Loading story…
The UK government reportedly moved to withdraw a secret order that would have forced Apple to provide access to encrypted iCloud data, reversing a demand issued under the Investigatory Powers Act that sought blanket access to user content stored worldwide. The order targeted Apple's Advanced Data Protection feature, which extends end-to-end encryption to additional iCloud categories, and drew sharp criticism because it could have enabled access to data belonging to users outside the UK without their governments' knowledge.
Apple resisted the demand by refusing to weaken its security architecture, removing Advanced Data Protection from the UK market, and pursuing a legal appeal instead of building a global backdoor into iCloud. The dispute became a broader flashpoint over lawful access and encryption, with privacy advocates warning that any mandated backdoor would undermine security for all users, while UK authorities argued the capability was needed for terrorism and child sexual abuse investigations; U.S. officials and reporting later indicated London agreed to rescind the order, though formal notification was still reportedly pending.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
According to U.S. Director of National Intelligence Tulsi Gabbard and Financial Times sources, the UK agreed to rescind the order seeking access to encrypted iCloud user data. At the time of reporting, the withdrawal was said not to be formally completed and Apple had reportedly not yet received official notice.
Rather than create a backdoor, Apple reportedly responded by withdrawing its Advanced Data Protection encrypted storage feature from the UK and pursuing a legal appeal against the order. This preserved its broader security architecture while contesting the government's demand.
The UK government reportedly served Apple with a technical capability notice under the Investigatory Powers Act requiring access to encrypted iCloud content, including data protected by Advanced Data Protection. The demand was described as applying broadly, potentially affecting users worldwide rather than only UK accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
macrumors.com
Open sourcemacrumors.com
Open sourcewashingtonpost.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple has withdrawn **Advanced Data Protection (ADP)** for iCloud in the UK after reports that the British government sought access to encrypted user data under the **Investigatory Powers Act**. The reported order allegedly demanded broad access to end-to-end encrypted iCloud content, including data belonging to users outside the UK, prompting Apple to remove the feature rather than create a backdoor. Apple said it was disappointed that UK customers would lose the protection at a time of increasing data breaches and privacy threats, and reiterated its long-standing refusal to weaken encryption in its products. The change affects iCloud categories protected by ADP, including **Photos, Notes, Messages backups, and device backups**, while other Apple services that use end-to-end encryption in the UK — such as **iMessage, FaceTime, password management, and health data** — remain unaffected. Existing UK users with ADP enabled will have to disable it manually during a grace period because Apple said it cannot turn the feature off on their behalf. The move has intensified concerns among security and privacy advocates, who warn that lawful-access demands can erode protections relied on by users worldwide.
Jun 29, 2026
Apple has filed a new legal challenge against a U.K. government demand for access to encrypted iCloud backup data, escalating a dispute over the country's use of secret **technical capability notices** under the Investigatory Powers Act. The case, reported as being brought before the Investigatory Powers Tribunal, targets a narrower order focused on U.K. users after an earlier, broader demand that reportedly extended to both U.K. and U.S. users was withdrawn following diplomatic friction with Washington. The contested notice is widely described by critics as an attempt to force an effective backdoor into iCloud backups protected by **Advanced Data Protection**. Apple has argued that creating such access would weaken security for all users, and the company had previously removed the option for U.K. customers to enable Advanced Data Protection after the first order. Civil liberties groups including **Privacy International** and **Liberty** have also challenged the government's use of these notices in a separate case scheduled for hearing in December.
Aug 5, 2026
The UK Home Office has issued a new technical capability notice (TCN) to Apple, demanding the creation of a backdoor into the company's encrypted cloud storage service, specifically targeting data belonging to British users. This latest request, reportedly transmitted in early September, follows a previous attempt in January where the Home Office sought global access to encrypted user data, which led to significant diplomatic tensions between the UK and the US. The earlier order prompted Apple to challenge the demand in court and resulted in the company withdrawing its Advanced Data Protection (ADP) service from the UK in February. As a result, Apple is currently unable to offer its most secure cloud storage option, iCloud Advanced Data Protection, to new users in the United Kingdom. Apple has publicly expressed disappointment that UK customers are deprived of these enhanced privacy protections, especially in light of increasing data breaches and threats to customer privacy. The company reiterated its longstanding position that it has never built, and will never build, a backdoor or master key for any of its products or services. The Home Office, while declining to confirm or deny the existence of the latest TCN, stated that it will always take necessary actions to ensure the safety of UK citizens. Under the Investigatory Powers Act 2016, the UK government has the authority to compel telecommunications companies to remove electronic protections on user data for evidence collection purposes. Privacy advocates have raised concerns that any attempt to weaken Apple's encryption could jeopardize the security of global customers' sensitive information, including passwords, message histories, and health data stored in iCloud. Both Apple and the Home Office are legally restricted from discussing the specifics of TCNs. The ongoing standoff highlights the broader conflict between government demands for lawful access to encrypted data and technology companies' commitments to user privacy and security. The situation has also had implications for international relations, as previous UK demands threatened to impact trade negotiations with the United States. The Home Office's renewed focus on British users' data, rather than global access, appears to be a strategic shift following the backlash from its earlier attempt. Despite the government's insistence on the necessity of such measures for national security, the move has intensified the debate over the balance between public safety and individual privacy rights. The outcome of this dispute could set a significant precedent for how governments interact with technology providers regarding encrypted services. Apple continues to resist any efforts that would compromise the security architecture of its products, maintaining that such actions would undermine the trust and safety of its user base. The lack of access to ADP in the UK leaves British users with fewer options for securing their cloud-stored data compared to users in other countries. The ongoing legal and policy battle underscores the challenges faced by multinational technology companies operating under varying national security laws and privacy expectations.
Jun 29, 2026