The recent federal raid on the home of Washington Post reporter Hannah Natanson isn’t merely an attack by the Trump administration on the free press. It’s also a warning to anyone with a smartphone.

Included in the search and seizure warrant for the raid on Natanson’s home is a section titled “Biometric Unlock,” which explicitly authorized law enforcement personnel to obtain Natanson’s phone and both hold the device in front of her face and to forcibly use her fingers to unlock it. In other words, a judge gave the FBI permission to attempt to bypass biometrics: the convenient shortcuts that let you unlock your phone by scanning your fingerprint or face.

It is not clear if Natanson used biometric authentication on her devices, or if the law enforcement personnel attempted to use her face or fingers to unlock her devices. Natanson and the Washington Post did not respond to multiple requests for comment. The FBI declined to comment.

[

Related

FBI Raid on WaPo Reporter’s Home Was Based on Sham Pretext](https://theintercept.com/2026/01/15/fbi-raid-washington-post-journalist/)

Natanson has not been charged with a crime. Investigators searched her home in connection with alleged communication between her and government contractor Aurelio Luis Perez-Lugones, who was initially charged with unlawfully retaining national defense information. Prosecutors recently added new charges including multiple counts of transmission of defense information to an unauthorized person. Attorneys for Perez-Lugones did not comment.

The warrant included a few stipulations limiting law enforcement personnel. Investigators were not authorized to ask Natanson details about what kind of biometric authentication she may have used on her devices. For instance, the warrant explicitly stated they could not ask Natanson which specific finger she uses for biometrics, if any. Although if Natanson were to voluntarily provide any such information, that would be allowed, according to the warrant.

The FBI’s search and seizure warrant for Washington Post reporter Hannah Natanson details how authorities could use her fingers or face to unlock her phone.  Screenshot: FBI

Andrew Crocker, surveillance litigation director at the Electronic Frontier Foundation, told The Intercept that while the EFF has “seen warrants that authorize police to compel individuals to unlock their devices using biometrics in the past,” the caveat mandating that the subject of the search cannot be asked for specifics about their biometric setup is likely influenced by recent case law. “Last year the D.C. Circuit held that biometric unlocking can be a form of ‘testimony’ that is protected by the 5th Amendment,” Crocker said. This is especially the case when a person is “forced to demonstrate which finger unlocks the device.”

Crocker said that he “would like to see courts treat biometric locks as equivalent to password protection from a constitutional standpoint. Your constitutional right against self-incrimination should not be dependent on technical convenience or lack thereof.”

[

Related

Crossing the U.S. Border? Here’s How to Protect Yourself](https://theintercept.com/2025/03/29/customs-us-border-travel-airports-phone-searches/)

Activists and journalists have long been cautioned to disable biometrics in specific situations where they might face heightened risk of losing control of their phones, say when attending a protest or crossing a border. Martin Shelton, deputy director of digital security at Freedom of the Press Foundation, advised “journalists to disable biometrics when they expect to be in a situation where they expect a possible search.”

Instead of using biometrics, it’s safest to unlock your devices using an alphanumeric passphrase (a device protected solely by a passcode consisting of numbers is generally easier to access). There are numerous other safeguards to take if there’s a possibility your home may be raided, such as turning off your phone before going to bed, which puts it into an encrypted state until the next time it’s unlocked.

That said, there are a few specific circumstances when biometric-based authentication methods might make sense from a privacy perspective — such as in a public place where someone might spy on your passphrase over your shoulder.

The post Washington Post Raid Is a Frightening Reminder: Turn Off Your Phone’s Biometrics Now appeared first on The Intercept.


From The Intercept via This RSS Feed.

all 3 comments

sorted by: hot top controversial new old
[–] 6 points 9 months ago (2 children)

I use my finger to unlook the phone, but after 5 attempts, it will always ask for my password. So if I am going to be searched, I can conveniently use the wrong finger 5 times and lock it with password. It won't revert to fingerprint unlocking until I entered the password once.

After that, I have a duress password that will erase everything on the phone except the OS.

If you are at risk in the US, consider getting a refurbished pixel and install grapheneOS. You'll sleep better.

🎯 2
  • source
  • hideshow 2 child comments
  • [–] 1 point 9 months ago (1 child)

    I can conveniently use the wrong finger 5 times and lock it with password. It won’t revert to fingerprint unlocking until I entered the password once.

    It's better than nothing, but I don't think that puts the phone into the BFU (Before First Unlock) state, so your data is still unencrypted in memory. The duress code that wipes your data is certainly going to be effective, but you are then definitely going to be on a charge of deliberate destruction of evidence. Whether that's worth it would be a decision for each individual.

