US Congress asks the UK spy tribunal to let Apple brief lawmakers on the iCloud backdoor order

On 11 September 2026 Senator Ron Wyden and Congressman Warren Davidson sent a letter to the president of the Investigatory Powers Tribunal, the closed British court that hears Apple's challenge to the UK order for access to encrypted iCloud data. Their complaint is not about the order itself. It is about who is allowed to know. Apple told Congress that the UK let it brief the US Attorney General and the Vice President, and explicitly forbade it from telling Congress anything more.

How the case got here

The dispute is now twenty months old and most of it has played out in leaks and court orders rather than public filings, because a Technical Capability Notice comes with a legal ban on discussing it. The sequence matters, since the new letter leans on the last one having worked.

1. January 2025: the Home Office serves Apple a Technical Capability Notice under the Investigatory Powers Act, demanding a way to read encrypted iCloud backups of users worldwide.
2. February 2025: Apple switches off Advanced Data Protection for UK customers rather than build that access; the rest of the world keeps it.
3. March 2025: Apple files its first tribunal complaint. Wyden, Davidson and other lawmakers write to the tribunal asking for the case to be heard in public.
4. April 2025: the tribunal rejects the government's attempt at total secrecy and publishes the "bare details" of the case, including the names of the parties.
5. Late 2025: after objections from Washington, the Home Office withdraws the worldwide notice and issues a narrower one covering only British users' data. Apple's first challenge is thrown out as moot.
6. August 2026: Apple lodges a new complaint, this time challenging the government's authority to issue such notices at all.
7. 11 September 2026: the second congressional letter lands ahead of the case-management hearing on how that claim will proceed.

What the letter says

The two pages are unusually blunt for correspondence with a foreign court. The authors write that it is "wholly inappropriate for a foreign executive body to attempt to dictate the distribution of powers within the US government", and that the UK "cannot champion legislative oversight at home while using administrative gag orders to kneecap the constitutional authority of the US Congress". Much of the letter is an argument from British history: William Pitt's description of Parliament as the "grand inquest of the nation", Bagehot, Dicey, the idea that no administration can place its demands beyond legislative inquiry.

The practical asks are three. Open justice in the proceedings, repeating the request from last year. Access for independent cybersecurity experts and affected parties to evaluate the technical demand, which so far only the parties and security-cleared counsel have seen. And a ruling that no surveillance demand issued under UK law may restrict a US company from fully informing Congress. The letter also quotes the then Director of National Intelligence, Tulsi Gabbard, who called the original demand a "clear and egregious violation of Americans' privacy and civil liberties".

The Guardian, which saw the letter before it was sent, reported that the Home Office had been approached for comment. The tribunal is not bound by anything Congress writes. It was not bound in 2025 either, and still ruled against blanket secrecy weeks after the first letter, noting that the representations it had received "strongly argued in favour of open justice".

Why the secrecy is the point

The narrowing of the notice to British users solved the diplomatic problem and left the technical one intact. A capability to decrypt one country's backups has to exist in Apple's global systems, and the only thing keeping it from being used elsewhere is policy. That is exactly the kind of claim that needs outside scrutiny, and it is the claim nobody outside the closed hearing is allowed to test. We compared how Russia, the UK, Canada and Australia wrote their backdoor laws; the UK's is the only one where the affected company is forbidden from saying the order exists.

What this means if you use iCloud

Outside the UK, nothing has changed on paper: Advanced Data Protection is available and, when on, Apple holds no key to your backups, photos or notes. Check it in Settings, tap your name, then iCloud, then Advanced Data Protection. If it says Off, Apple can decrypt your backup on request from any government with a valid legal process, which was already true before this case. In the UK the toggle is gone, and the current notice is about what Apple must be able to do with the data that is left.

The honest note on VPNs belongs here and is short: a VPN changes which network you appear on, not who holds the keys to a backup sitting on Apple's servers. For this particular problem the only setting that matters is whether end-to-end encryption is on, and in one country the answer has been decided by a notice nobody may read.