A secret UK order told Apple to build in a way to reach any customer's encrypted iCloud data, anywhere in the world. When the order collapsed months later, pressure from Washington did that, not the safeguard the law promised.
Estimated reading time: 9 minutes
In short. In January 2025 the Home Office served Apple with a technical capability notice under section 253 of the Investigatory Powers Act 2016, demanding the ability to reach any customer's encrypted iCloud data, anywhere in the world. A Judicial Commissioner, the Act's own safeguard against misuse, signed off on it as necessary and proportionate before it took effect. Weeks later Apple pulled its strongest encryption option from new UK customers rather than comply, and the notice was withdrawn only after months of diplomatic pressure from the US government, its Director of National Intelligence said, not because any court found it unlawful. A second, UK-only notice followed the same secret approval process in 2025 and is now under a fresh challenge at the Investigatory Powers Tribunal, with a case management hearing on 17 September 2026, the day after this piece was checked. Three documented mistakes: four stars.
The Investigatory Powers Act 2016 lets the Home Secretary order a telecoms or postal operator, in secret, to build and maintain the technical means to help the state get at data it is otherwise protected from reading. A technical capability notice under section 253 is not a warrant against one suspect. It is a standing instruction to make a capability exist. The Act's answer to the obvious question, what stops a minister ordering a company to break its own security on a whim, is a Judicial Commissioner: a serving or retired senior judge who must independently approve the decision before it can take effect. That is the safeguard the government points to. It is also the safeguard that was in place, working exactly as designed, when the Home Office ordered Apple to build a way into any customer's encrypted iCloud data on the planet.
The claims, tested
| The law's own words | What the record actually shows | Verdict |
|---|---|---|
| Section 254(2)-(3) of the Act: before approving a decision to give a technical capability notice, a Judicial Commissioner "must review the Secretary of State's conclusions" on necessity and proportionality, "apply[ing] the same principles as would be applied by a court on an application for judicial review" [1] | Judicial review principles test whether a decision was irrational, unlawful or procedurally flawed, not whether the reviewer would have made the same call. Section 254(4) requires written reasons only if the Commissioner refuses approval; there is no requirement to publish reasons for granting it. Computer Weekly reported that the January 2025 notice against Apple "was approved by the investigatory powers commissioner, Brian Leveson" [4], a role IPCO's own website confirms Sir Brian Leveson currently holds [6], a single sentence in press reporting is the public's entire window onto how that review went | A judge does sign off, on a standard built to defer to the minister's own reasoning, in a review nobody outside the Home Office and the company will ever see argued |
| Section 255(3) of the Act: before giving a notice, the Secretary of State must weigh "the likely benefits," "the likely cost of complying," "the technical feasibility," and "any other effect of the notice on the person (or description of person) to whom it relates" [2] | "The person... to whom it relates" is the recipient operator, in this case Apple. Nothing in sections 252 to 258 requires the Secretary of State to weigh the effect on the customers whose data the notice actually concerns, or on other countries whose citizens' data would be exposed by a notice with no geographic limit, which is exactly what the January 2025 notice was: Privacy International's own case record states the UK required Apple "to maintain the capability to provide access to any data stored on its iCloud system by Apple users anywhere in the world" [3] | The checklist Parliament wrote protects the operator's costs and feasibility. It does not require anyone in government to weigh the security of the people whose backups are actually at stake, and there is no separate mechanism that does |
| IPCO's own description of the regime: "Use of the most intrusive powers is authorised by our Judicial Commissioners using the double-lock process" [7], presented as the check that constrains ministers | The double lock approved the January 2025 worldwide notice. It did not survive contact with Washington. US Director of National Intelligence Tulsi Gabbard announced in August 2025 that the UK had withdrawn the notice "following months of diplomatic pressure from the United States" [5], with no public finding from any court or Commissioner that it had been unlawful. A second, UK-only notice went through the identical secret approval process months later; the Investigatory Powers Tribunal's own case page records it as Apple Inc v Secretary of State for the Home Department, case IPT/25/68/CH, and that Apple's first challenge was dismissed only once the notice itself changed, not because the Tribunal ruled on its lawfulness [8] | The one time this year the regime's most consequential decision was reversed, foreign diplomatic pressure did it. The law's own safeguard had already said yes |
The mistakes, counted
The safeguard reviews the minister's reasoning, not the decision (1). Section 254 gives a Judicial Commissioner a real role, not a rubber stamp in name only: refusal requires written reasons, and the Commissioner must apply the general privacy duties in section 2 of the Act [1]. But the test applied, "the same principles as would be applied by a court on an application for judicial review," is a standard built around deference to the primary decision-maker. It asks whether the Home Secretary's conclusion was one a reasonable minister could reach, not whether the Commissioner independently agrees a worldwide capability notice was the right call. That review, and everything the Commissioner and the Home Office argued inside it, happens entirely out of public view. When Privacy International and Liberty asked the Investigatory Powers Tribunal to at least confirm the bare existence of Apple's case, the government's own position, recorded in the Tribunal's public judgment, was that even that would be "contrary to the public interest" [3].
