privacy protections that end-to-end encryption (E2EE) provides users, the Trump administration could halt those plans for good.
[3]
[4]
Security experts, privacy geeks, and pretty much everyone who has the faintest clue about how E2EE works knows that backdooring the likes of iMessage and WhatsApp is impossible. Data is either end-to-end encrypted or it isn't. There is no in-between.
That has not stopped multiple ruling parties in the UK from pushing on with anti-encryption rhetoric.
[5]
And yet, despite heavy backlash from the tech industry and beyond about the feasibility of undermining encryption, the country's lawmakers have affected change.
After it served Apple with [6]demands to break encryption earlier this year, the tech giant threw the technically confused UK government a bone by [7]shuttering its Advanced Data Protection iCloud feature for all Brits.
However, it seems Home Office staff are now coming to terms with the fact that the Trump administration will block any attempt to further strongarm Amercia's tech companies.
[8]
Insiders told the [9]Financial Times , speaking on condition of anonymity, that the Trump administration's disapproval of the UK's plans, which the president has previously likened to Chinese-style policymaking, is the main obstacle in achieving its encryption-busting ambitions.
Officials know the US doesn't want anyone touching its tech companies. For the UK's closest ally - historically at least - it's a firm red line.
Should the UK indeed back down on its encryption ban ambitions, it would raise further questions over its sovereignty - its ability to set its own laws without having to bend the knee to the US.
There is not an abundance of cases whereby the UK's legislature has been forced to back down in the face of political pressure overseas, although some might say Huawei's removal from Britain's 5G networks – with the government issuing [10]legal notices to vendors after US sanctions in combination with a severe diplomatic push – might be an example of this. Another semi-recent example came in 2022 concerning the UK's plan to ship asylum seekers off to Rwanda.
The EU said that plan broke international law and the European Court of Human Rights (ECtHR) issued an interim measure to stop the first deportation flights until UK courts could assess the legality of it all.
The legislation was passed by Rishi Sunak's UK government last year, but the new incoming Prime Minister Kier Starmer binned the program not long after taking office, as promised in his election run.
Ironically, the EU [11]tabled its own regulation earlier this year to send illegal immigrants to "return hubs," one of which is rumored to be… Rwanda.
Back to the point at hand, legal experts who spoke to The Register when the UK-Apple encryption furor kicked off in January, said the UK could risk another run-in with the ECtHR if it went ahead with its encryption plans, putting it on a similar level to Russia.
Will Richmond-Coggan, partner at Freeths specializing in privacy and cybersecurity disputes, [12]told us : "Insisting on this level of access, even with judicial supervision of the process, may well place the UK on a collision course with previous decisions made in the European Court of Human Rights, which has previously ruled (in the case of a similar attempt by Russia to broaden the scope of its domestic surveillance capabilities) that this contravened people's privacy rights."
A reminder: in its pursuit of an encryption backdoor, workaround, or however it's dressed up, the UK has been compared by its closest political ally to China, while legal experts say the potential for human rights violations would put it on par with Putinland.
That's not even considering all the other countries that are known for questionable policies to human rights, free speech, surveillance, et al.
Separate from the unwelcome company the UK would keep, such a move could lead to diplomatic difficulties with the US, with Home Office officials reportedly concerned over how future tech deals with the US could play out.
Tulsi Gabbard, the US's director of national intelligence, previously [13]said of the Apple technical capability notice (TCN) that she was not made aware prior to it being issued.
She added that if the UK mandated an encryption workaround, it would be an "egregious violation" of public privacy which could risk the data agreement held between the UK and US.
Putting aside the potential embarrassment of the US shutting down decade-long UK policymaking efforts, privacy advocates will rejoice if the UK's attempts to bypass E2EE are foiled or otherwise buried.
The UK will no doubt have a soundbyte ready showing there was a reasonable compromise between achieving its encryption ambitions and appeasing political allies.
It's a tough one to predict how it will play out. Tech regulation and legislation is a difficult beast, and the debate on legally circumventing encryption will not end.
The debate is especially "thorny," as one individual told The Register, because even the experts can't land on a definitive resolution. Privacy campaigners are adamant that E2EE must remain impregnable, while some cybersecurity folk – usually a bunch that lean on the side of technology – are less absolute in their takes.
