Investigation into classified data leaks is stymied by iPhone security feature.<\/b>
\nIn summary:
Macworld reports that the FBI was unable to extract data from a reporter\u2019s seized iPhone 13 due to Apple\u2019s Lockdown Mode feature.
Lockdown Mode, introduced in iOS 16, provides extreme privacy protection against targeted spyware by disabling features and requiring device unlock for accessory connections.
This incident demonstrates Apple\u2019s robust security measures can effectively thwart even law enforcement forensic tools, showcasing strong user privacy protections.
FBI tech specialists have been unable to gain access to a journalist\u2019s iPhone because it was in Lockdown Mode, court filings reveal.
As part of an investigation into the suspected leaking of classified data by a Pentagon contractor, the FBI last month raided the home of reporter Hannah Natanson and confiscated a wide range of devices, including an iPhone 13 and two MacBook Pros. They were able to access one of the MacBooks by pressing Natanson\u2019s fingertip on the Touch ID sensor (which was permitted under the terms of the search warrant), but they had no such luck with the iPhone.
\u201cThe iPhone was found powered on and charging, and its display noted that the phone was in \u2018Lockdown\u2019 mode,\u201d representatives of the FBI report in a filing (via 404 Media) which opposes the return of the devices. \u201cBecause the iPhone was in Lockdown mode, [the Computer Analysis Response Team] could not extract that device.\u201d
As 404 observes, the filing was made roughly two weeks after the raid, which implies that FBI specialists were unable to break through Lockdown Mode for that length of time. This gives us a rare glimpse into the feature\u2019s effectiveness.
Lockdown Mode is a niche and rarely discussed iPhone security feature, an ultra-high-privacy setting, which was added in the iOS 16 software update back in 2022. It\u2019s intended for iPhone owners working in specialised fields, such as journalism and political activism, where they could be targeted by state-sponsored spyware. The mode disables many features and impacts performance, but makes your device much more difficult to target.
While its principal aim is to thwart mercenary spyware attacks, Lockdown Mode can also prevent data from being extracted thanks to a change in the way the locked-down device interacts with external accessories: namely, that the iPhone has to be unlocked for an accessory to be connected. As 404 points out, many digital forensics tools used by law enforcement depend on making a physical connection in a way that Lockdown Mode prevents.
It\u2019s debatable how Apple will feel about making headlines in this way. On the one hand, the situation serves as a reminder that iPhones have excellent security features, and that Apple is so committed to device privacy that it has made enemies in law enforcement. There are echoes of the San Bernardino case in 2015\/2016, when Apple refused to write a custom iPhone OS to help the FBI access a mass shooter\u2019s communications.
But on the other hand, Apple approaches the political establishment in a slightly more conciliatory way these days. How would Tim Cook react if the president posted messages to Truth Social complaining about Lockdown Mode and demanding it be removed in future versions of iOS? It\u2019s hard to say, but I imagine he\u2019d like to avoid that conversation.<\/p>\n