On September 17, at a case management hearing in the Investigatory Powers Tribunal, Daniel Beard KC told the tribunal that Apple wanted the gag order lifted — that the company should at last be allowed to say out loud whether a Technical Capability Notice exists. Six days earlier, Senator Ron Wyden and Congressman Warren Davidson had written to the same tribunal asking it to open its proceedings. The Home Secretary’s position, maintained throughout, is neither to confirm nor deny.

Most coverage has framed this as a story about British users getting second-class encryption. That’s true. It’s also the least interesting thing about it.

The Argument That Just Stopped Working

For a decade, the industry’s most effective piece of persuasion wasn’t a legal brief or a lobbying spend. It was an engineering claim: encryption is indivisible. You cannot weaken it for one jurisdiction without weakening it for everyone, because data crosses borders and code is code. The claim did enormous work. It was why ministers were told a backdoor order meant either a global compromise or a market exit — two costs no democracy would pay.

Britain ran the experiment. The second Technical Capability Notice, as the Financial Times reported in October 2025, applies only to British users. Apple pulled Advanced Data Protection from UK accounts, kept selling iPhones in Britain, and booked the whole thing as a legal line item rather than an existential one. Whatever you think of the policy, the deterrence argument is now empirically falsified — and it was falsified by a government nobody would accuse of flawless execution.

That is the fact worth worrying about. Not that Britain wants a backdoor. That Britain got a geographically scoped one, at a price other governments can now read off a spreadsheet.

Secrecy Is Protecting the Template, Not the Operation

Which is why the gag order matters more than the order. Liberty is litigating on “assumed facts” because the Home Secretary won’t confirm the notice exists. Privacy International, informed in August that Apple had filed a fresh claim against the UK’s powers to issue these notices, has a substantive hearing listed for December.

If the concern were operational security — not tipping off targets — a tribunal could handle that with a closed session and a redacted judgment. What neither-confirm-nor-deny actually protects is deniability: the ability to run a two-tier encryption regime without ever defending it as policy, in public, with a minister’s name attached. Apple’s lawyers appear to have concluded that their only remaining leverage is publicity, which is an odd position for a company that spent years insisting this was a technical matter best left to engineers.

A Backdoor With a Passport Check

Here’s the part the civil-liberties chorus keeps muffling, because it flatters nobody’s framing. Ten iCloud categories — Backup, Drive, Photos, Notes, among them — now sit at a lower protection tier for any account registered in the United Kingdom. Fifteen other categories remain end-to-end encrypted by default, per Apple’s own support documentation.

The tier boundary, however, does not exist in the data. A UK journalist’s shared drive with a New York editor. A Bristol manufacturer’s backups syncing into a Dublin subsidiary. A British parent’s photo library shared with a Canadian spouse. The threat model doesn’t check residency, so the downgrade doesn’t land on privacy enthusiasts who read the right blogs. It lands on British businesses whose clients, insurers, and procurement teams are about to start asking a question nobody in Whitehall has priced: what tier is your backup on, and where does it live?

One security engineer at a Manchester managed-services provider said his clients spent the week assuming they were unaffected, because they’d never heard of Advanced Data Protection and took “encrypted” to mean encrypted. His summary was better than anything in the filings: “They think it’s a toggle. It’s a border.”

Ask the Home Office what the downgrade costs British firms — in breach exposure, in insurance terms, in the audits that follow — and you get a statement about the importance of lawful access. That isn’t an answer. It’s a refusal wearing the costume of one, and it has gone largely unchecked because this argument has been conducted almost entirely between cryptographers and spies.

Who Has to Update

The governments that have wanted this for years — whose lawyers were assured no democracy would tolerate a localized downgrade — now have a working precedent and a known price. Apple’s policy shop, which built an imposing rhetorical wall on the indivisibility claim, owes an explanation for why the wall came down without a shot. And the people who told the public that jurisdiction-specific backdoors were impossible should say plainly that they were wrong, rather than relitigating the gag order as though transparency were the whole fight.

Transparency matters. But the substantive fight was lost in a hearing room in September, while everyone was arguing about whether the press was allowed in the room.

Sources