Your Phone's Encryption Is on Trial: Apple vs the UK Government Explained

The UK secretly ordered Apple to build a backdoor into your encrypted data. Apple refused, went to court, and the case that could decide the future of digital privacy for everyone on the planet is now heading to a public tribunal. Here is everything you need to understand about it.

Something Unusual Happened to UK iPhone Users

In February 2025, iPhone users in the United Kingdom opened their settings and noticed something was missing. Advanced Data Protection, Apple's optional feature that encrypts iCloud backups so completely that even Apple itself cannot read them, had quietly disappeared. No announcement. No explanation. Just gone.

What had actually happened became clear through investigative journalism and legal proceedings over the following months. The UK Home Office had secretly served Apple with a Technical Capability Notice under the Investigatory Powers Act 2016. The notice ordered Apple to build a backdoor into its encrypted cloud backup system that would allow UK government agencies to access user data. Apple refused to build the backdoor. Instead, it did the only other thing it could do under the circumstances: it disabled Advanced Data Protection entirely for UK users, meaning no British iPhone user can now access Apple's strongest encryption tier.

Apple then filed a legal challenge. And in July 2026, it filed a fresh complaint at the UK's Investigatory Powers Tribunal after the government rewrote the original order. A public hearing is now scheduled where the tribunal will decide whether what the UK government did was lawful, and the answer to that question will reverberate well beyond the United Kingdom.

What Is a Technical Capability Notice and Why Is It So Unusual?

A Technical Capability Notice, or TCN, is a classified legal order issued by the UK Home Secretary under the Investigatory Powers Act 2016. It compels technology companies to build or maintain technical capabilities that allow government agencies to intercept or access data during lawful investigations into serious crime or national security threats.

Two things make TCNs extraordinary. The first is their secrecy. Receiving a TCN is like receiving a super-injunction. The recipient cannot legally confirm the order exists, cannot discuss its contents, and cannot seek public advice about it. Apple could not even confirm to its own customers why Advanced Data Protection had disappeared from their settings. The existence of this particular TCN only became publicly known through media investigations and Apple's decision to remove the feature rather than comply.

The second extraordinary feature is the scope of what this particular TCN reportedly demanded. This was not an order to provide access to a specific suspect's data under a warrant. It was reportedly an order for systematic access capability to encrypted iCloud backups globally, meaning the backdoor, if built, would potentially have applied not just to UK users but to every iCloud user anywhere in the world. US Congressional members from both parties wrote to the tribunal specifically on this point, warning that a UK demand for access to American citizens' encrypted data without going through existing treaty mechanisms was itself a violation of international legal norms.

The Legal Framework: What the Investigatory Powers Act Actually Says

The Investigatory Powers Act 2016, nicknamed the Snoopers' Charter by critics when it was being debated in Parliament, is the UK's primary surveillance law. It authorises a range of government data collection powers including bulk interception of communications, retention of internet connection records by service providers, and equipment interference (essentially government-authorised hacking). TCNs fall within its scope.

The Act was already controversial when it passed. But its application to encryption specifically has always been legally contested. Critics argued then and continue to argue now that compelling a company to weaken or remove encryption does not merely grant access to existing data. It requires the company to actively create a new vulnerability in a system that was previously secure, changing the nature of the product without user knowledge or consent.

Apple's legal challenge has two components. The first attacks the legality of the TCN itself under the Investigatory Powers Act, arguing that the Act does not give the government power to demand what this TCN demanded. The second challenges the secrecy of the entire regime, arguing that a legal framework where recipients cannot even acknowledge an order's existence, and where affected users have no notice that their security has been compromised, violates the right to privacy and the right to an effective remedy under the European Convention on Human Rights, which UK law still incorporates through the Human Rights Act 1998.

Privacy International and civil liberties group Liberty are running parallel cases making similar arguments about the lawfulness and proportionality of the TCN regime as a whole.

