Apple Returns to UK Court Over Encryption Access Order

The Second Technical Capability Notice

Apple has filed a complaint with the UK's Investigatory Powers Tribunal over a government order issued in October last year, according to people familiar with the matter. The filing challenges what UK authorities call a "technical capability notice," a classified legal instrument that compels service providers to furnish access to user data, encryption notwithstanding.

The notice targets iCloud accounts protected by Advanced Data Protection, Apple's end-to-end encryption feature that renders backup data inaccessible to anyone except the account holder. When ADP is enabled, Apple itself cannot decrypt the contents, a design choice that has placed the company at odds with law enforcement agencies seeking investigative access across multiple jurisdictions.

At DailyTechWire, we've tracked similar encryption disputes in India, Australia, and the European Union over the past eighteen months. The UK case stands out not for its novelty but for its persistence: London issued an identical demand in early 2025, then withdrew it after diplomatic pressure from Washington during the first months of the Trump administration's second term.

A Pattern of Demand and Withdrawal

The earlier order, delivered in February 2025, prompted Apple to disable Advanced Data Protection for all UK-based accounts. Users in England, Scotland, Wales, and Northern Ireland found themselves unable to activate the feature, effectively downgrading their iCloud backups to a state in which Apple retains decryption keys and can comply with lawful data requests.

That first standoff ended when US officials intervened, framing the UK's demand as a potential precedent that could complicate American technology firms' encryption strategies globally. The order was rescinded in April 2025, and Apple quietly restored ADP access for UK users in May.

By October, however, the Home Office had issued a second technical capability notice, this time without the public attention that accompanied the first. Apple's tribunal filing surfaced only recently, suggesting the company chose to litigate rather than negotiate a second time.

What the Tribunal Decides

The Investigatory Powers Tribunal hears cases involving government surveillance powers granted under the Investigatory Powers Act 2016, legislation that consolidated and expanded UK intelligence agencies' authority to intercept communications and compel technical assistance. Technical capability notices fall under Part 4 of that statute, which permits the Secretary of State to require telecommunications operators to maintain interception capabilities.

Apple's legal argument, though not publicly disclosed, is expected to center on proportionality and the technical feasibility of selective decryption. End-to-end encryption by design precludes a "golden key" for specific accounts; any backdoor mechanism would necessarily weaken the cryptographic architecture for all users, a position Apple has defended in US congressional hearings and European policy forums alike.

The tribunal's proceedings are closed, and its rulings can remain sealed if the government invokes national security grounds. This opacity has frustrated privacy advocates, who argue that secret orders undermine public debate over surveillance scope and the balance between security imperatives and individual rights.

Regional Momentum Behind Encryption Mandates

London's renewed push arrives amid a broader regulatory shift across Asia and Europe. In March, Singapore's Ministry of Home Affairs proposed amendments to the Criminal Procedure Code that would authorize courts to compel decryption assistance from service providers. South Korea's National Intelligence Service has lobbied for similar authority, though legislative progress has stalled in the face of opposition from civil society groups in Seoul.

India remains the most aggressive jurisdiction. The Ministry of Electronics and Information Technology issued decryption orders to three US-based cloud providers in 2025 under the Information Technology Act, though details remain sparse. One order, directed at a messaging platform with significant market share in Mumbai and Delhi, led to a service suspension that lasted eleven days before a compromise was reached, the terms of which were never made public.

At DailyTechWire, we've observed that these demands cluster around two triggers: high-profile criminal investigations involving encrypted communications and, more quietly, intelligence agencies' concern that adversary states are leveraging commercial encryption to shield espionage networks. The UK case likely reflects both threads, though official statements cite only the former.

Commercial and Diplomatic Stakes

Apple's decision to litigate rather than disable ADP again suggests a strategic calculation. Removing the feature a second time would erode consumer trust in a product marketed explicitly on privacy grounds, particularly in the UK's lucrative enterprise segment, where IT administrators have adopted ADP as a compliance tool under the General Data Protection Regulation.

There is also a signaling dimension. If Apple capitulates twice in the same market, other governments will interpret the precedent as exploitable. The company's resistance in the UK serves as a deterrent elsewhere, a dynamic that has shaped its approach to data localization demands in China and Vietnam.

The diplomatic variable remains unpredictable. The first UK order collapsed under US pressure, but Washington's current posture toward allied surveillance practices is less clear. The Trump administration has oscillated between championing American tech firms' encryption products and endorsing law enforcement access in domestic contexts; how that ambivalence translates into bilateral pressure on London is uncertain.

What Happens If Apple Loses

A tribunal ruling against Apple would leave the company with three options, none of them palatable. It could comply and engineer a decryption mechanism, though doing so would likely trigger a global backlash and invite copycat demands from other Five Eyes nations and beyond. It could again disable ADP for UK users, accepting the reputational cost and revenue impact in a market that generated an estimated twelve billion dollars in services revenue for Apple in fiscal 2025.

Or it could withdraw iCloud services from the UK entirely, a nuclear option that would strand millions of users and invite regulatory retaliation but preserve the integrity of its encryption architecture worldwide. Industry observers consider this scenario remote but not impossible; Apple has previously pulled products from markets rather than compromise core design principles, including its 2021 decision to halt engraving services in Hong Kong after content moderation disputes.

The tribunal is expected to issue a preliminary procedural ruling within sixty days, though a final judgment could take six months or longer. Apple has not commented publicly, adhering to its longstanding policy of declining to discuss matters in active litigation.

For now, UK users retain access to Advanced Data Protection, and iCloud backups remain encrypted. How long that holds depends on a closed courtroom in London and a set of legal arguments the public may never read in full.