17.5 Encryption under pressure

Status reviewed 15 July 2026. The Investigatory Powers Act notice regime and 2024 amendments are in force. Apple Advanced Data Protection remains unavailable to UK users. The reported Apple notice has been neither confirmed nor denied by the Home Office, and the exact terms are not public.

Why this fight matters

Encryption is not a niche concern for the technically minded. It is the foundation that keeps ordinary digital life safe.

The same mathematics that protects a criminal's messages also protects:

• your banking, medical records and work email;
• your family photographs;
• the messages of journalists, lawyers, doctors and abuse survivors.

There is no version of encryption that is strong against criminals but weak against the state, because the maths does not know who is asking. This is the single most important fact in the whole debate, and most of the disagreement comes from people wishing it were not true.

The UK government, like several others, has long been uneasy about strong end-to-end encryption, where only sender and recipient can read a message and the provider itself cannot. The two sides:

• Law enforcement and security agencies argue, with genuine cases behind them, that it lets serious criminals and abusers operate beyond reach.
• Technologists, security experts and civil-liberties groups answer that any way to break or bypass encryption for some inevitably weakens it for all.

This page sets out where that conflict stands in UK law and practice, and what it means for you.

The Investigatory Powers Act and technical notices

The legal centre is the Investigatory Powers Act 2016, amended in 2024.

• A Technical Capability Notice can require a telecommunications operator to maintain specified capabilities drawn from regulations, subject to necessity and proportionality procedures.
• The regime also includes national-security and notification notices.
• Notices, and their very existence, are subject to statutory disclosure restrictions, so public knowledge of individual demands is limited.

The power is not wholly without review. The Act provides for:

• Secretary of State and Judicial Commissioner involvement;
• a statutory review route;
• technical and cost advice;
• oversight by the Investigatory Powers Commissioner;
• potential proceedings before the Investigatory Powers Tribunal.

The 2024 amendments also restrict certain relevant changes while a notice is under review, and extend parts of the regime.

Critics reasonably argue that confidentiality prevents ordinary public scrutiny, and that a provider may have to maintain the status quo while challenging a notice. Accuracy means acknowledging both the safeguards and the unusually secret setting they operate in.

The Apple encrypted-backup case

The clearest public example came in 2025. Keep what is reported separate from what is confirmed:

• Reported: reputable reporting said the UK had served Apple with a notice seeking access to data protected by Advanced Data Protection, including data of users outside the UK.
• Not confirmed: the Home Office has consistently declined to confirm or deny any notice.
• Confirmed by Apple's actions: Apple stopped offering Advanced Data Protection to new UK users in February 2025, and later required existing UK users to turn it off to keep using their iCloud accounts.
• Apple's position: it has not built and will not build a backdoor or master key.

The practical result is certain even though the notice is not. UK users cannot choose end-to-end encryption for the extra iCloud categories covered by Advanced Data Protection, including iCloud Backup, Drive, Photos and Notes.

What still has end-to-end encryption: the fifteen categories Apple encrypts end to end by default (such as iCloud Keychain and Health), plus iMessage and FaceTime.

Myth: all iCloud data, or all Apple communications, in the UK lost end-to-end encryption. Reality: that broader claim is inaccurate. Avoid it.

Why this episode matters:

• It was real, not hypothetical. The powers were used against a major company over a deployed encryption feature.
• A company pulled a security feature from an entire country rather than compromise it, leaving UK users with weaker protection than people elsewhere.
• It showed the secrecy in action. The demand was not publicly confirmed in the ordinary way; what is known came out through reporting and subsequent legal proceedings.

For UK users the upshot was concrete and adverse: a privacy feature available in other countries was taken away, as a direct result of government pressure.

Client-side scanning and the messaging power

The second front is the Online Safety Act. It contains a power that could, in principle, require a messaging service to use "accredited technology" to identify illegal material (most relevantly, child sexual abuse content), including on end-to-end encrypted services.

The only known way to do that on an encrypted service is client-side scanning: software on your own device that inspects your messages or images before they are encrypted and sent. To its critics, that is a surveillance system installed on every phone, and it breaks the core promise of end-to-end encryption that nobody but the participants can see the content.

How it played out:

• During the Act's passage, major encrypted-messaging providers including Signal and WhatsApp said publicly they would rather withdraw from the UK than build such scanning in.
• The government indicated the power would not be used until scanning could be done in a way that was technically feasible without compromising security, a standard experts widely regard as not currently achievable.
• The power remains on the statute book, unused but available, and could be activated if the political and technical calculus changes.

Even dormant, its existence shapes how providers behave and what users expect.

Why a backdoor cannot be "for the good guys only"

The recurring official hope is "exceptional access": authorised authorities, under proper legal process, can read encrypted content while everyone else stays locked out.

The near-unanimous view of the cryptography and security community: this is not achievable. Any deliberate access mechanism (a key held in escrow, a scanning system, a built-in bypass) is a vulnerability. It can be:

• discovered;
• stolen;
• misused;
• compelled by another government, including ones with no regard for human rights.

A door built for one party is still a door, and whoever finds the key can open it. The history of security is full of mechanisms meant for narrow use being found and abused more widely.

This is not technologists being awkward or ideological. It is a statement about what is possible. You can have communications secure against everyone, or communications accessible to some and therefore weaker against all. You cannot have both.

Weakening encryption to catch the worst actors also exposes the law-abiding majority, including the very institutions (banks, hospitals, government itself) that depend on strong encryption to function. The choice is genuinely binary, and pretending otherwise does not make a safe backdoor exist.

What this means for you

Where things stand today is reassuring in one way and concerning in another.

• Reassuring: strong end-to-end encryption remains lawful and widely available in the UK. Signal, WhatsApp and similar services still operate, and using them is entirely legal.
• Concerning: the legal pressure is real and ongoing, one major privacy feature has already been withdrawn from UK users, and dormant powers exist that could compel more.

The trajectory is towards more pressure, not less.

The sensible response:

• Use strong encryption now, while you can, and make it your default rather than something saved for sensitive moments. See 7.1 on messaging and Chapter 3 on encrypting data at rest.
• Prefer services that are end-to-end encrypted by default and have shown they will resist compromising their security.
• Keep your own backups encrypted under keys you control, rather than relying solely on a provider's cloud, especially since one cloud encryption feature has already been pulled in the UK.
• Treat it as partly a civic matter, as with digital identity. The encryption you can rely on in five years depends partly on whether people understand and defend it now.

The consolidated steps are in 17.7.

Primary sources: the Home Office Notices Regime Code of Practice, the Investigatory Powers (Amendment) Act 2024 explanatory notes, and Apple's UK Advanced Data Protection notice.