Apple asks the Investigatory Powers Tribunal to end the secrecy around the UK encryption orderApple asks the Investigatory Powers Tribunal to end the secrecy around the UK encryption order

Apple argued at the Investigatory Powers Tribunal in London on Thursday 17 September that the UK government should no longer be allowed to refuse to confirm whether it has ordered the company to hand over access to encrypted iCloud data.

The hearing concerned the government's policy of neither confirming nor denying the existence of an individual technical capability notice, the instrument the Home Office uses to compel access. Reuters reported the proceedings, and both 9to5Mac and iClarified relayed its account. Ben Jaffey, appearing for the campaign groups Privacy International and Liberty, told the tribunal the government's position had, in his words, become farcical, pointing to references to the original notice by US politicians and to unnamed UK sources briefing the press. Neil Sheldon, for the government, argued that dropping the policy would let hostile actors work out which companies have been served.

Privacy International's own case page sets out the procedural history and adds a detail the news reports leave out: WhatsApp applied to intervene in the case and was refused. The page lists a substantive hearing on the campaign groups' claim for December 2026. Reuters, as relayed by both outlets, reports that a full hearing on Apple's challenge to the notice itself is unlikely before next year.

The underlying dispute began in January 2025, when Britain issued a notice seeking access to encrypted iCloud backups. Apple withdrew Advanced Data Protection, its opt-in end-to-end encryption for iCloud, from UK users the following month rather than comply. Computer Weekly, which has followed the case closely, reported that the first notice was dropped after pressure from Washington and replaced with one covering UK users only, and that in September 2026 two US legislators urged the tribunal to open the hearings.

How the case has moved

What was decided, and what was not

Nothing about encryption was decided on Thursday. The tribunal heard argument on one narrow question: whether the government may keep saying nothing at all. The question of whether Britain can lawfully require access to end-to-end encrypted data is for a later hearing, and on the reported timetable that is next year.

It is worth being precise about what remains unconfirmed, because the reporting can read as though the order is an established fact. No UK government has confirmed any notice exists. What is on the record is that Apple removed a security feature from an entire country in February 2025 and has been in court ever since, which is not the behaviour of a company responding to nothing.

Our take

The secrecy question sounds procedural and is the one that matters most this year. A notice nobody may mention cannot be debated in Parliament, tested in public, or accurately reported. The government's answer, that naming one company helps adversaries map which companies are covered, is a real argument rather than a lawyer's flourish. It is also weaker here than in general, because this particular notice has been discussed by US officials on the record.

For anyone in the UK the practical position has not changed since last year, and it is worth restating plainly. Advanced Data Protection is not available to new users there. Without it, iCloud backups sit under keys Apple holds, which means they can be produced under a valid legal demand. That is the same position most cloud services have always been in, and it is a real step down from what users elsewhere can switch on.

The part we would watch is precedent rather than iCloud. A technical capability notice can be served on any operator, and the secrecy attaches to all of them. If the tribunal upholds the policy, the next order of this kind will be equally invisible, and the company receiving it will have the same choice Apple made: weaken the product everywhere, withdraw the feature in one country, or litigate in the dark. Smaller companies cannot afford the third option.

One caution on dates. Sources do not agree on when the replacement notice was issued. Privacy International's case page and Computer Weekly put it in October 2025; Reuters, as relayed by iClarified, says July 2026. We have not found a document that settles it, so we have said what each source says rather than pick one.