Forgot your password?
typodupeerror
Iphone

FBI Couldn't Get Into Reporter's iPhone Because It Had Lockdown Mode Enabled (404media.co) 130

The FBI has been unable to access a Washington Post reporter's seized iPhone because it was in Lockdown Mode, a sometimes overlooked feature that makes iPhones broadly more secure, according to recently filed court records. 404Media: The court record shows what devices and data the FBI was able to ultimately access, and which devices it could not, after raiding the home of the reporter, Hannah Natanson, in January as part of an investigation into leaks of classified information. It also provides rare insight into the apparent effectiveness of Lockdown Mode, or at least how effective it might be before the FBI may try other techniques to access the device.

"Because the iPhone was in Lockdown mode, CART could not extract that device," the court record reads, referring to the FBI's Computer Analysis Response Team, a unit focused on performing forensic analyses of seized devices. The document is written by the government, and is opposing the return of Natanson's devices.

The FBI raided Natanson's home as part of its investigation into government contractor Aurelio Perez-Lugones, who is charged with, among other things, retention of national defense information. The government believes Perez-Lugones was a source of Natanson's, and provided her with various pieces of classified information. While executing a search warrant for his mobile phone, investigators reviewed Signal messages between Pere-Lugones and the reporter, the Department of Justice previously said.

This discussion has been archived. No new comments can be posted.

FBI Couldn't Get Into Reporter's iPhone Because It Had Lockdown Mode Enabled

Comments Filter:
  • In any case, if it's true, it means none of the companies that crack this stuff bothered with lockdown mode, so now they will and it will be cracked soon enough.
    • Why shouldn't the phone be secure by default

      • Re:Bad Apple Ad (Score:5, Informative)

        by mccalli ( 323026 ) on Thursday February 05, 2026 @10:58AM (#65970298) Homepage
        Because it would be unusable. Lockdown mode is pretty severe [apple.com], it's not something you want to deal with day to day.
        • by dnaumov ( 453672 )

          Because it would be unusable. Lockdown mode is pretty severe [apple.com], it's not something you want to deal with day to day.

          I am reading through the list in your link and I don't get it - what part of this is supposed to be "unusable"?

          • Despite what you claim you clearly didn't read the link the GP posted. It's a massive list of stuff that's disabled that people would find an iDevice barely useful without.

            • Re:Bad Apple Ad (Score:4, Informative)

              by dnaumov ( 453672 ) on Thursday February 05, 2026 @01:46PM (#65970660)

              Despite what you claim you clearly didn't read the link the GP posted. It's a massive list of stuff that's disabled that people would find an iDevice barely useful without.

              It's not a "massive list" and the things mentioned are barely an inconvinience (oh noes, Photos drops location details and Facetime doesnt work unless you had contact within 30 days, oh noes). The biggest would be restrictions on the web browser and you can have per-site exclusions.

              So what the fuck are you talking about?

              • by narcc ( 412956 )

                He's just not being clear. By "people would find an iDevice barely useful without" he really means "Please, don't use lockdown mode. It makes you harder to oppress. Privacy is treason."

        • by abulafia ( 7826 )
          I guess it is in the eye of the beholder, but "severe" seems overstated. I actually prefer some of the "restrictions" - no more Facetime spammers.
        • Re:Bad Apple Ad (Score:5, Informative)

          by Pseudonymous Powers ( 4097097 ) on Thursday February 05, 2026 @11:52AM (#65970418)

          From the link:

          How Lockdown Mode protects your device

          When Lockdown Mode is enabled, some apps and features will function differently, including:

          Messages: most message attachment types are blocked, other than certain images, video and audio. Some features, such as links and link previews, will be unavailable.

          Web browsing: certain complex web technologies are blocked, which may cause some websites to load more slowly or not operate correctly. In addition, web fonts may not be displayed, and images may be replaced with a missing image icon.

          FaceTime: incoming FaceTime calls will be blocked unless you have previously called that person or contact within the past 30 days. Features such as SharePlay and Live Photos are unavailable.