Graeme Stewart, head of public sector at Check Point, said: "There's no easy answer. Personally, I don't see any value in banning encryption or [14]VPNs . It's a deeply flawed idea driven more by political posturing than technological reality. That said, we do need mechanisms for lawful intercept when absolutely necessary. And we do want to protect children from harmful online content."
In his view, he thinks the way forward is to take action on other components that facilitate online harms. Instead of banning encryption on social media platforms, why not mandate social media sign-ups with government-backed digital IDs, for example?
Thorny, disjointed, and divisive
The Home Office's official lines on encryption are confused. It [15]says it has no intention of compelling messaging platforms to break encryption, but also demands they implement safety features to help detect criminal activity.
As part of its TCNs, it also requires relevant operators to assist the government in intercepting data.
Frustratingly for encrypted messaging platforms, it does not specify the ways in which they must do this.
So, you can see why these platforms are threatening to [16]pull out of countries that seek to ban or undermine E2EE, or do so indirectly.
One of the prominent suggestions for allowing E2EE to exist while also appeasing the UK government is for platforms to deploy [17]client-side scanning (CSS). This would see content generated on a user's phone matched against a database of objectionable material, before being encrypted and sent to the recipient.
The problem here is that while messages technically are end-to-end encrypted, and platforms could still say they offer E2EE, the entire purpose of the tech is undermined.
The spirit of E2EE dictates that users enjoy total privacy, and can share their messages free from surveillance of any kind.
Digital rights group Access Now said this implementation would "deprive people of their confidentiality." Senior policy counsel and encryption policy lead, Namrata Maheshwari, [18]blogged :
"Storing the database on a device, which contains granular, sensitive personal information including media, notes, search histories, banking information, and medical data, is a debilitating attack on privacy."
[19]X's new 'encrypted' XChat feature seems no more secure than the failure that came before it
[20]TAKE IT DOWN Act? Yes, take the act down before it's too late for online speech
[21]Apple drags UK government to court over 'backdoor' order
[22]Governments can't seem to stop asking for secret backdoors
"Such a database could be modified and controlled by an external entity, without any user control; essentially converting any personal device into a potential 'bug in our pocket'."
The government would promise the database is protected with only the highest degrees of security, and yet some of the most sensitive databases in the country have been [23]raided by cybercriminals .
Put simply, E2EE cannot be broken while maintaining the same trust it has now.
The Register has contacted the Home Office for a response. We're not expecting one because it has so far refused to even admit the existence of the TCN. ®
Get our [24]Tech Resources
[1] https://www.legislation.gov.uk/ukpga/2000/23/part/III
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aJsQu9VLpITvPuNhV1BsLwAAAFQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aJsQu9VLpITvPuNhV1BsLwAAAFQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aJsQu9VLpITvPuNhV1BsLwAAAFQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aJsQu9VLpITvPuNhV1BsLwAAAFQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2025/02/07/home_office_apple_backdoor_order/
[7] https://www.theregister.com/2025/02/24/rather_than_add_a_backdoor/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aJsQu9VLpITvPuNhV1BsLwAAAFQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://www.ft.com/content/3a3e6dbc-591d-4087-9ad3-11af04f0176f
[10] https://www.gov.uk/government/news/huawei-legal-notices-issued
[11] https://commission.europa.eu/news-and-media/news/migration-commission-proposes-new-european-approach-returns-2025-03-11_en
[12] https://www.theregister.com/2025/02/24/apple_adp_replacements_e2ee/
[13] https://www.theguardian.com/us-news/2025/feb/26/tulsi-gabbard-uk-apple
[14] https://www.theregister.com/2025/07/31/banning_vpns_to_protect_kids/
[15] https://www.gov.uk/government/publications/end-to-end-encryption-and-child-safety/end-to-end-encryption-and-child-safety#:~:text=The%20UK%20government,child%20sexual%20abuse.
