Apple Challenges UK Secrecy Over iCloud Encryption Order

Apple challenged the British government’s refusal to confirm whether it has ordered the company to provide access to encrypted iCloud data during a hearing before the Investigatory Powers Tribunal in London on Thursday, September 17, according to Reuters.

The hearing focused on the government’s policy of neither confirming nor denying the existence of individual technical capability notices, or TCNs. Ben Jaffey, the lawyer for campaign groups Privacy International and Liberty, told the tribunal that the government’s position had “become farcical” because “the horse has long bolted.”

Jaffey pointed to public references to the original notice by U.S. politicians and officials, as well as confirmations to the press by unnamed UK sources. Both he and Apple’s lawyer argued that the policy affronts open justice and prevents meaningful public discussion of the issue.

Neil Sheldon, representing the British government, argued that the issue extends beyond Apple and that abandoning the policy would pose a national security risk. He said hostile actors could use such disclosures to build a picture of which operators are subject to technical capability notices.

Apple itself cannot access data protected by Advanced Data Protection, which end-to-end encrypts iCloud Backup and other categories so even the company cannot read them. It has also argued that an entry point created for one government could be exploited by hackers or hostile states, weakening security for everyone.

Britain first issued a technical capability notice in January 2025 seeking access to encrypted cloud backups belonging to U.S. and British citizens. Apple withdrew Advanced Data Protection for UK users the following month, saying it would never build a back door. The demand for access to U.S. users’ data was later dropped after months of negotiations with the Trump administration, while Britain issued a second notice in July 2026 covering only Apple’s UK customers.

Apple filed a second legal challenge in August 2026 against the UK-only order. Privacy International and Liberty are also challenging it, arguing that the notice would violate human rights and weaken security.

Thursday’s hearing dealt only with whether the government can continue to rely on its neither confirm nor deny policy, not whether Britain can legally require access to encrypted data. The tribunal will now consider that issue, while Reuters reports that a full hearing on the underlying notice is unlikely before next year.