What Can the Home Office Force a Tech Company to Build?

In January 2025 the Home Office reportedly served Apple with a notice demanding it build a way in to iCloud data protected by Advanced Data Protection. That's Apple's opt-in end-to-end encryption for backups. Apple didn't comply, and didn't confirm the notice existed, because confirming it exists would breach the Act's secrecy duty.

Here's how it has played out, as far as anyone outside can tell:

February 2025: Apple pulled Advanced Data Protection from the UK entirely and took the matter to the Investigatory Powers Tribunal.
August 2025: reporting suggests the original worldwide demand was dropped after pressure from the US.
Afterwards: a narrower notice covering UK users' data reportedly followed in its place, which Apple is still challenging.
2026: a case management hearing is listed for September, with a substantive hearing in December.

Most of what's known about this case comes from leaks and journalism, not from anything either party was legally able to say. That opacity is not incidental. It's the point of the power being used: a technical capability notice under section 253 of the Investigatory Powers Act 2016.

A TCN makes you build the capability, not hand over data

I've written before about data retention notices under the same Act, which force ISPs to log and store communications data. TCNs are a different instrument entirely.

They don't ask a company to hand over data it already has. They ask it to build and maintain the ability to comply with a future demand, and to keep quiet about having been asked.

What section 253 lets the Secretary of State require

Section 253 lets the Secretary of State give a notice to a "relevant operator", a definition broad enough to cover postal and telecommunications operators of any size. The notice imposes "applicable obligations" for the purpose of securing that the operator has the capability to provide assistance in relation to a future warrant or authorisation.

It's forward-looking by design. A TCN isn't itself a demand for data. It's a demand that the plumbing exist, so that a later, separate authorisation can be actioned quickly and without the operator being able to say no on technical grounds.

The obligations a notice can specify include:

providing facilities or services of a specified description
maintaining apparatus, including equipment the operator owns or runs
the removal of "electronic protection applied by or on behalf of that operator to any communications or data"
the security of postal or telecommunications services the operator provides
the handling or disclosure of information

Where the detail lives

The obligations that can actually be imposed are set out in more detail in secondary legislation: the Investigatory Powers (Technical Capability) Regulations 2018. These were made after consultation with the Technical Advisory Board and affected industry, as required by section 253(6).

The notice itself then specifies the concrete steps the operator must take and a reasonable timeframe for taking them, per section 253(7).

The double lock is real scrutiny, but not a hearing

TCNs go through the same "double lock" as interception warrants under the Act:

The Secretary of State decides the notice is necessary and proportionate.
A Judicial Commissioner has to approve that decision before it takes effect.

Under section 254, the Commissioner reviews the Secretary of State's conclusions on necessity and proportionality applying ordinary judicial review principles. They must give written reasons if they refuse.

What judicial review principles actually buy you

It's worth being precise here. Judicial review principles ask whether the decision-maker acted lawfully, rationally and proportionately given the material in front of them. They don't ask whether the Commissioner would have made the same call on the merits.

It's real independent scrutiny, considerably more than a rubber stamp. But it's not an adversarial hearing where the operator gets to make its case before the notice is issued. The operator finds out when the notice arrives.

The gag clause is what makes TCNs unusual

This is the feature that makes TCNs odd even by the standards of investigatory powers law. Section 255(8) covers a person given a relevant notice, and anyone employed or engaged for the purposes of that person's business. They must not disclose the existence or contents of the notice to any other person without the Secretary of State's permission.

That covers a lot of people you might want to tell:

your users
a journalist
a regulator in another country
on a strict reading, your own shareholders

The Act enforces the duty through civil proceedings rather than a specific criminal offence. That gives the Secretary of State the option of an injunction against a threatened or actual breach.

Why everything about the Apple case comes from unnamed sources

The practical effect is that a company served with a TCN cannot simply announce it's fighting one. That's why nearly everything reported about the Apple case has come from unnamed sources rather than statements from Apple or the Home Office. It's also why Apple's tribunal hearings have reportedly been held partly in secret.

Hang on, it gets stranger. A law firm, a journalist, or a Member of Parliament can describe the shape of a notice they've heard about. Meanwhile the one party who could confirm the details in full is legally barred from doing so.

The Apple dispute turns on who "applied" the encryption

The interesting legal question isn't whether a TCN can require encryption to be weakened in the abstract. It's what "electronic protection applied by or on behalf of that operator" means when the whole design point of Advanced Data Protection is that Apple doesn't hold the keys.

There's a reasonable argument for the Home Office reading. Apple built the system, ships the client, and operates the iCloud infrastructure the encrypted blobs sit in. So protection Apple engineered and rolled out to its users arguably counts as protection applied "on behalf of" the operator, even though Apple itself can't decrypt the result.

Apple's evident position is that a scheme specifically designed to keep the operator out of the loop shouldn't be treated as something the operator can simply be told to reverse. The Act doesn't spell out an answer either way. That's exactly the kind of question a tribunal, not a phone call, is for.

The leverage a domestic ISP doesn't have

Whatever the outcome, the underlying instrument only works on operators the UK can compel. Apple is a US company with no obligation to prioritise UK compliance over commitments elsewhere. It's notable that it chose to withdraw a feature rather than build a backdoor.

It's also notable that the pressure that reportedly moved the Home Office off its original worldwide demand came from another government rather than from litigation. A domestic ISP facing a TCN doesn't have that leverage.

If you're the operator on the receiving end

If your company is a "relevant operator" under the Act, which in practice can mean anyone providing a telecommunications or postal service to UK users, a TCN is not a request you can quietly decline on the basis that compliance is technically inconvenient.

The Technical Capability Regulations exist precisely to normalise the expectation that certain classes of operator maintain the relevant capability as a condition of operating. By the time a notice arrives, the "is this feasible" conversation is meant to have already happened through the Technical Advisory Board consultation process, not at your desk.

What you can and can't do

Per the Act itself, you have two routes:

refer the notice back for review before complying
challenge it through the Investigatory Powers Tribunal, which is the route Apple has taken twice now

What you cannot do, absent the Secretary of State's permission, is tell your users you've received one. For a company whose entire product pitch rests on a promise about what it can and can't see, that silence is arguably the more consequential half of the power.