Why we’re challenging the UK Government’s attempts to break encryption

How is the Government attempting to break encryption?

Many of us use encrypted software in our daily lives. Apple users will be familiar with iCloud – the software that backs up your photos, passwords, messages, and other personal data across devices.

At the start of 2025, it was widely reported that the UK Government had served Apple with a Technical Capability Notice (TCN), requiring it to weaken its Advance Data Protection (ADP) service for iCloud users anywhere in the world.

There’s a reason you may not have heard of a TCN before. These are secret government orders issued under section 253 of the Investigatory Powers Act 2016 (IPA) that require companies to change their products to facilitate the government’s surveillance and investigatory powers. This can include removing or weakening encryption services.

TCNs are so secret that you are legally prevented from saying that you have received one.

We don’t know the specifics of the Government’s order, but shortly after these reports, Apple announced it was withdrawing ADP for UK users, and that it had launched a legal challenge against the Government.

Advanced Data Protection is an opt-in feature that strengthens the end-to-end encryption of specific iCloud data; not even Apple can access it. Currently it is only disabled in the United Kingdom and continues to be available everywhere else in the world.

On its website, Apple said it has “never built a backdoor or master key to any of [its] products or services,” and never will.

Why is encryption important?

End-to-end encryption is a process that scrambles our data using mathematical algorithms so it cannot be read by anyone else.

It’s the most secure form of encryption, protecting things like our bank details, health records, private conversations and images.

It plays a vital role in keeping our data safe. That’s why the Government’s attempts to build a backdoor to it are incredibly dangerous.

Once a backdoor has been created, anyone with the right skills could open it. Bad actors such as hostile states and criminal networks could suddenly have a way into our personal data. This puts us all at risk, particularly marginalised and persecuted groups, and journalists.

That’s why Liberty, alongside Privacy International and two individuals, are challenging the lawfulness, necessity and secrecy of the TCN regime.

Why Liberty is taking action

This is a frontier case to protect everyone’s right to privacy and freedom of expression.

Technical Capability Notices lack sufficient safeguards and transparency. We are arguing that compromising the security of data in a way that potentially impacts millions of users is unlawful and violates the human rights of those affected.

The implications of this case extend beyond Apple, as this Government, and future governments, could (and already might) make similar requests of other tech companies without any of us knowing.

We know other companies are worried about this too. WhatsApp made an application to intervene in both Apple’s case and our case, but the Tribunal refused its application.

The outcome of this case could be felt globally. If a democratic country such as the UK is allowed to weaken our privacy rights so seriously, it will embolden others to follow.

What’s next in the legal challenge?

Following diplomatic issues with the Trump Administration, which was angry that the UK was undermining Americans’ privacy, the Financial Times reported in October 2025 that the Government had withdrawn the first TCN and Apple had received a second one, but this time it only applied to “British users”.

Shortly after, Apple’s legal claim was dismissed due to a “change in circumstances”.

We recently learnt that Apple has launched a second legal challenge to the UK’s powers to issue TCNs.

On 17 September 2026, what’s known as a case management hearing took place to consider how Liberty and Apple’s separate legal challenges will be handled. Until now, the Home Secretary has Neither Confirmed Nor Denied (NCND) the existence of a TCN and our case has proceeded on ‘assumed facts’.

At this hearing we asked the Investigatory Powers Tribunal to consider the correctness of Home Secretary’s NCND position, arguing that our case should be based on actual facts. We are currently waiting for the Tribunal’s decision.

You can read our case submissions here.

Privacy is a fundamental right that the Government should not be allowed to undermine. We’ll keep fighting to ensure our privacy and safety online is protected, now and in the future.