          Apple services: incoming invitations for Apple services, such as invitations to manage a home in the Home app, will be blocked unless you have previously invited that person. Focus and any related status will not work as expected. Game Center is also disabled.

          Photos: when you share photos, location information will be excluded. Shared albums are removed from the Photos app, and new Shared Album invitations are blocked. You can still view these shared albums on other devices that haven’t enabled Lockdown Mode.

          Device connections: to connect your iPhone or iPad to an accessory or another computer, the device needs to be unlocked. To connect your Mac laptop with Apple silicon to an accessory, your Mac needs to be unlocked and you need to provide explicit approval.

          Wireless connectivity: your device won’t automatically join non-secure Wi-Fi networks and will disconnect from a non-secure Wi-Fi network when you turn on Lockdown Mode. 2G and 3G mobile support is turned off for iPhone and iPad.

          Configuration profiles: configuration profiles can’t be installed, and the device can’t be enrolled in Mobile Device Management or device supervision while in Lockdown Mode.

          Phone calls and plain text messages continue to work while Lockdown Mode is turned on, although incoming calls won’t ring on a paired Apple Watch. Emergency features, such as SOS emergency calls, will not be affected.

          • Re:Bad Apple Ad (Score:4, Insightful)

            by FictionPimp ( 712802 ) on Thursday February 05, 2026 @12:04PM (#65970436) Homepage

            They just need to make each one of those a toggle. I'd turn quite a few of those on.

            • They just need to make each one of those a toggle. I'd turn quite a few of those on.

              Whatever you toggle becomes the weakest link, potentially even cumulatively. ...not that I disagree with you.

              • I'm not even thinking about security.

                I don't want random FaceTime, so I'd turn that on. I don't want location data in shared photos (or really to even accidentally share photos). I'm fine with not getting invitations for apple services, I don't want those. I don't use configuration profiles, so I'd like to remove the risk I accidentally add one. I don't want link previews in iMessage

                Just quality of life things.

                • by unrtst ( 777550 )

                  Agreed. Though I'm not sure I'd enable any of them. Would be nice to selectively loosen the restriction on complex web apps when needed/wanted without having to disable lockdown mode and all the other protections. If I had an Apple Watch, I'd probably want it allow it to ring. Otherwise, all those settings sounds like they should be the sane defaults it ships with, rather than lockdown-specific restrictions.

        • I've been using Lockdown mode since it has came out. Yes, one can't just click on links sent to you via text, and it can be a PITA to browse some websites, especially those with brain-dead anti-adblocker stuff that considers Lockdown Mode an adblocker. However, overall, it works well enough, and the security benefits are worth it, IMHO.

          I just wish websites would understand that many Apple users use it. I use it across all my Apple devices, just as protection from zero click attacks.

      • Presumably to avoid users accidentally bricking their phone due to a security snafu.

      • The iPhone _is_ secure by default. If any exploits are found, they are fixed. But the attack surface is reduced. If you support two image formats in lock down mode versus 50 in "normal" mode, that means in lockdown mode you are immune against exploits in 48 image formats. It also means you cannot display any of those 48 image formats.
  • Comments (Score:2, Insightful)

    The comments here should be interesting. What’s the venn diagram of the pro encryption group and the “these boots are so tasty when the stand on liberals” group look like? I suspect the boots so tasty crowd remains silent.

    • Re:Comments (Score:5, Insightful)

      by sinij ( 911942 ) on Thursday February 05, 2026 @10:31AM (#65970222)
      I know you get off on stoking political division, so there is no surprise that you vomited your latest post as soon as this story dropped.

