Loading story…
Apple has filed a new legal challenge against a U.K. government demand for access to encrypted iCloud backup data, escalating a dispute over the country's use of secret technical capability notices under the Investigatory Powers Act. The case, reported as being brought before the Investigatory Powers Tribunal, targets a narrower order focused on U.K. users after an earlier, broader demand that reportedly extended to both U.K. and U.S. users was withdrawn following diplomatic friction with Washington.
The contested notice is widely described by critics as an attempt to force an effective backdoor into iCloud backups protected by Advanced Data Protection. Apple has argued that creating such access would weaken security for all users, and the company had previously removed the option for U.K. customers to enable Advanced Data Protection after the first order. Civil liberties groups including Privacy International and Liberty have also challenged the government's use of these notices in a separate case scheduled for hearing in December.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
After dropping the broader demand, the British government issued Apple a new technical capability notice limited to users in the United Kingdom. TechCrunch reports this second order was issued in October.
In early 2025, the U.K. government issued Apple a secret order demanding access to users’ encrypted iCloud backups. The dispute centered on data protected by Apple’s Advanced Data Protection feature.
The separate complaint brought by Privacy International and Liberty is due to be heard in December before the Investigatory Powers Tribunal. The references do not specify the year beyond the current reporting context.
Apple filed a new legal complaint with the U.K.'s Investigatory Powers Tribunal challenging the latest government demand for access to encrypted iCloud backups of U.K. users. The complaint targets the newer, U.K.-limited technical capability notice.
Privacy International and Liberty separately challenged technical capability notices before the U.K.'s Investigatory Powers Tribunal. Their case concerns the legality of such surveillance demands.
The U.K. Home Office agreed to drop an earlier broader demand that would have affected both U.K. and U.S. users. According to the reports, the demand was withdrawn after diplomatic friction or intervention from Washington.
After the first U.K. order, Apple removed the ability for users in the United Kingdom to enable Advanced Data Protection. The move followed the government demand for access to encrypted iCloud backup data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
6 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcetherecord.media
Open sourcescworld.com
Open sourcetechcrunch.com
Open sourcebloomberg.com
Open sourcemacrumors.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK Home Office has issued a new technical capability notice (TCN) to Apple, demanding the creation of a backdoor into the company's encrypted cloud storage service, specifically targeting data belonging to British users. This latest request, reportedly transmitted in early September, follows a previous attempt in January where the Home Office sought global access to encrypted user data, which led to significant diplomatic tensions between the UK and the US. The earlier order prompted Apple to challenge the demand in court and resulted in the company withdrawing its Advanced Data Protection (ADP) service from the UK in February. As a result, Apple is currently unable to offer its most secure cloud storage option, iCloud Advanced Data Protection, to new users in the United Kingdom. Apple has publicly expressed disappointment that UK customers are deprived of these enhanced privacy protections, especially in light of increasing data breaches and threats to customer privacy. The company reiterated its longstanding position that it has never built, and will never build, a backdoor or master key for any of its products or services. The Home Office, while declining to confirm or deny the existence of the latest TCN, stated that it will always take necessary actions to ensure the safety of UK citizens. Under the Investigatory Powers Act 2016, the UK government has the authority to compel telecommunications companies to remove electronic protections on user data for evidence collection purposes. Privacy advocates have raised concerns that any attempt to weaken Apple's encryption could jeopardize the security of global customers' sensitive information, including passwords, message histories, and health data stored in iCloud. Both Apple and the Home Office are legally restricted from discussing the specifics of TCNs. The ongoing standoff highlights the broader conflict between government demands for lawful access to encrypted data and technology companies' commitments to user privacy and security. The situation has also had implications for international relations, as previous UK demands threatened to impact trade negotiations with the United States. The Home Office's renewed focus on British users' data, rather than global access, appears to be a strategic shift following the backlash from its earlier attempt. Despite the government's insistence on the necessity of such measures for national security, the move has intensified the debate over the balance between public safety and individual privacy rights. The outcome of this dispute could set a significant precedent for how governments interact with technology providers regarding encrypted services. Apple continues to resist any efforts that would compromise the security architecture of its products, maintaining that such actions would undermine the trust and safety of its user base. The lack of access to ADP in the UK leaves British users with fewer options for securing their cloud-stored data compared to users in other countries. The ongoing legal and policy battle underscores the challenges faced by multinational technology companies operating under varying national security laws and privacy expectations.
Jun 29, 2026
The UK government reportedly moved to withdraw a secret order that would have forced Apple to provide access to encrypted iCloud data, reversing a demand issued under the Investigatory Powers Act that sought blanket access to user content stored worldwide. The order targeted Apple's **Advanced Data Protection** feature, which extends end-to-end encryption to additional iCloud categories, and drew sharp criticism because it could have enabled access to data belonging to users outside the UK without their governments' knowledge. Apple resisted the demand by refusing to weaken its security architecture, removing Advanced Data Protection from the UK market, and pursuing a legal appeal instead of building a global backdoor into iCloud. The dispute became a broader flashpoint over lawful access and encryption, with privacy advocates warning that any mandated backdoor would undermine security for all users, while UK authorities argued the capability was needed for terrorism and child sexual abuse investigations; U.S. officials and reporting later indicated London agreed to rescind the order, though formal notification was still reportedly pending.
Jun 29, 2026
Apple has withdrawn **Advanced Data Protection (ADP)** for iCloud in the UK after reports that the British government sought access to encrypted user data under the **Investigatory Powers Act**. The reported order allegedly demanded broad access to end-to-end encrypted iCloud content, including data belonging to users outside the UK, prompting Apple to remove the feature rather than create a backdoor. Apple said it was disappointed that UK customers would lose the protection at a time of increasing data breaches and privacy threats, and reiterated its long-standing refusal to weaken encryption in its products. The change affects iCloud categories protected by ADP, including **Photos, Notes, Messages backups, and device backups**, while other Apple services that use end-to-end encryption in the UK — such as **iMessage, FaceTime, password management, and health data** — remain unaffected. Existing UK users with ADP enabled will have to disable it manually during a grace period because Apple said it cannot turn the feature off on their behalf. The move has intensified concerns among security and privacy advocates, who warn that lawful-access demands can erode protections relied on by users worldwide.
Jun 29, 2026