What the Tribunal Has Already Decided: The Secrecy Battle

Even before the substantive hearing on the merits, the case produced a significant preliminary ruling. The Home Secretary's lawyers applied to keep all details of the case secret, arguing that revealing even the bare outline of proceedings would damage national security.

The Investigatory Powers Tribunal, presided over by Lord Justice Singh and Mr Justice Johnson, rejected the gagging application. Ten media organisations including the BBC, Guardian, Financial Times, and The Telegraph had campaigned for open justice. The tribunal agreed, ruling that the case did not warrant total secrecy and that the public interest in open justice outweighed the government's concerns, particularly since the existence of the dispute was already widely reported.

This was the first battle Apple effectively won. A case about surveillance secrecy will now be heard in public, using what the tribunal calls "assumed facts" so that national security classified details can be kept back while legal principles are argued openly.

What This Means for Users Around the World, Including India

You might be reading this in India and wondering: why does a dispute between Apple and the UK government matter to me? It matters for three reasons.

The first is that the legal principle being decided is not UK-specific. Every government in the world with investigatory powers legislation is watching this case. If the tribunal rules that the UK government can compel Apple to build a backdoor into encrypted systems, the precedent will be cited by governments in India, the United States, Australia, and dozens of other countries to make similar demands. If Apple wins, it establishes that no democratic government can use a unilateral secret order to compromise encryption for an entire user base.

The second reason is that this case directly involves iCloud, which is used by hundreds of millions of people globally including a large number of Indian users. If a backdoor had been built rather than contested, the global scope of the original TCN as reported means it may not have been limited to UK users.

The third is that India has its own provisions under the Information Technology Act and its predecessor laws that allow government agencies to require companies to provide technical assistance for decryption and data access. These provisions have not been tested in the way the UK TCN has, but the legal questions are closely related. How the UK tribunal resolves the conflict between government surveillance powers and encryption rights will be directly relevant to how Indian courts approach similar questions when they arise.

The Bigger Picture: Governments vs Encryption

The Apple case is the highest-profile current front in a battle that has been building for over a decade. Governments, particularly in the Five Eyes intelligence alliance of the US, UK, Canada, Australia, and New Zealand, have long argued that end-to-end encryption and encrypted cloud storage create what they call "going dark" problem, where investigators cannot access communications and data even with lawful authority.

Tech companies and cryptographers argue that there is no such thing as a backdoor only accessible to authorised governments. Any technical vulnerability built into an encryption system is a vulnerability that can be exploited by anyone who discovers it, including hostile governments, criminal networks, and intelligence agencies of countries whose legal standards are not the same as liberal democracies. Building a backdoor for the UK government means building a backdoor for everyone.

WhatsApp applied to intervene in the Apple IPT proceedings, which tells you how seriously the messaging company views the precedent this case might set for its own end-to-end encryption. The tribunal refused WhatsApp's application, but the fact that the world's largest messaging platform tried to join the case speaks to the industry-wide stakes.

Where Things Stand Right Now

Apple filed its fresh complaint at the IPT in July 2026 after the UK government rewrote the original TCN in a narrower UK-only form. The tribunal has confirmed it will hear Apple's case alongside Privacy International and Liberty's cases in public proceedings. A case management hearing was recently scheduled to determine exactly how the related cases will proceed.

The hearing itself is expected to address the fundamental legal question: does the Investigatory Powers Act authorise the government to demand that a technology company weaken or remove its own encryption? And if it does, is that authority compatible with human rights law?

The answer is not coming today or next month. But when it comes, it will be one of the most significant legal decisions on digital privacy and government surveillance power in a generation.

The Bottom Line

The UK secretly ordered Apple to break your encryption. Apple said no and went to court. The case is now going to a public tribunal. Whatever the tribunal decides will shape what governments around the world think they can demand from technology companies in the name of national security, and how much of your digital life is actually private.

That is not a UK story. That is everyone's story.

This blog is for general informational purposes and does not constitute legal advice. For guidance on data privacy, surveillance law, or technology compliance matters, please contact our team.