      However, reasonable people a) would agree that going after journalists to uncover confidential source is not good for free speech regardless of the context, b) would agree that right against self-incrimination should not disappear just because it is "on a computer" or "on a phone".
      • Re: (Score:1, Troll)

        by stabiesoft ( 733417 )
        I'm not sure how much longer there will be journalists in the US. WaPo just gutted theirs. And in the same story I saw, it was talking about how the NYT's has become a site of cooking recipes and crossword puzzles. In the same article it talked about how Bezos tossed millions to get that fact based melania thriller to appease his lord majesty, and I guess WaPo journalists are paying for it. I don't think history is going to treat jeffy well, he could be keeping WaPo alive but instead is throwing money at ap
        • Re: (Score:2, Insightful)

          by homerbrew ( 10094532 )
          Yup, they are all owned by MAGAs now, so there is no need for real journalism. Just reprint what they tell you... Sadly independent journalism is currently the only way real news is going to be spread. There are so many low quality independent outlets, you really need to find and filter the crap ones out.
        • Wow, sometimes the truth hurts eh?
        • Bezos lost $100M on the WaPo "experiment", and he's covered similar losses for the previous several years. It's a pity all those fired 'journalists' failed to produce a product people wanted to pay to read (subscriptions were down 25% from a year ago).

          Their issue isn't that they lost their WaPo jobs, it's that their industry is shrinking, and they'll likely never find another journalism job - time to "Learn to Code"...

      • Re: (Score:3, Insightful)

        by Anonymous Coward

        you, yes YOU, have supported the most divisive figure in american political history since the civil war and gonna sit here and pretend like you care about it now? fuck all the way off please

        that aside im curious, do you prefer to ingest the boot toe or heel first? what type of wine pairing do you like?

      • Re:Comments (Score:5, Insightful)

        by karmawarrior ( 311177 ) on Thursday February 05, 2026 @11:52AM (#65970420) Journal

        > However, reasonable people a) would agree that going after journalists to uncover confidential source is not good for free speech regardless of the context, b) would agree that right against self-incrimination should not disappear just because it is "on a computer" or "on a phone"

        I must have missed the massive protests from Republicans about this then if the first part of your comment is correct. You ARE claiming Republicans do share the views you attribute to "reasonable people", correct?

    • You shouldn't finish your popcorn before the movie starts.

  • by Puls4r ( 724907 ) on Thursday February 05, 2026 @10:19AM (#65970208)
    Unless you're the past president.

    Just one more brick in the wall of the oligarchs proving that they can live by a different set of rules.
  • by oumuamua ( 6173784 ) on Thursday February 05, 2026 @10:38AM (#65970240)
    More than the phone was siezed and there is a special 1980 law protecting reporters and going after ALL their sources (do you think this administration stopped with just one?)

    On Friday night, a federal court in Virginia unsealed a redacted version of the search warrant affidavit that provides the FBI’s sworn statement justifying its request to search the home of Washington Post reporter Hannah Natanson. In the search, the government seized two laptops, Natanson’s phone, a voice recorder, and other electronic devices.

    ...

    “In its affidavit, the government did not reference the federal law that prohibits, with few exceptions, raids targeting journalists or newsrooms to seize unpublished work. The government appears to have ignored a crucial press freedom guardrail in searching a journalist’s home and did not alert the magistrate judge to the law’s application in this case, let alone show how or if it had complied with the statute’s considerable protections.”

    That federal law is the Privacy Protection Act of 1980, which created essential protections for journalists and newsrooms from government searches and seizures. Congress passed it out of concern that such raids could stanch the free flow of information to the public.

    https://www.rcfp.org/natanson-... [rcfp.org]

    • Re: (Score:3, Informative)

      by sinij ( 911942 )
      It is way early to try to memoryhole Obama's administration going after journalists [apnews.com] the same way. This is one of the rare cases where this is undeniably both parties problem. This is why Constitution exists.
      • What constitution? It was on life support before Roe vs Wade was overturned despite a complete lack of new legislation or a constitutional amendment to back that up (even Dred Scott needed a constitutional amendment to over turn its precedent), and the current administration is ignoring it outside of token "Pretend Congress still has some power" stuff.

