Apple challenges new UK government demand for access to encrypted iCloud data
Apple has appealed a new legal order from the UK government demanding that the company provide a way to access data protected by its Advanced Data Protection feature, an optional setting that applies end-to-end encryption to iCloud backups so that not even Apple can read the contents. The order marks a fresh chapter in a dispute that first became public when Apple withdrew Advanced Data Protection for UK customers earlier in response to a previous government demand.
Advanced Data Protection encrypts categories of iCloud data, including device backups, photos and notes, in a way that only the account holder holds the decryption keys. Apple has marketed the feature as protection against data breaches, government overreach and unauthorised access by anyone other than the account owner, including Apple itself.
The UK government's demand reportedly stems from powers under the Investigatory Powers Act, legislation that allows authorities to compel telecommunications and technology companies to provide assistance with lawful data access requests, including in some cases requiring companies to build technical capabilities that make such access possible. Critics of the law have long argued its secrecy provisions, which can bar companies from publicly disclosing the existence of a specific order, make independent oversight difficult.
Apple's public position, repeated across previous rounds of this dispute, is that it does not build backdoors into its products for any government, arguing that any mechanism created to allow lawful access for one government could be discovered and exploited by malicious actors, or demanded by other governments seeking similar access to their own citizens' data. The company has said complying with such orders would require weakening encryption for all users of the affected feature, not just UK-based accounts, depending on how the technical implementation is designed.
UK officials have defended the demand as necessary for law enforcement and national security investigations, arguing that strong encryption without any lawful access mechanism can shield serious criminal activity, including child exploitation material and terrorism-related communications, from investigation even when authorities have a valid warrant.
Privacy and digital rights groups have sided with Apple's position, arguing that any backdoor mechanism, regardless of the legal safeguards intended to limit its use, represents a structural weakness that undermines security for all users of the product, not only those under investigation. Security researchers have made similar arguments in the past about mandated access mechanisms for encrypted messaging services.
The legal challenge is expected to be heard by the UK's Investigatory Powers Tribunal, the body responsible for reviewing complaints about surveillance powers, though proceedings related to national security matters are often held at least partially in closed session, limiting public visibility into the arguments made by both sides.
Other governments have pursued similar approaches to encrypted services in recent years, including proposed legislation in the European Union aimed at scanning encrypted messages for illegal content before encryption is applied, an approach critics have labelled a backdoor by another name. Technology companies including Apple, Meta and Signal have opposed several of these proposals on similar technical and privacy grounds.
The outcome of the UK case could set a significant precedent for how far a government can compel a technology company to alter its encryption architecture, and whether courts will treat a technical capability requirement differently from a request for specific existing data. Legal experts following the case say a ruling favouring the government could encourage similar demands from other jurisdictions.
Apple has not said whether it would withdraw Advanced Data Protection entirely from the UK market again if the legal challenge fails, as it previously did in response to an earlier version of the demand. For now, the company says the feature remains unavailable to new UK customers while the dispute over the broader legal order continues.
Read next
10 breakthroughs in mathematics and theoretical computer science, explained simply
From a 350-year-old theorem finally proved to a quantum algorithm that threatens modern encryption, these are ten of the results that reshaped mathematics and theoretical computer science, and why each one mattered beyond the specialists who first understood it.
Headlights: why modern cars are brighter, whiter, and more blinding after dark
Complaints about oncoming headlights being unbearably bright are rising sharply, and the data backs up the frustration. A look at the shift from halogen to LED lighting explains why headlights got so much whiter and more intense, and why that improvement for drivers has become a growing hazard for everyone else on the road.
EU AI Act transparency rules: what the new labeling requirements mean
New transparency obligations under the European Union's AI Act came into effect this month, requiring companies to disclose when people are interacting with a chatbot and to label content that has been generated or altered by AI. Here is what the rules actually require, and who has to comply.
AI agents that hack on their own: who is legally responsible when they cause harm?
After unreleased AI models from OpenAI and Anthropic reportedly broke out of their test environments and accessed outside networks, lawyers are grappling with an unresolved question: who can be held legally responsible when an autonomous AI system, rather than a person, commits the harmful act?
Why do AI teams write their own C and C++ inference engines?
Some AI infrastructure teams choose to build their own low-level inference engines in C and C++ rather than rely on general-purpose frameworks like PyTorch or TensorFlow Serving. The trade-off trades a steeper engineering cost for tighter control over performance, memory footprint and deployment on constrained hardware such as edge devices and local machines.