Apple and Rights Groups Press UK Tribunal to Drop Secrecy Over iCloud Encryption Order

Apple, Liberty and Privacy International pressed the UK’s Investigatory Powers Tribunal last week to stop letting the Home Office hide behind a policy of neither confirming nor denying a reported order demanding access to encrypted iCloud data. The case management hearing took place on September 17, Digital Watch Observatory reported.

The tribunal is weighing how to handle two related cases. One is a new complaint from Apple challenging the Home Secretary’s power to issue technical capability notices, or TCNs. The other, brought by Privacy International, Liberty and two individuals, challenges the lawfulness and secrecy of the TCN regime itself.

Ben Jaffey KC, for Privacy International and Liberty, argued that keeping up the neither-confirm-nor-deny position was no longer sustainable given how much about the reported notice is already public. According to Computer Weekly, he called the government’s position “farcical” and said the cases should proceed on the “actual facts.” Apple’s counsel, Daniel Beard KC, said the government’s claim that relying on assumed facts had “no consequences” was “just wrong.”

For the Home Office, Neil Sheldon KC argued that confirming which operators have or haven’t received TCNs could give “material assistance” to people involved in terrorism or online abuse, by showing them where their data might be reachable. The government also said dropping the policy for Apple could undercut it for notices involving other companies.

How the iCloud split happened

The dispute dates to early 2025, when The Washington Post reported that the Home Office had issued a TCN seeking access to end-to-end encrypted iCloud data. Apple then withdrew Advanced Data Protection, its opt-in setting that extends end-to-end encryption to iCloud Backup, Photos, Notes and more, from UK users. Apple said it was “gravely disappointed” and that it had “never built a backdoor or master key” to its products, but it has not publicly confirmed that the decision followed a TCN.

Without Advanced Data Protection, UK accounts fall back to standard data protection. Under that default, Apple keeps the encryption keys in its data centers so it can decrypt data for recovery, and only certain categories are end-to-end encrypted.

In August 2025, US Director of National Intelligence Tulsi Gabbard said the UK had agreed to drop its demand for a “back door” that would have exposed encrypted data belonging to US citizens. The UK government did not publicly confirm that account.

Apple’s first challenge before the tribunal was dismissed last October, Liberty said in August, when the tribunal notified the rights groups of Apple’s second complaint. TCNs fall under section 253 of the Investigatory Powers Act 2016, and section 255 generally bars a recipient from disclosing a notice without the Home Secretary’s permission.

“This is a hugely important case that will have far-reaching implications for the public’s privacy rights well into the future,” Ruth Ehrlich, Liberty’s director of external relations, said at the time.