        The US Constitution is toilet paper right now. The next democratic (small D) government should have a new one ready to go that has the major holes in the curr

      • Re: (Score:3, Informative)

        by homerbrew ( 10094532 )
        Based on the article you leaked, he was aggressive in plugging the leaks inside the government. He didn't appear to arrest journalists and seize their devices for an unlawful search. I have no issue with any president attempting to stop their government from leaking classified information, including our current one. I do have a huge issue with the search and seizure of journalists for the sole reason of finding their confidential leak. We are way beyond becoming the next North Korea or Hungary, this is
        • by sinij ( 911942 )
          Your motivated reading of the linked article does not change that Obama's administration did the same thing [cjr.org]. I am not defending Trump's administration on this issue, but it is dishonest to pretend this is something new.
          • by maladroit ( 71511 ) on Thursday February 05, 2026 @02:00PM (#65970692) Homepage

            When did Obama order a raid on a journalist in order to track down a leak?

            Obama's record wasn't great, but this looks like an obvious escalation.

      • by AmiMoJo ( 196126 )

        This is why you don't let this stuff slide, even when the guy doing it is popular and seemingly benign. The next guy might not be, and once the door is open...

      • by gweihir ( 88907 )

        Constitutions need to be enforced. After the Republicans have now successfully corrupted the US Supreme Court, that does not happen anymore. Another step into Fascism.

      • by narcc ( 412956 )

        You're a dishonest scumbag. The article does not support your bullshit claims.

        Fuck off, troll.

    • Damn. It took a whole 40 minutes between the first post and your post for someone to come up with the fact that search warrants against journalists should never be issued to find their sources. Kudos.

      This should have been the first topic to be discussed, instead of "Apple ads" and technology stuff. Police states and totalitarian regimes go after journalists sources. Freedom of press is paramount in a democracy.

    • Don't need to unlock a phone, duh. Water boarding way easier and cheaper to get information. Water + towel = cheap.
  • ... that Epstein practiced this good of OpSec. I am glad that someone at WaPo explained how to configure iPhones for security to journalists working there.
    • ... Epstein used bitlocker and Windows automatically uploaded the key tot he cloud that later was used to decrypt emails about Bill's syphilis problems.
      • Hoist with his own petard. Just desserts for a flimflam that sold a crufty copy of a copy of OS he ripped off. Added window dressing but ignored its horrible security for decadesm His sales team pushed half-baked products into law enforcement, banking, government, and much of the corporate world; despite its glaring technical inadequacies.

  • by codebase7 ( 9682010 ) on Thursday February 05, 2026 @11:07AM (#65970334)
    Even if you did get the thing back, no sane person who actually cares about OpSec would use it. It's compromised. Even if they couldn't access the data, there's no telling what else they did succeed in doing to it. Hell, attempting to use it might allow them to finally access that data, complete with automatic transmission to their analysts.

    Lockdown mode is better than nothing, but in reality the best option would be automatic, instant, and silent destruction of any data that the adversary might want to get their hands on. After all, adversaries rarely allow you to get the device back anyway. (And there's typically a ploy at work for them if they do.)
    • by OrangeTide ( 124937 ) on Thursday February 05, 2026 @11:45AM (#65970406) Homepage Journal

      It's tough to initiate that when you're not certain when a device will fall into the wrong hangs. A lock down plus time out for self erase might be a reasonable compromise.

      My old friend used to put a hundreds of fake URLs that he monitored as a canary or trip wire (I forgot what he called it). The longish path to a fake file was unlikely to be found accidentally, but if someone access his device and attempted to access the links that would inadvertently alert him. This can be helpful for detecting a remote attack, or knowing when an agency successfully unlocked a device. With the intention that he'd get a lawyer to go after any improper procedure to reach an acquittal

      • by gweihir ( 88907 )

        "Self erase" is a myth. It does not work in real-world scenarios. Unless the attackers are incompetent and cannot spend any money. To be fair, law-enforcement and spying on citizens is often done on the cheap and routinely done incompetently.

  • You donâ(TM)t turn on lockdown mode just for fun. For example if you store encrypted data on iCloud then only you have a key; if you lose the key your data is gone. Without lockdown mode, Apple has a second key and can restore your access. Of course that is less secure. Apple, or a rogue apple employee, or a very clever hacker, or law enforcement, might be able to access your data. You decide how bad that risk is compared to the risk of losing your data.

