Alice and Bill live in the UK, share an identical iPhone model, pay for the same Apple services, and store their lives in iCloud. Alice can turn on Advanced Data Protection, which encrypts most of her cloud data so Apple cannot read it. Bill cannot. The reason is simple: Apple pulled ADP for new UK users in February 2025, and Bill missed the window.
This is not a hypothetical. It is a real difference between two people using the exact same device. Alice enabled ADP before the withdrawal; Bill could not afterward. The result is a two-tier system where one person’s data is guarded by stronger encryption than the other’s, even though they bought the same phone and signed up for the same services.
The San Bernardino Case That Changed Everything
The fight over access to encrypted data is not new. In January 2014, Tim Cook told ABC’s David Muir that Apple would resist any attempt to break into its systems. “We have a gag order on us right now,” Cook said. He added, “There is no back door. The government doesn’t have access to our servers. They would have to cart us out in a box for that… We feel that strongly about it.”
Three years later, on 2 December 2015, Syed Rizwan Farook and Tashfeen Malik killed 14 people and wounded 22 in the San Bernardino terrorist attack. The FBI recovered Farook’s iPhone 5C but could not guess the passcode. The agency sought a court order forcing Apple to help access the device. Apple refused.
In an open letter, Cook said the government was asking for something Apple did not have. “Too dangerous to create,” he called it. In another ABC interview, Cook described the requested software as “the equivalent of cancer” and a “master key” capable of unlocking hundreds of millions of devices. On CBS’s 60 Minutes, he put it plainly: “If you put a back door in, then that back door is for everybody. For good guys and bad guys.”
James Comey, then FBI Director, told 60 Minutes he was committed to protecting Americans’ privacy but said marketing devices that place someone beyond the law troubled him. The FBI ultimately accessed the phone using a third party, widely reported to be Cellebrite.
The UK’s Order Under the Surveillance Law
On 7 February 2025, The Washington Post reported that the UK government had ordered Apple to provide access to data protected by its strongest iCloud encryption. The request came under the Investigatory Powers Act 2016, the UK’s modern surveillance law.
A Technical Capability Notice (TCN) is a legal instruction requiring providers to maintain or develop capability to meet certain requirements. It does not itself authorise access to data. Before issuing a TCN, the government must weigh technical feasibility, cost, likely benefits, and the number of users affected. A TCN needs approval from a Judicial Commissioner; recipients are gagged unless permitted by the UK Secretary of State.
The Post reported a TCN was issued secretly in January 2025, requesting Apple create a way to access encrypted iCloud data belonging to UK and worldwide Apple users. Apple’s private position remained consistent with its past stance: weakening encryption for any purpose or beneficiary makes every user less secure.
The dispute was the UK government wanting access, Apple saying it could not decrypt the data, and the UK responding that Apple should change the system to allow decryption.
What ADP Actually Protects
Not all iCloud data is end-to-end encrypted (E2EE). Some categories, like Passwords, Health data, and Messages in iCloud, are E2EE by default. With ADP turned on, iCloud Backup, Photos, Notes, and other categories become E2EE; Apple does not hold the keys to decrypt that data.
Apple cannot unlock ADP-protected data even if ordered to by law enforcement. That is the core of the UK dispute: the company cannot comply with a lawful order because it does not hold the keys to begin with.
Privacy International and other groups argued the government should not secretly compel companies to weaken encryption without adequate public scrutiny. The Investigatory Powers Tribunal (IPT) became involved as the independent UK body hearing complaints about unlawful surveillance or human rights breaches by public authorities.
| Who | Position |
|---|---|
| Alice | Can turn on ADP, protecting most iCloud data from Apple access |
| Bill | Cannot turn on ADP because Apple withdrew it for new UK users |
| UK Government | Ordered Apple to create a way around encryption via a TCN |
| Apple | Refused, citing the danger of weakening encryption for all users |
What This Means for Ordinary Users
The practical effect is stark. Alice gets stronger protection because she signed up before the withdrawal. Bill gets weaker protection because he did not. The two-tier system is not a choice between two devices; it is a choice made for them by Apple’s decision to stop offering ADP to new UK users.
The UK government’s demand also raises a broader question about trust. If Apple can be ordered to build a way around encryption, who else might ask?
The involvement of Privacy International and others means the dispute is drawing attention outside the secret issuance of the TCN. The underlying tension remains: the state wants access to encrypted data, and Apple cannot give it because it does not hold the keys.
The two-tier system in the UK is a warning sign. It shows what happens when governments treat encryption as a problem to be solved rather than a right to be protected. Alice and Bill deserve equal protection, regardless of when they bought their phones. Until that happens, the gap between them will remain open.
Where the paper stands
The paper backs Alice and the citizens and local groups pushing back against surveillance, and is against Apple’s withdrawal of Advanced Data Protection for new UK users, which creates a two-tier encryption system. The withdrawal leaves Bill with weaker protection than Alice, even though they share the same phone and paid the same price. That is an unacceptable outcome.
The dispute shows the dangers of government pressure on encryption. When the state demands a way around encryption, it weakens security for everyone, not just the target. Apple’s refusal to build a master key was the right call, and the company’s consistent stance on the subject supports that judgment.
What the reader should watch for is any further erosion of encryption protections. Governments and vendors alike push for access that puts ordinary users at risk. The paper will continue to stand with the citizens and local groups fighting back against these threats.
Source material: “Two-Tier Encryption in the UK – Identical Apple Devices, Different Protection,” macanorak.com.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.