Apple’s iMessage could face its most serious test yet
No sooner has Apple finally confirmed the adoption of RCS messages alongside iMessage than something much bigger comes along to screw it all up. We’ve known for some time that 2024 will be a huge year for messaging, but it turns out that while the landscape may still change forever, it’s not a good thing.
As expected, Apple unveiled RCS — essentially an upgrade to SMS — at its WWDC event. No surprise. Green bubbles remain green, security remains limited, at least for now, and the walls of the iMessage walled garden remain largely intact.
But RCS is about to back down. European attack dogs are not happy with the changes that have already been deployed on Apple and its peers. Not only are huge fines potentially in the mix as Brussels investigates app store compliance, but iMessage is now firmly in the crosshairs. Their intention is to agree something by the end of June.
Putting aside the exciting WWDC news about AI and RCS, the biggest change for the iPhone this year has been regulation rather than innovation. Brussels Eurocrats have forced Apple to open up third-party app stores and give users the option to decide which Apple apps to keep and which to delete. Competition 1 — Safety 0.
And so iMessage and a similarly troubling new risk from the same source. This time, the issue is law enforcement’s lack of access to fully encrypted content transmitted via iMessage (and WhatsApp, Signal, Google Messages, Facebook Messenger). With end-to-end encryption, only the sender and recipient can decrypt the content, making interception of the data flow unproductive. Security and law enforcement have lobbied for a backdoor to eavesdrop, industry has said no and parliaments have so far agreed.
But not to be deterred, and led by CSAM prevention – which is a tougher fight for big tech than general law enforcement – Europe has a bright new idea. Think of it as a backdoor embedded in the idea of a backdoor.
When it was launched earlier this year, crypto expert Matthew Green described parts of the proposal as “the scariest thing I’ve ever seen… a new mass surveillance system that will read private text messages, not to detect CSAM, but to detect ‘modification’ .” This nightmare is now much closer.
Signal confirmed it would leave EU markets rather than comply. Apple reportedly considered the same when the UK was investigating its own encryption compromises. These EU proposals look much more realistic and last year 9 to 5 Mac joined the dots, warning that these much more realistic EU proposals could cause Apple to pull the plug on iMessage.
The world-renowned – or not – technical experts in the Belgian government have devised a clever ruse in her role as President of the Council of Europe. Users will agree to scan device-side media attachments for CSAM (image, video, URL) flags, or lose access to sending attachments and be limited to plain text.
This idea has been called “chat control,” and yes, it’s as silly as it sounds.
Usually such suggestions come and go and don’t stick. This is certainly what we’ve seen before when it comes to encryption compromises. But Europe is on course and this idea will not go away. It is discussed and reshaped. But it remains.
The European Parliament rejected a more extensive encryption backdoor, but this new compromise is gaining support. The Netherlands has now said it “partially agrees” with Belgium’s latest proposal to control chat and Netpolitik warns that it can be even tougher. “Several states criticize restrictions on images and videos. Ireland fears chat control will “lose effectiveness”. Denmark requires that “the text must also be included”… Many states support the basic thrust of the new proposals. These include proponents of chat control such as Romania, Bulgaria and Denmark.
Separately, but with an emphasis on how serious Europe’s attack on big tech could become, Financial Times reported that “Brussels is set to charge Apple with allegedly stifling competition in its mobile apps business, the first time EU regulators have used new digital rules to target a major tech group”.
This can mean fines in the billions of dollars.
None of us really expected Apple to open up to more app stores or WhatsApp to introduce its messaging chat center — but here we are. Much more important is what is now being reviewed in Brussels. Once a device-side scan is ordered, there’s no going back. CSAM expands into serious crime, counter-terrorism, and then into the realms of political dissent and even sexual niches. Where platforms have the capability, it opens the door to formulating local laws.
“We are concerned about developments in the EU Council,” warned a joint industry statement issued at the end of May. “We call on ministers in the EU Council to reject all scanning proposals that go against the principle of end-to-end encryption, including client-side scanning and upload moderation, and to guarantee the protection of digital rights throughout the proposal.” . These disruptive techniques would only threaten the safety and rights of Internet users.”
But there’s a good chance Europe will call a big tech bluff, as Apple’s iMessage, Signal and WhatsApp and Meta’s Facebook Messenger will have a serious decision to make. And bragging aside, what the DMA has shown is that while big tech can warn of consequences, it is reluctant to comply. This is a much more significant test.
Reports suggest that this will be discussed privately with the aim of producing a workable proposal agreed between states by the end of June. It affects you. This is serious. The industry has so far shown no willingness to engage in this discussion and support anything of the sort, but Europe has been equally stubborn over the past year. Apple and its peers forced the UK to back down on this issue, now the question is whether they can do the same here.