Apple Faces New Cybersecurity Law in UK

[MacRumors]

A new British cybersecurity law mandates smart device manufacturers like Apple to enhance protections or face hefty penalties.

The legislation, known as the Product Security and Telecommunications Infrastructure (PSTI) Act, introduces robust requirements aimed at securing devices connected to the internet to make it harder for cybercriminals to get access to private networks.

The law specifically targets the inadequacies in current security measures by mandating three major changes: the elimination of default passwords, a clear protocol for reporting security vulnerabilities, and detailed consumer information on the length of product support and software updates. These stipulations apply to all companies manufacturing or selling smart devices in the UK.

For Apple, the law will necessitate a review of how its products comply with these enhanced standards. While Apple devices do not use default passwords, the company will need to ensure that all of its connected devices sold in the UK clearly communicate the duration of security support to customers. In addition, affected companies are expected to establish or refine their contact points for security issue reporting.

Retailers such as Apple stores are also required to provide customers with point-of-sale information about the cybersecurity practices relevant to the devices they purchase. The PSTI Act also includes strict penalties for non-compliance, with fines that can reach up to £10 million ($12.5 million USD) or 4% of the offending company's global turnover.

Note: Due to the political or social nature of the discussion regarding this topic, the discussion thread is located in our Political News forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

Article Link: Apple Faces New Cybersecurity Law in UK

 

[HouseLannister]

Will be nice to see Apple saying how long people will get security updates. They used to be best in class, but Samsung and Google's 7-year policies are now the expectation rather than an unwritten policy that Apple has. You can currently get iOS 17 on an iPhone XS, so that's 5 years of updates, but they can sometimes go further with some out of cycle point releases for major bugs. Just would be nice for them to say a number.

 

[lkrupp]

All this concern for privacy and security when the very governments issuing these requirements are themselves keen to collect data on their own citizens and want backdoor entry points to mobile operating systems.

 

[ddtmm]

If this applies to all companies that manufacture smart devices, I would imagine Apple is probably one of the most compliant of most manufacturers already.

 

[Unggoy Murderer]

I'm sure Apple will fare reasonably well here, they already support devices for quite a long time.

Online / digital security is something that is far too often overlooked or taken for granted. Within 20 years we've went from people spending £120/year on Norton anti-virus to willingly installing what's basically spyware like TikTok or Zoom on their devices.

I think it's important for companies to be held to account over data protection, but we still need to do so much to educate the everyday person to protect themselves (and their loved ones) online.

 

[antiprotest]

Yeah this in particular shouldn't be controversial or hard for Apple to comply. The security that needs to be stepped up is all round encryption against everyone that is not the account user, including, or especially, governments. But of course the EU and other governments are not going to legislate against themselves.

 

[yanksfan114]

Isn't this the same government that has been proposing banning encryption?

 

[kemal]

Isn't the default password for iOS 'Alpine'?

 

[Beautyspin]

All this concern for privacy and security when the very governments issuing these requirements are themselves keen to collect data on their own citizens and want backdoor entry points to mobile operating systems.

Yup, I trust Apple, a greedy corporation, with my data so that it can use it for its ad platform. I do not like my government to access the data to solve crimes of national importance.

Apple's new ad product pushes it closer to Google

Last week, Apple made news for testing an AI-powered ad product similar to Google’s Performance Max. Apple has been successfully investing in advertising for the past few years. But Google has a multibillion dollar advertising advantage. Even with AI advertising improvements, Apple is nowhere...

www.emarketer.com

 

[robvalentine]

Isn't this the same government that has been proposing banning encryption?

Have you met the UK government? They have probably baked the backdoor into the small print and getting their media chums to suppress it. Smoke and mirrors

 

[Reverend Benny]

Nice one, especially "detailed consumer information on the length of product support and software updates".
I would have wanted a fourth one saying "any connected device need to be supported with security updates for at least 15 years with the last 5 years being offered can contain a small and justified fee"

 

[contacos]

Good. Seems like Apple needs this since we still have not received any information why they logged us all out the other day.