The statute's own checklist has no line for the people whose data is the point (2). Read section 255(3) end to end and the matters the Secretary of State must weigh before issuing a notice are the operator's costs, the operator's technical feasibility, and effects on the operator [2]. A notice can be written with global reach, as the January 2025 notice against Apple was, without any statutory requirement to weigh the security consequences for the millions of people whose data is covered, or the diplomatic consequences of reaching into data belonging to citizens of other countries. Parliament wrote a safeguard for the relationship between the Home Office and the company. It did not write one for the relationship between the state and the public whose backups were the actual subject of the order.
The one correction that happened came from outside the law (3). The Judicial Commissioner approved the January 2025 notice as necessary and proportionate. Weeks later Apple withdrew its Advanced Data Protection option for new UK customers rather than build the access demanded [3]. The notice itself was not withdrawn by any ruling that it had been unlawful. It was withdrawn, Director of National Intelligence Tulsi Gabbard said in August 2025, after "months of diplomatic pressure from the United States" [5]. A second, narrower notice covering only UK users then went through the same secret double-lock process and is itself now being challenged afresh, with a case management hearing scheduled for 17 September 2026, US lawmakers Ron Wyden and Warren Davidson having written to the Tribunal that same week urging it to make the proceedings public [9].
Credit where due
The Investigatory Powers Tribunal, when actually tested, did not simply defer to the government's preferred secrecy. Its 7 April 2025 judgment rejected the Home Office's argument that the bare fact of Apple's case should stay hidden, finding that revealing it would not damage national security and calling a fully closed process "the most fundamental interference with the principle of open justice" [3]. And the Act's regime is not a black box by design: section 254 does put a named, senior judicial figure into the decision, IPCO publishes a general account of the double-lock process [7], and the Home Office's shift from a worldwide notice to a UK-only one is, read generously, a narrower ask than the one that provoked the original backlash, even if this piece's central finding is that the narrowing changed nothing about how the decision gets made or checked.
Verdict
Four stars, from three documented mistakes. The Investigatory Powers Act's headline safeguard against a minister ordering a company to break its own encryption did its job exactly as written: a Judicial Commissioner reviewed the January 2025 notice against Apple and approved it. The notice covered any customer's encrypted iCloud data, anywhere on Earth. iOS runs on just over half of UK mobile devices, so the population the regime touches is not a rounding error [10]. What actually stopped that notice was not the Act's judicial check, which had already said yes, but months of diplomatic pressure from Washington. A second notice, narrower in scope but identical in process, is already back in front of the same Tribunal, with a hearing the day after this piece went to press. The law promises a judge checks this. A judge did. That did not stop it happening.
Sources
- Investigatory Powers Act 2016, section 254, legislation.gov.uk
- Investigatory Powers Act 2016, section 255, legislation.gov.uk
- PI Apple TCN Challenge, case tracker, Privacy International
- Home Office issues new 'backdoor' order over Apple encryption, Computer Weekly, 1 October 2025
- UK abandons Apple backdoor demand after US diplomatic pressure, CyberScoop, 19 August 2025
- Who we are, Investigatory Powers Commissioner's Office
- Investigatory powers, Investigatory Powers Commissioner's Office
- Apple Inc v Secretary of State for the Home Department, Investigatory Powers Tribunal
- US lawmakers call for UK court to lift secrecy over Apple 'backdoor' surveillance, Computer Weekly, 11 September 2026
- Mobile Operating System Market Share United Kingdom, StatCounter Global Stats, August 2026