[16] https://www.theregister.com/2025/02/26/signal_will_withdraw_from_sweden/
[17] https://www.theregister.com/2021/10/15/clientside_side_scanning/
[18] https://www.accessnow.org/why-client-side-scanning-is-lose-lose-proposition/
[19] https://www.theregister.com/2025/06/03/xs_new_encrypted_xchat_feature/
[20] https://www.theregister.com/2025/04/29/take_it_down_act_passes/
[21] https://www.theregister.com/2025/03/05/apple_reportedly_ipt_complaint/
[22] https://www.theregister.com/2025/03/03/opinion_e2ee/
[23] https://www.theregister.com/2025/05/19/legal_aid_agency_data_theft/
[24] https://whitepapers.theregister.com/
First tabled by former prime minister David Cameron in 2015 following a terrorist shooting at the offices of French satirical magazine Charlie Hebdo, vague wording alluded to a potential ban in the Investigatory Powers Act 2016.
The roots of the government's anti-encryption agenda were deeper and older, though. As early as the year 2000, the UK government's stance on encryption was marked by a push for the ability to intercept encrypted comms, namely via the Regulation of Investigatory Powers Act [1](RIPA). .
[2]
Recent reporting suggests, however, that after a decade-plus losing battle to break the fundamental privacy protections that end-to-end encryption (E2EE) provides users, the Trump administration could halt those plans for good.
[3]
[4]
Security experts, privacy geeks, and pretty much everyone who has the faintest clue about how E2EE works knows that backdooring the likes of iMessage and WhatsApp is impossible. Data is either end-to-end encrypted or it isn't. There is no in-between.
That has not stopped multiple ruling parties in the UK from pushing on with anti-encryption rhetoric.
[5]
And yet, despite heavy backlash from the tech industry and beyond about the feasibility of undermining encryption, the country's lawmakers have affected change.
After it served Apple with [6]demands to break encryption earlier this year, the tech giant threw the technically confused UK government a bone by [7]shuttering its Advanced Data Protection iCloud feature for all Brits.
However, it seems Home Office staff are now coming to terms with the fact that the Trump administration will block any attempt to further strongarm Amercia's tech companies.
[8]
Insiders told the [9]Financial Times , speaking on condition of anonymity, that the Trump administration's disapproval of the UK's plans, which the president has previously likened to Chinese-style policymaking, is the main obstacle in achieving its encryption-busting ambitions.
Officials know the US doesn't want anyone touching its tech companies. For the UK's closest ally - historically at least - it's a firm red line.
Should the UK indeed back down on its encryption ban ambitions, it would raise further questions over its sovereignty - its ability to set its own laws without having to bend the knee to the US.
There is not an abundance of cases whereby the UK's legislature has been forced to back down in the face of political pressure overseas, although some might say Huawei's removal from Britain's 5G networks – with the government issuing [10]legal notices to vendors after US sanctions in combination with a severe diplomatic push – might be an example of this. Another semi-recent example came in 2022 concerning the UK's plan to ship asylum seekers off to Rwanda.
The EU said that plan broke international law and the European Court of Human Rights (ECtHR) issued an interim measure to stop the first deportation flights until UK courts could assess the legality of it all.
The legislation was passed by Rishi Sunak's UK government last year, but the new incoming Prime Minister Kier Starmer binned the program not long after taking office, as promised in his election run.
Ironically, the EU [11]tabled its own regulation earlier this year to send illegal immigrants to "return hubs," one of which is rumored to be… Rwanda.
Back to the point at hand, legal experts who spoke to The Register when the UK-Apple encryption furor kicked off in January, said the UK could risk another run-in with the ECtHR if it went ahead with its encryption plans, putting it on a similar level to Russia.
Will Richmond-Coggan, partner at Freeths specializing in privacy and cybersecurity disputes, [12]told us : "Insisting on this level of access, even with judicial supervision of the process, may well place the UK on a collision course with previous decisions made in the European Court of Human Rights, which has previously ruled (in the case of a similar attempt by Russia to broaden the scope of its domestic surveillance capabilities) that this contravened people's privacy rights."
A reminder: in its pursuit of an encryption backdoor, workaround, or however it's dressed up, the UK has been compared by its closest political ally to China, while legal experts say the potential for human rights violations would put it on par with Putinland.
That's not even considering all the other countries that are known for questionable policies to human rights, free speech, surveillance, et al.
Separate from the unwelcome company the UK would keep, such a move could lead to diplomatic difficulties with the US, with Home Office officials reportedly concerned over how future tech deals with the US could play out.