  • source
  • parent
  • hideshow 1 child comment
  • Check grapheneos, after locking, they clear the data from memory. Also, after locking, a timer starts, if I don't unlock my phone before the timer runs out, it auto reboots. Now, I don't live in a country where I need to be worried about being searched, but you can bet if I were in the US, that timer would be no longer than 1 hour. Hell, maybe would set it to 10 minutes, just to be sure.

  • source
  • parent
  • 62 comments in c/news@lemmy.world view that post
    [–] 75 points 9 months ago (15 children)

    A reminder if you restart your phone biometrics don't work until you unlock it once with your code.

    If you're about to deal with police, turn off or restart your phone so it resets to a Before First Unlock state where your information is encrypted and biometrics do not work.

    If your phone allows you to set an automatic restart, set that up.

    GrapheneOS by default automatically reboots after 18 hours of not being successfully unlocked. Devices in the Before First Unlock state are effectively not able to be accessed by standard law enforcement solutions. It also lets you set a duress password that will immediately make the storage contents permanently inaccessible, delete the eSIM, and power off the device.

  • source
  • hideshow 15 child comments
  • [–] 20 points 9 months ago (11 children)

    If you press the lock button on your iPhone several times in a row, it will force the entry of a pin next time it starts.

    Test it out, and learn how to do it quickly if the popo comes for you.

  • source
  • parent
  • hideshow 11 child comments
  • [–] 10 points 9 months ago* (3 children)

    On my pixel I can just hold the power button and click "Lockdown" on the menu and it will force the code

  • source
  • parent
  • hideshow 3 child comments
  • [–] 7 points 9 months ago (2 children)

    I don't like this because it's hard to do quickly without being obvious.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 8 points 9 months ago* (1 child)

    iPhone users: Hold power and either volume up or down button for two seconds It will lock and ask for your pin, regardless if you shut down the phone or not.

    Learn how to do it quickly and blindly, with your phone in your pocket.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 6 points 9 months ago* (last edited 9 months ago)

    Also change the passcode type to alphanumeric even if you just use numbers. Makes it impossible for them to unlock it with that Mosad software. Though you probably need to make the passcode longer than 6 characters and add in a few letters. Like a 6 number passcode just take days to crack. While a 12 character alphanumeric code takes thousands of years.

  • source
  • parent
  • [–] 2 points 9 months ago (3 children)

    I haven't done as much research on iPhones... does that put it back into a BFU state, or just not accept biometrics?

    There is a difference if it doesn't force it back into BFU state, not for say a patrol officer/agent on the field, but definitely if they're trying to get into your phone later.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 9 months ago (2 children)

    It just disables biometrics, so not a complete lockdown, but better than nothing.

    If you want to do a better lockdown, you do the following, it takes longer however:

    • Press Vol+
    • Press Vol-
    • Hold the lock button until you see the Apple logo

    This will force a restart of the device and require the pin to be entered.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 9 months ago* (1 child)

    You can just hold the lock button and volume up until it prompts you to power off.

    Or swipe down the control center and there a power icon in the top right

    Edit. Apparently that control center thing doesn't work on my phone but it used to

  • source
  • parent
  • hideshow 1 child comment
  • [+] 11 points 9 months ago (3 children)
  • [–] 1 point 9 months ago (2 children)

    Got any examples? Apple has won in court and the feds got all butthurt because they couldn’t unlock phones that they wanted to access.

  • source
  • parent
  • hideshow 2 child comments
  • load more comments (-1 replies)
    [–] 28 points 9 months ago* (6 children)

    Find your device's "lockdown" feature (disables fingerprint/face entry) and enable that in any potentially sketchy situation.

    I don't know how to trigger it on iOS, but my Pixel has the "lockdown" mode option on the same window as "shutdown" and "reboot", which can be accessed at any time by briefly holding the power button.

  • source
  • hideshow 6 child comments
  • [–] 15 points 9 months ago* (1 child)

    On iOS, you can press the power button five times in a row or hold the power button and volume up button together. Either one of those disables biometric login.

    Of course, you need to know that you need to do that and have the chance to do so.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 9 months ago (1 child)

    Wouldn't it be better to just turn the phone off? Seems like it's about the same amount of effort, and it won't have anything unencrypted in RAM any more.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 9 months ago

    It’s already in the same screen, both on Android and iOS, so of course it is much better, and not less convenient, to shutdown instead.

    I can’t think of any reason not to, besides “I might want to unlock it real quick”, which is exactly what you’re preventing on this scenario.

  • source
  • parent
  • [–] 24 points 9 months ago

    Is this the same Washington Post that was informed of the planned illegal invasion and kidnapping of a foreign state leader 24 hours before it happened and chose to sit on that information in order to protect the president?

