U.S. probes UK over encryption backdoor demands amid breach of data pact

The U.S. government has opened an inquiry into whether the United Kingdom breached a bilateral data-sharing agreement by demanding Apple Inc. create a “backdoor” to access encrypted iCloud data globally.

The probe, led by Director of National Intelligence Tulsi Gabbard, follows revelations that British authorities secretly instructed the tech giant to bypass its own security systems, potentially violating the 2018 Clarifying Lawful Overseas Use of Data (CLOUD) Act, which prohibits unilateral access to citizens’ data across borders without legal safeguards.

At the center of the dispute is the UK’s Investigatory Powers Act 2016, which permits gag orders to suppress corporate disclosure of surveillance requests. Apple reportedly received such an order to build tools enabling UK authorities to decrypt iCloud content, prompting the company to suspend its Advanced Data Protection (ADP) feature for UK users.

ADP, an opt-in system offering end-to-end encryption, ensures only users can access their data, a protection Apple itself cannot override. The UK’s demand, if enforced, would nullify this security layer, exposing user data to potential cyberattacks.

In a February 25 letter to Senator Ron Wyden and Representative Andy Biggs, Gabbard called the reported UK directive a “clear and egregious violation” of Americans’ constitutional rights, warning it could create “serious vulnerabilities” exploitable by adversarial states.

She emphasized that the CLOUD Act bars foreign governments from accessing U.S. persons’ data without adhering to mutual legal assistance treaties, which require transparency and judicial oversight.

The investigation underscores escalating tensions between tech firms and governments over encryption. While law enforcement argues such tools hinder crime prevention, experts warn that backdoors undermine global cybersecurity.

“Mandating decryption capabilities sets a dangerous precedent,”note one cybersecurity scholar on social media. “Once created, these tools can be weaponized by authoritarian regimes or hackers, destabilizing trust in digital ecosystems”.

Apple, which faces operational risks if it resists, has not disclosed how many users are affected or when ADP might be reinstated. Meanwhile, Gabbard’s office is assessing whether the UK’s actions contravene the CLOUD Act’s reciprocity principle, which restricts both nations from unilaterally accessing data on each other’s soil.

The outcome could reshape transatlantic data governance. If the U.S. confirms a breach, it may prompt revisions to the CLOUD Act framework, straining intelligence-sharing partnerships.

Conversely, a UK refusal to backtrack could embolden other nations to impose similar demands, fragmenting global privacy standards. For now, the focus remains on diplomatic negotiations and Apple’s next move—a decision that balances legal compliance with user trust.