Tulsi Gabbard, the US's director of national intelligence, previously [13]said of the Apple technical capability notice (TCN) that she was not made aware prior to it being issued.
She added that if the UK mandated an encryption workaround, it would be an "egregious violation" of public privacy which could risk the data agreement held between the UK and US.
Putting aside the potential embarrassment of the US shutting down decade-long UK policymaking efforts, privacy advocates will rejoice if the UK's attempts to bypass E2EE are foiled or otherwise buried.
The UK will no doubt have a soundbyte ready showing there was a reasonable compromise between achieving its encryption ambitions and appeasing political allies.
It's a tough one to predict how it will play out. Tech regulation and legislation is a difficult beast, and the debate on legally circumventing encryption will not end.
The debate is especially "thorny," as one individual told The Register, because even the experts can't land on a definitive resolution. Privacy campaigners are adamant that E2EE must remain impregnable, while some cybersecurity folk – usually a bunch that lean on the side of technology – are less absolute in their takes.
Graeme Stewart, head of public sector at Check Point, said: "There's no easy answer. Personally, I don't see any value in banning encryption or [14]VPNs . It's a deeply flawed idea driven more by political posturing than technological reality. That said, we do need mechanisms for lawful intercept when absolutely necessary. And we do want to protect children from harmful online content."
In his view, he thinks the way forward is to take action on other components that facilitate online harms. Instead of banning encryption on social media platforms, why not mandate social media sign-ups with government-backed digital IDs, for example?
Thorny, disjointed, and divisive
The Home Office's official lines on encryption are confused. It [15]says it has no intention of compelling messaging platforms to break encryption, but also demands they implement safety features to help detect criminal activity.
As part of its TCNs, it also requires relevant operators to assist the government in intercepting data.
Frustratingly for encrypted messaging platforms, it does not specify the ways in which they must do this.
So, you can see why these platforms are threatening to [16]pull out of countries that seek to ban or undermine E2EE, or do so indirectly.
One of the prominent suggestions for allowing E2EE to exist while also appeasing the UK government is for platforms to deploy [17]client-side scanning (CSS). This would see content generated on a user's phone matched against a database of objectionable material, before being encrypted and sent to the recipient.
The problem here is that while messages technically are end-to-end encrypted, and platforms could still say they offer E2EE, the entire purpose of the tech is undermined.
The spirit of E2EE dictates that users enjoy total privacy, and can share their messages free from surveillance of any kind.
Digital rights group Access Now said this implementation would "deprive people of their confidentiality." Senior policy counsel and encryption policy lead, Namrata Maheshwari, [18]blogged :
"Storing the database on a device, which contains granular, sensitive personal information including media, notes, search histories, banking information, and medical data, is a debilitating attack on privacy."
[19]X's new 'encrypted' XChat feature seems no more secure than the failure that came before it
[20]TAKE IT DOWN Act? Yes, take the act down before it's too late for online speech
[21]Apple drags UK government to court over 'backdoor' order
[22]Governments can't seem to stop asking for secret backdoors
"Such a database could be modified and controlled by an external entity, without any user control; essentially converting any personal device into a potential 'bug in our pocket'."
The government would promise the database is protected with only the highest degrees of security, and yet some of the most sensitive databases in the country have been [23]raided by cybercriminals .
Put simply, E2EE cannot be broken while maintaining the same trust it has now.
The Register has contacted the Home Office for a response. We're not expecting one because it has so far refused to even admit the existence of the TCN. ®
Get our [24]Tech Resources
[1] https://www.legislation.gov.uk/ukpga/2000/23/part/III
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aJsQu9VLpITvPuNhV1BsLwAAAFQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aJsQu9VLpITvPuNhV1BsLwAAAFQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aJsQu9VLpITvPuNhV1BsLwAAAFQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aJsQu9VLpITvPuNhV1BsLwAAAFQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2025/02/07/home_office_apple_backdoor_order/
[7] https://www.theregister.com/2025/02/24/rather_than_add_a_backdoor/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aJsQu9VLpITvPuNhV1BsLwAAAFQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[9] https://www.ft.com/content/3a3e6dbc-591d-4087-9ad3-11af04f0176f
[10] https://www.gov.uk/government/news/huawei-legal-notices-issued
[11] https://commission.europa.eu/news-and-media/news/migration-commission-proposes-new-european-approach-returns-2025-03-11_en
[12] https://www.theregister.com/2025/02/24/apple_adp_replacements_e2ee/
[13] https://www.theguardian.com/us-news/2025/feb/26/tulsi-gabbard-uk-apple
[14] https://www.theregister.com/2025/07/31/banning_vpns_to_protect_kids/
[15] https://www.gov.uk/government/publications/end-to-end-encryption-and-child-safety/end-to-end-encryption-and-child-safety#:~:text=The%20UK%20government,child%20sexual%20abuse.
