Apple launches new legal challenge against UK over iCloud access

Apple has reportedly launched a new challenge against the British government over a legal demand that required the company to be able to provide users’ iCloud data in response to a warrant.

The nature of the new challenge, which was first reported by the Financial Times, is unclear. Notice of the complaint was sent to Privacy International, whose spokesperson told Recorded Future News they were “happy to learn that Apple is once again challenging the UK’s regime of secret orders.”

“While we don’t know the substance of Apple's claim, if it relates to the previously reported orders aimed at undermining the security of Apple's iCloud storage, then Apple’s claim, alongside ours and Liberty’s, is crucially important to preserving all of our privacy and security,” the charity group added.

At the core of the dispute is Apple’s Advanced Data Protection (ADP) feature, which generates and stores encryption keys on users’ own devices instead of Apple’s servers. Because Apple never holds the keys, it is technically unable to access the content of iCloud accounts even when served with a lawful request.

Last February, Apple withdrew ADP for British users entirely after receiving a secret legal demand, first reported by The Washington Post. Officially known as a Technical Capability Notice (TCN), it demanded that Apple retain the ability to access the content of iCloud accounts instead of protecting them with ADP.

Although the details of the TCN are not public, it appears that by withdrawing ADP for British users, Apple effectively complied.

The Financial Times reported that the initial request sought British access to U.S. citizens’ data as well as its own. This appears to contradict existing data-sharing rules between Westminster and Washington, which prohibit either country from intentionally targeting the other's citizens' data.

The “bare details of the case” were confirmed last April by the Investigatory Powers Tribunal — the only court in the country that can hear certain national security cases. Apple submitted the new complaint to this court, according to the Financial Times.

In its April judgment, the tribunal cited numerous public comments undermining the government’s ongoing claim of the need for secrecy around the demand, including U.S. President Donald Trump comparing the British government’s move to “something that you hear about with China.”

As a matter of policy, Westminster officials say they neither confirm nor deny the existence of TCNs and do not comment on “operational matters” — a position that experts, including from Britain's own intelligence community, have argued is unsustainable, unjustifiable and should change.

That call for transparency is not new. In a 2018 essay in Lawfare, two of the most senior technical specialists at GCHQ argued for a “more informed debate” about the requirements for law enforcement and national security agencies to access encrypted material.

Notably, they drew a distinction between a lawful access regime and the alternative — simply hacking a target’s device — warning that the latter “is completely at odds with the demands for governments to disclose all vulnerabilities they find to protect the population.”

Law enforcement agencies have repeatedly warned that their inability to access end-to-end encrypted communications is hampering work to tackle serious crime, including child sexual abuse. In the case of Apple’s ADP feature, because it makes iCloud content inaccessible server-side, any detection of illegal material would have to happen on users’ devices before content is encrypted, rather than on Apple’s servers afterwards.

Apple itself explored that approach, announcing in 2021 a client-side scanning system that would check content on-device to see if it depicted child abuse content. Following criticisms, Apple quietly shelved the plan in 2022. The question of how to police encrypted platforms when those platforms are designed to prevent police access remains unresolved.

Neither Apple nor the Home Office responded to a request for comment.