Lockdown Mode prevented FBI from getting into reporter’s iPhone

After the FBI raided a Washington Post reporter’s home and seized multiple devices, Lockdown Mode prevented them from accessing her iPhone. Here are the details.

FBI unable to access data from reporter’s iPhone

As reported by 404 Media, the FBI raided the home of Washington Post reporter Hannah Natanson earlier this year, “as part of an investigation into leaks of classified information.”

Natanson’s profile page on The Washington Post’s website states that she has been “covering Trump’s reshaping of the federal government and its effects,” and that “was part of a team of Post journalists awarded the 2022 Pulitzer Prize for Public Service for coverage of the Jan. 6 insurrection at the U.S. Capitol.”

During the FBI’s raid last January, agents seized multiple electronic devices at Natanson’s home, including a MacBook Pro and an iPhone 13.

However, the FBI’s Computer Analysis Response Team (CART) was unable to extract data from the iPhone thanks to the system’s Lockdown Mode, which “helps protect devices against extremely rare and highly sophisticated cyber attacks,” per Apple’s description.

Here’s 404 Media:

“Because the iPhone was in Lockdown mode, CART could not extract that device,” the court record reads, referring to the FBI’s Computer Analysis Response Team, a unit focused on performing forensic analyses of seized devices. The document is written by the government, and is opposing the return of Natanson’s devices.

And

The court record mentioning Lockdown Mode was filed on January 30th, around two weeks after the FBI raided Natanson’s residence, indicating the FBI has not been able to access the iPhone during that time.

In practice, this means that, up until the report was filed, CART hadn’t managed to exfiltrate data because of the iPhone’s Lockdown Mode, but it’s impossible to know whether they have since been able to access the device.

More on Lockdown Mode

Here’s how Apple explains this feature, which is available in iOS 16 or later, iPadOS 16 or later, watchOS 10 or later, and macOS Ventura or later:

Lockdown Mode is an optional, extreme protection that’s designed for the very few individuals who, because of who they are or what they do, might be personally targeted by some of the most sophisticated digital threats. Most people are never targeted by attacks of this nature.
When Lockdown Mode is enabled, your device won’t function like it typically does. To reduce the attack surface that potentially could be exploited by highly targeted mercenary spyware, certain apps, websites, and features are strictly limited for security and some experiences might not be available at all.

Lockdown Mode limits a wide range of system features and connections, including blocking most message attachments, restricting certain web browsing technologies, limiting FaceTime calls from unknown contacts, preventing device connections unless the device is unlocked, and turning off configuration profiles and device management enrollment.

To learn more about Lockdown Mode, follow this link.