    There is also loss of functionality. Like you
    • Lockdown mode is device specific, although Apple nudges you to turn it on across all accounts. That has nothing to do with iCloud encryption.

      Advanced Data Protection for iCloud is what removes the second key from Apple's servers and only allows it on your devices. If you go with Yubikeys + ADP, this provides a very strong barrier... but of course, if the Yubikeys and devices are lost, you are out your data AND devices. I use ADP just for peace of mind if a cloud service is compromised. Same reason why I

    • by tlhIngan ( 30335 )

      That's the point of lockdown mode. It's designed to reduce the potential attack surface of iOS by reducing functionality.

      It's one of those adjustments where you trade functionality for security that most people probably won't ever use. But for those people who feel they need it, they may be willing to make the trade.

      That's why Apple doesn't enable it by default. But it's there should you need it.

  • ... it's entirely plausible Apple just gave them access under the condition that they claim they didn't do it.

    • Snowden leaks showed this is how it works. Also the big thing they always talk about is simply "acknowledging existence of a capability".

      So yes they play big on hiding the mere fact that a capability may exist. They want you using vulnerable stuff. You know, like friends.

      • by gweihir ( 88907 )

        They want you using vulnerable stuff. You know, like friends.

        Given the long history of these, ahem, "people of negative worth to society", trying to place vulnerabilities and backdoors, this is the most plausible explanation.

    • > .. it's entirely plausible Apple just gave them access under the condition that they claim they didn't do it.

      Undocumented MMIO (memory-mapped I/O) registers in Apple A12–A16 Bionic SoCs [securityweek.com]
  • There once was a time the search of a journalists phone would have been a non-starter. Protected. Appears we're in a timeline where this is now a norm, and the press has no protection anymore. Just a technical hurdle to be overcome.

    Freedom of the press had a purpose...
    The press had a purpose...

    On a parallel thought.. anyone know how to get back onto the old time line? will be happy with going back in time 30 years too... (much more sane.. and those were the 90's... )

  • by fahrbot-bot ( 874524 ) on Thursday February 05, 2026 @05:07PM (#65971128)

    Raiding the Washington Post reporter's home and seizing things is more about harassment and intimidation than the investigation into the government contractor Aurelio Perez-Lugone. The reporter isn't listed in the criminal complaint against the contractor and the raid on her was requested by the Pentagon. This sort of thing hasn't happened before in a situation like this.

    FBI searches reporter's home, raising concerns about intimidation of free press [pbs.org]

    So the criminal complaint against this contractor does not mention any ties to The Washington Post reporter, yet the attorney general, Pam Bondi,on X said that the search was requested by the Pentagon "at the home of a Washington Post journalist, who was obtaining and reporting classified and illegally leaked information from a Pentagon contractor."

    One, it is notable that the attorney general is pointing out that the Department of Justice has a suspect in custody and in fact has charged that suspect. And so it raises the question as to why the Justice Department and the FBI would take the extraordinary step of executing a search warrant at the home of a reporter and seizing her electronic devices.

    The other point that I would make here is that this is actually something that we haven't seen before. Again, we're talking about the FBI raiding the home of a journalist in a national security leak case. At the Reporters Committee for Freedom of the Press, where I work, we track these cases closely.

    We are not aware of another case where the Justice Department has executed a search warrant in a national security leak case against a journalist or against a news outlet. It's unprecedented.

  • Ways to break into things lose their value when they become public knowledge. Hence they may well have been able to break in, but decided not to admit to it. One scenario is that they did not even try because other evidence showed them it would be futile or they did not have to. Another scenario is that they did break in, found nothing justifying the admission that they were able to and now lie about things.

    Of course, it is possible they actually cannot get in either. But it is impossible to say what is tru

  • Since all you have to do is go back into settings and turn Lockdown Mode off, everything boils down to your passcode/phrase, doesn't it?
  • One of the features that Graphene (an Android fork) has is the idea of a 'kill code' PIN that when entered instead of unlocking your phone erases it. It would make the XKCD workaround for PIN codes less attractive to the government

186,000 Miles per Second. It's not just a good idea. IT'S THE LAW.

Working...