U.S. senator warns UK’s Investigatory Powers Act could compromise U.S. encryption and data privacy

A new request from Senator Ron Wyden highlights mounting unease in Washington over the United Kingdom’s surveillance laws. In a letter to Director of National Intelligence Tulsi Gabbard, the senator asked for a public assessment of the national‑security risks created by Britain’s Investigatory Powers Act (IPA) and its secret “technical capability” orders aimed at U.S. technology firms. Wyden warned that any foreign demand for an encryption back‑door would endanger American privacy and widen avenues for hostile cyber actors.

The IPA’s gag provisions complicate oversight. Recipients of a technical‑capability notice may not even admit the order exists, leaving Congress and the public guessing about which companies are affected and how they respond. Apple told Wyden’s staff it would be barred from confirming or denying such a notice, and Google gave the same explanation when pressed for details.

Corporate reactions differ. Apple’s Advanced Data Protection (ADP) remains opt‑in worldwide, yet its default‑off status means only a fraction of users rely on full end‑to‑end encrypted iCloud backups. After receiving a UK demand earlier this year, the company removed ADP for new customers in Britain and forced existing users to disable the feature during a short grace period. Google enables encrypted Android backups by default but declined to say whether London had approached it, later stressing that no back‑door exists in its products. Meta issued an unequivocal denial, stating it has not been asked to compromise WhatsApp or Messenger encryption.

Wyden’s letter argues that the IPA’s reach extends beyond decryption. The law could secretly compel companies to store fresh U.S. user data on British soil and authorize “equipment interference” operations that install spyware on devices—steps that would expose U.S. officials and citizens alike to foreign surveillance. The senator contends these possibilities create systemic vulnerabilities rather than isolated privacy lapses.

U.S. authorities have examined whether the UK order against Apple violates the CLOUD Act, which forbids British investigators from demanding data belonging to Americans or anyone located in the United States. Political pressure is rising as well: Vice President J.D. Vance and other lawmakers have urged London to drop the matter amid fears of a broader clash over encryption policy.