 

[ozaz]

I'm sure Apple will fare reasonably well here, they already support devices for quite a long time.

Yeah, doesn't look like it will be much work for Apple to comply with this one. But just on the above point, I don't think there is any mandate for a specific minimum length of support, just a requirement to make it clear to customers what the minimum commitment is.

 

[Unggoy Murderer]

Will be nice to see Apple saying how long people will get security updates. They used to be best in class, but Samsung and Google's 7-year policies are now the expectation rather than an unwritten policy that Apple has. You can currently get iOS 17 on an iPhone XS, so that's 5 years of updates, but they can sometimes go further with some out of cycle point releases for major bugs. Just would be nice for them to say a number.

You're confusing full iOS updates with security updates.

The iPhone 6s got a software update just at the start of March, iOS 15.8.2 which was a security release. That phone is seven and a half years old.

Samsung Galaxy S20, a four year old phone, last upgradable version is Android 13. What expectation, exactly, is Samsung setting?

 

[JPack]

Will be nice to see Apple saying how long people will get security updates. They used to be best in class, but Samsung and Google's 7-year policies are now the expectation rather than an unwritten policy that Apple has. You can currently get iOS 17 on an iPhone XS, so that's 5 years of updates, but they can sometimes go further with some out of cycle point releases for major bugs. Just would be nice for them to say a number.

A number doesn't mean much if critical vulnerabilities aren't fixed. The real metric is number of CVEs fixed.

PSA: Apple isn’t actually patching all the security holes in older versions of macOS

Big Sur got a fix 234 days before Catalina did, although both are supported.

arstechnica.com

 

[Jim Lahey]

All this concern for privacy and security when the very governments issuing these requirements are themselves keen to collect data on their own citizens and want backdoor entry points to mobile operating systems.

This is how the game is played. Spend years battering tech firms into submission with legislation on app stores and USB ports because "won't someone please think of the users", then move in for the killshot by dictating security protocols. Security protocols they want backdoors into. I warned people about this when they were clapping like circus seals for more regulation.

 

[MallardDuck]

About darn time. Apple refusing to provide a committed minimum support duration has been a major gap.

 

[Jim Lahey]

https://forums.macrumors.com/thread...ecretly-veto-global-user-protections.2417840/

 

[I7guy]

All this while telling apple to widen its back doors.

 

[I7guy]

Yup, I trust Apple, a greedy corporation, with my data so that it can use it for its ad platform. I do not like my government to access the data to solve crimes of national importance.

Apple's new ad product pushes it closer to Google

Last week, Apple made news for testing an AI-powered ad product similar to Google’s Performance Max. Apple has been successfully investing in advertising for the past few years. But Google has a multibillion dollar advertising advantage. Even with AI advertising improvements, Apple is nowhere...

www.emarketer.com

Don’t know about you but I trust apple more than my government.

 

[cyanite]

Isn't this the same government that has been proposing banning encryption?

No, not really.

Isn't the default password for iOS 'Alpine'?

Maybe in some internal way, but that doesn’t surface to users.

 

[klasma]

Nice one, especially "detailed consumer information on the length of product support and software updates".
I would have wanted a fourth one saying "any connected device need to be supported with security updates for at least 15 years with the last 5 years being offered can contain a small and justified fee"

Not just security updates, but also browser and connected-services updates, because you’re unlikely to be able to browse the internet very well with a ten-year-old browser.

 

[klasma]

Yeah, doesn't look like it will be much work for Apple to comply with this one. But just on the above point, I don't think there is any mandate for a specific minimum length of support, just a requirement to make it clear to customers what the minimum commitment is.

It will add more competitive pressure. Since Google and Samsung already promise seven years, Apple might decide to go up to eight years, for example. Length of support is something that consumers actually care about.

 

[iAppleOrchard]

Kind of funny that the UK government wants to make this law but ban encryption at the same time...

 

[Beautyspin]

Don’t know about you but I trust apple more than my government.

No wonder Apple is surviving without any sanctions because of the quality of your government. /s Just kidding. I don't know which government is yours. But the point is that Apple is no saint, it uses your data exactly like Google for ads.