Technical capability notices under the Investigatory Powers Act are issued and contested in secret. The late-2024 notice forced Apple to withdraw Advanced Data Protection from all UK users in February 2025, a narrower replacement order followed in late 2025, and the tribunal heard the case on assumed facts in 2026 only because Apple and Privacy International litigated. Separately, section 121 of the Online Safety Act could compel scanning of encrypted services; the power is unused and on the statute book. UK law contains no presumption protecting end-to-end encryption and no duty to publish even the number of notices.
Every UK user now has weaker cloud security than users elsewhere, a national downgrade with no parallel. Secret orders against encryption chill security investment and threaten adequacy, and the only checks so far have been leaks and foreign-government pressure.
An IPA and OSA amendment creating a statutory presumption against notices that weaken end-to-end encryption, mandatory aggregate transparency reporting, and independent technical review before issuance.
// State-led: Instrument: IPA/OSA amendment creating statutory presumption and mandatory TCN transparency.
Every UK user carries a cloud-security downgrade with no parallel abroad, and the statutory shield is politically fraught, checked so far only by litigation and foreign pressure.