Lockdown mode prevented FBI from getting into reporter’s iPhone – 9to5Mac

After the FBI raided a Washington Post reporter’s home and seized several devices, Lockdown prevented them from accessing her iPhone. Here are the details.

The FBI does not have access to data from the reporter’s iPhone

As he states 404 MediaThe FBI raided the home of Washington Post reporter Hannah Natanson earlier this year “as part of an investigation into leaks of classified information.”

Natanson’s profile page on The Washington Post website states that she “covered Trump’s reshuffle of the federal government and its implications” and that she “was part of a team of Post journalists awarded the 2022 Pulitzer Prize for Public Service for coverage of the January 6 U.S. Capitol uprising.”

During an FBI raid last January, agents seized several electronic devices from Natanson’s home, including a MacBook Pro and an iPhone 13.

However, the FBI’s Computer Analysis Response Team (CART) was unable to extract data from the iPhone due to the system’s Lockdown mode, which “helps protect the device against extremely rare and highly sophisticated cyberattacks,” as Apple describes it.

Here it is 404 Media:

“Because the iPhone was in Lockdown mode, CART was unable to retrieve the device,” the court filing states, referring to the FBI’s Computer Analysis Team, a unit dedicated to conducting forensic analysis of seized devices. The document is written by the government and opposes the return of Natanson’s devices.

AND

The court filing mentioning the Lockdown was filed on January 30, about two weeks after the FBI raided Natanson’s residence, indicating that the FBI did not have access to the iPhone during that time.

In practice, this means that CART was unable to exfiltrate the data due to the iPhone’s locked mode until the report was filed, but there is no way to know if they have had access to the device since then.

More about lock mode

Here’s how Apple explains the feature, which is available in iOS 16 or later, iPadOS 16 or later, watchOS 10 or later, and macOS Ventura or later:

Lockdown Mode is an optional, extreme protection designed for the very few individuals who, because of who they are or what they do, may be personally targeted by the most sophisticated digital threats. Most people are never the target of attacks of this kind.
When Lock Mode is enabled, your device will not work as usual. To reduce the attack surface that could potentially be exploited by highly targeted mercenary spyware, some apps, websites and features are severely restricted for security reasons, and some options may not be available at all.

Lockdown mode restricts a wide range of system functions and connections, including blocking most message attachments, restricting certain web browsing technologies, restricting FaceTime calls from unknown contacts, preventing device connections unless the device is unlocked, and disabling configuration profiles and device management registration.

To learn more about lock mode, click this link.

Accessories offer on Amazon

Add 9to5Mac as a preferred resource on Google
Add 9to5Mac as a preferred resource on Google

FTC: We use automatic income earning affiliate links. More.

Leave a Comment