The Home Office sought access to data and messages stored by Apple users on its cloud storage in the UK and overseas by demanding a “backdoor” to Apple’s iCloud service, a court ruling has revealed.
A UK government order against Apple requires the company to “remove electronic protection where practicable” on data stored by Apple users on its cloud-based backup service, including beyond the borders of the UK.
A court ruling suggests the UK has not yet dropped demands to access the data of US Apple users, despite an announcement by the US director of national intelligence, Tulsi Gabbard, that the UK had backed down following a major diplomatic row with the US.
The document, based on “assumed facts”, reveals that the Home Office order goes wider than giving access to data stored by Apple users on the company’s Advanced Data Protection (ADP) service, which it withdrew from the UK following the Home Office’s actions, and covers all data stored by Apple users on its iCloud service.
Apple launched a legal challenge against the Home Office at the Investigatory Powers Tribunal (IPT), an independent body that rules on the lawful use of surveillance powers, in March, after the Home Office imposed the order in January.
Apple is challenging the Home Office’s use of a secret order, known as a technical capability notice (TCN), to require it to introduce mechanisms to allow the UK to access data and messages stored by users on iCloud.
According to a court decision, issued by the Investigatory Powers Tribunal on Wednesday 27 August, the Home Office powers apply extraterritorially beyond the UK. “The obligations are not limited to the UK or users of the service in the UK, they apply globally in respect of the relevant data categories of all iCloud users,” it stated.
Apple required to disclose messages and data
The Home Office order against Apple requires the tech company “to provide and maintain a capability to disclose categories of data stored within a cloud-based backup service”, according to the filing, meaning that Apple is required to hand over messages and data stored on iCloud.
This could include encryption keys, photographs and metadata that can identify a person, device, service used or websites visited, but not the content viewed on a website.
The Home Office has refused to confirm or deny the existence of the technical capability notice, despite its existence having been widely leaked.
The IPT has decided to proceed on the basis of “assumed facts”, allowing the case to be heard in open court, without the risk of breaching secrecy around the order, in hearings scheduled for early 2026.
TCN does not allow bulk interception
An analysis of the IPT decision, approved by two senior judges, shows that the TCN does not give UK intelligence services or law enforcement the ability to conduct bulk surveillance on material stored on Apple’s iCloud.
Under the Investigatory Powers Act, the TCN requires Apple to provide technical capabilities to allow targeted interception of communications.
This means police and intelligence services can apply for interception warrants to obtain data stored on Apple’s iCloud from targeted individuals, organisations or premises.
They can also apply for “thematic warrants” to target multiple people, organisations or premises simultaneously, if surveillance forms part of a “single investigation” or “operation”.
Apple argues that the TCN prevents the company from offering its Advanced Data Protection service worldwide. The service allows users to independently encrypt their data on iCloud in a way that cannot be read by Apple.
The company withdrew its ADP service from the UK in February, in the wake of the order. “As we have said many times before, we have never built a backdoor or master key to any of our products or services, and we never will,” Apple said in a statement.
The Home Office TCN sparked a major diplomatic row between the UK and the US, with the UK attracting criticism from US president Donald Trump, vice-president JD Vance and the director of national intelligence Tulsi Gabbard, who argued that it could undermine US citizens’ privacy and civil liberties.
Gabbard announced on social media site X on 19 August that the UK had agreed to drop demands for a “backdoor” that would allow access to the data of US citizens, although the terms of the agreement are unclear.
IPA amendments extended reach of ‘backdoor’ orders
The legal filing also reveals that the Home Office began the process of issuing the TCN against Apple before the introduction of critical amendments to the Investigatory Powers Act (IPA) 2016 that impacted TCNs, but did not complete the process until after the amendments had partially come into force.
The Investigatory Powers (Amendment) Act 2024 includes measures to extend the reach of TCNs to technology companies that are not based or controlled in the UK, provided that they operate services to UK users.
The government is expected to argue in hearings at the IPT next year that the TCN is proportionate, as the government is required to obtain a warrant for each target for interception, which must be approved by a judicial commissioner.
It is expected to say that the powers created by the TCN are not an attempt to expand surveillance powers, but to maintain existing powers that were in place before Apple introduced automatic encryption tools.
Government lawyers are also expected to argue that the approval of the TCN by a judicial commissioner provides sufficient legal and privacy safeguards.
Legal arguments will focus on advanced encryption
Apple is unlikely to succeed in legal arguments that the Home Office should not be able to access encrypted data on iCloud in cases where Apple already has the encryption keys.
However, it is expected to present arguments against Home Office demands that it remove users’ rights to encrypt data with their own encryption keys using Apple’s Advanced Data Protection service.
Commentators say the case will raise new areas of law. The only legal precedent is a case involving the encrypted messaging service Telegram, which implied that systematically weakening encryption is a disproportionate interference with the right to privacy under Article 8 of the European Convention on Human Rights.
Bernard Keenan, a lecturer in law at UCL and a specialist in surveillance law, said the assumed facts appear to be “a lot more specific than the government would have wanted – it’s pretty easy to infer the terms of the order”.
He said the UK government had massively underestimated international objections to the TCN.
“First, the extent to which Apple, as a ‘surveillance intermediary’, is prepared to resist requests to weaken the security of its devices in response to law enforcement requests,” he said.
“Second, the government also underestimated the attitude of key members of the Trump administration to the balance between privacy and state power.”