[16] https://www.theregister.com/2025/02/26/signal_will_withdraw_from_sweden/
[17] https://www.theregister.com/2021/10/15/clientside_side_scanning/
[18] https://www.accessnow.org/why-client-side-scanning-is-lose-lose-proposition/
[19] https://www.theregister.com/2025/06/03/xs_new_encrypted_xchat_feature/
[20] https://www.theregister.com/2025/04/29/take_it_down_act_passes/
[21] https://www.theregister.com/2025/03/05/apple_reportedly_ipt_complaint/
[22] https://www.theregister.com/2025/03/03/opinion_e2ee/
[23] https://www.theregister.com/2025/05/19/legal_aid_agency_data_theft/
[24] https://whitepapers.theregister.com/
Re: Thanks Donald.
abend0c4
I'm not sure we should be expressing thanks for a situation in which the only thing preventing the government doing something objectively idiotic is the overwhelming power of a capricious economic adversary. There's a lot more can go wrong in those circumstances than might happen, by accident, to go right.
Doctor Syntax
"The Home Office's official lines on encryption are confused. It says it has no intention of compelling messaging platforms to break encryption, but also demands they implement safety features to help detect criminal activity."
If the Home Office believes this is possible all it has to do to persuade the rest of us is to produce a proof of concept that withstands proper expert dissection. If it lacks the ability to do so itself it could commission it, preferably under terms where most of the payment is made when the experts agree it really works.
The Regulation of Investigatory Powers Act (RIPA)..
Anonymous Coward
That's the act where the [1]local council spied on you for putting your bins out on the wrong day. That and your dog fouling the pavement /s
[1] https://bigbrotherwatch.org.uk/wp-content/uploads/2023/03/RIPA_Report_Embargo22Aug.pdf
Client Side Scanning
Anonymous Coward
You mean implementing NSO/Pegasus or Paragon/Graphite?
.....on every end point in the UK?
Internet Service Providers
Anonymous Coward
All this chatter about E2EE focuses EXCLUSIVELY on services provided by companies like Signal and Meta.
What about private groups implementing their own encryption protocols? Or the SWIFT banking system?
I suppose the government is planning to attempt to decrypt every base64 attachment traversing the internet?
Rachel Reeves will need to find a lot more that five billion pounds for that sort of STASI project!!
BebopWeBop
Starmer's determination to lick the boots of the US might actually have some positive consequences - even if he did not intend them.
Doctor Syntax
I suppose that now we're just a small offshore island nation he doesn't have much choice.
CSS
zimzam
Does client-side scanning even work on devices with root-level user access? How would you ensure that the database hasn't been tampered with.
Re: CSS
Doctor Syntax
Would you be allowed root-level access any more?
Magical thinking as usual
0laf
Who would have thought we'd be thanking POTUS for protecting British citizens data however incidentally it has come about.
UK push to change encryption so that it only opens for the pure-of-heart despite all leaders in the field saying no, despite all academics saying no, despite the maths saying no, is the usual magical thinking by politicians who believe that if they say it outloud then it can be done. I'm also sure there is a queue of snake oil sellers at the door suggeseting that if only they get a grant/fund/contract they can make it happen.
What common sense could not achieve
JimmyPage
Donald Trump did.
Make of that what you will.
Thanks Donald.
We need protecting from our idiot government. Unfortunately, nothing will save us from age verification, CSS and a VPN ban/licence requirement. The flipside is that these policies will bury them at the next election. They are no longer stuff that only techies care about, but things that damage peoples day to day surfing. At which point, the basics of democracy kick in - if enough people have a reason to hate their government, they will get voted out.