Blocking mode: FBI fails to crack a reporter's iPhone

Apple's Lockdown Mode is actually intended for extreme exceptional cases. It's aimed at people who are specifically threatened by sophisticated digital attacks. A recent case from the US now demonstrates very concretely what this function can do. Even the FBI couldn't access the data on a seized iPhone because Lockdown Mode was active.

The incident involves a Washington Post journalist and an ongoing investigation into potential leaks of classified information. It connects several sensitive issues: press freedom, government investigations, digital forensics, and the question of how much control governments should have over personal devices. At the same time, the case provides a rare real-world example of how Apple's security mechanisms actually work beyond marketing claims.

Search of the apartment of a Washington Post reporter

As reported by the online news outlet 404 Media, the Federal Bureau of Investigation searched the home of Washington Post reporter Hannah Natanson earlier this year. The search was part of an investigation into alleged leaks of confidential or classified information.

Hannah Natanson works for the Washington Post. According to her author profile, she has reported on Donald Trump's reshuffling of the US federal government and its consequences. She was also part of a reporting team that won the 2022 Pulitzer Prize for Public Service for its coverage of the storming of the US Capitol on January 6.

Seized devices

During the search in January, FBI agents seized several electronic devices from Natanson's apartment. These included a MacBook Pro and an iPhone 13. Such measures are not unusual in investigations of this kind, as digital devices are considered potential sources of communication data, documents, or metadata.

FBI fails with iPhone

Of particular relevance is what happened after the seizure. The FBI's Computer Analysis Response Team (CART), a special unit for the forensic analysis of digital devices, attempted to extract data from the iPhone. According to court documents, however, this attempt was unsuccessful.

The reason: The iPhone was in Lockdown Mode. The documents explicitly state that CART was unable to extract any data from the device due to this mode. The corresponding document was written by the US government and argues against the return of the seized devices.

Timeline according to court records

The court document mentioning the Lockdown Mode was filed on January 30th. This was about two weeks after the search of Natanson's apartment. It can therefore be inferred that the FBI did not have access to the iPhone's data during this period.

In practice, this means that up until the report was submitted, the FBI had not been able to unlock the device or secure any data. Whether access was subsequently gained is not publicly known and cannot be determined based on the available information.

What Lockdown Mode actually is

Lockdown Mode is a security feature from Apple that was introduced with iOS 16 and later versions. It is also available on iPadOS 16, watchOS 10, and macOS Ventura or later.

Apple describes Lockdown Mode as an optional, particularly stringent security measure. It is intended for a very small group of people who, due to their work or personal circumstances, could be specifically targeted by sophisticated digital attacks. According to Apple, this mode is unnecessary for most users.

Technical limitations in Lockdown Mode

When Lockdown Mode is activated, the device no longer behaves as usual. To minimize potential attack vectors, numerous functions are restricted or completely disabled. These include, among others:

Blocking most message attachments
Limitations of certain web browser technologies
FaceTime calls are now only possible from known contacts.
No connection to other devices while the device is locked.
Disabling configuration profiles and mobile device management

These restrictions are intended to prevent highly specialized spyware from exploiting security vulnerabilities. At the same time, however, they also make it more difficult for forensic analysis tools to access the system.

Significance of the case

This case demonstrates that the Lockdown Mode not only offers theoretical protection but can also be effective in real-world investigations. Even a specialized FBI unit was unable to access data from an iPhone with the Lockdown Mode activated.

This clearly demonstrates how strong modern device security has become and how much it has changed the balance of power between device manufacturers, users, and law enforcement agencies.

Lockdown Mode: Maximum security for iPhone, iPad and Mac

A real stress test for the Lockdown Mode

The incident involving Hannah Natanson makes the Lockdown Mode tangible. It's not an abstract security feature, but a tool with very real consequences. In this case, it prevented the FBI from accessing a seized iPhone for at least two weeks. For journalists, as well as other particularly vulnerable groups, this underscores the practical relevance of this function – and for law enforcement agencies, it highlights the limitations of traditional digital forensics. (Image: Shutterstock / Primakov)