    How odd to then claim just weeks later that they're "free press" and that the man they helped attack others is now attacking them.

  • source
  • [–] 10 points 9 months ago (4 children)

    On LineageOS, hold the power button and click "Lockdown"

  • source
  • hideshow 4 child comments
  • [–] 9 points 9 months ago* (3 children)

    Android has this too, if you enable it in the settings.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 10 points 9 months ago

    Ya that's great but also if you power off you phone, you can't use biometrics once it boots up for the first unlock. If you have time to shut it off first, that is.

  • source
  • [–] 8 points 9 months ago (19 children)

    Andoid implemented a lockout mode that when you activate, disables biometrics, usb access and hides notification.

    Its been available since the OneUI update.

    You activate by holding power and selecting lockput (where reset would be)

  • source
  • hideshow 19 child comments
  • [–] 9 points 9 months ago (4 children)

    OneUi isn't 'android', it's 'samsung'

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 9 months ago* (1 child)

    I've got a pixel and it will not allow biometrics on a hard power off or restart, only for login from a previous session. if I was a journalist I'd be resetting my phone constantly if I had sources to protect.

    It also hard locks if its been 24 hours since a password was typed. You can also intentionally cut your finger or fuckup your face guarantee biometric lockout. If you think you're about to be arrested and you have fingerprint unlock you can just slice or burn your finger.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 9 months ago* (3 children)

    iPhone/iPad/iWatch does this when you hold the power button to bring up the “turn off” slider. I’m pretty sure stock Android is similar. It’s great because it can be done in your pocket without even looking. I wish more people knew this, and did it every time they go through a security checkpoint or see a fascist in their periphery.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 9 months ago* (last edited 9 months ago) (2 children)

    For me at least it's tap power button 5 times rapidly, rather than holding it, on iPhone.

    Or hold power + volume down

    Edit: Do keep in mind that this doesn't reset your phone to Before First Unlock status, so it's still vulnerable to tools like cellebrite. This only disables Face ID until you enter the passcode again. For better protection, you'd want to fully shut down your phone, which MIGHT protect it from unlocking altogether, or it might not. If they can't have it unlocked right away, they can get it in a few months or years since you won't be getting security updates and they do discover new vulnerabilities every now and then.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 9 months ago (1 child)

    On my android the 5-tap activates SoS mode. Holding power for a moment gives the power off and lockdown option, as does pressing power+volup simultaneously. Power+voldown appears to be screenshot.

    Most of these options will still keep the phone "active" though so I'm not sure about USB based hacks. If encryption is enabled I believe that forcing a reboot/shutdown means the data on the phone isn't accessible until after unlocking via PIN/password on boot.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 9 months ago

    Oh yeah, so basically this will only protect from the police forcing you to look at your phone or touch the fingerprint sensor. It doesn't actually reset to BFU so you do indeed have to shut it down fully to be more protected. I probably should've mentioned that in my previous comment

  • source
  • parent
  • [–] 1 point 9 months ago (4 children)

    I can't find it? Do I need to enable it somewhere ?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 9 months ago (3 children)

    Yes . Need to enable in settings. Look for "lockdown mode" in security section

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 9 months ago (2 children)

    Enabled it, it's in lock screen security settings. But I don't see amy difference with regular power button single press

  • source
  • parent
  • hideshow 2 child comments
  • [–] 0 points 9 months ago (3 children)

    This would be much better if it could be triggered by touching the fingerprint sensor with a specific finger. I'm disappointed that isn't a feature yet.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 9 months ago (2 children)

    Its a built in feature for android. Bw glad that have it at all.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 6 points 9 months ago (3 children)

    Handing out my fingerprint to a tech company has seemed like a really bad idea ever since that tech was introduced to smartphones. Never used it myself. I've just stuck to the pattern lock instead. And don't even get me started on FaceID.

  • source
  • hideshow 3 child comments
  • [–] 10 points 9 months ago* (2 children)

    Tiktok's new TOS explicitly states that by using the platform, you grant them a permanent liscense to use your face, your voice, etc, for anything they want.

    Training LLM models, selling your biometric data to anybody, anything.

    People were right that its a form of invasive spyware, all corpo social media apps are, including dating apps obviously.

    But uh, its 'ours' now, its our 'panopticon in your pocket' killer app, so... now its good or something.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 9 months ago (1 child)

    Thank you, I'm so glad I left tiktok a while ago

    Side note, creating a bitmoji on Snapchat grants them rights to your likeness and image

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 9 months ago

    Graphene can do two factor unlock which is nice.

  • source
  • [–] 5 points 9 months ago (1 child)

    Any serious justice system would not accept illegally obtained evidence like this

  • source
  • hideshow 1 child comment
  • [–] 16 points 9 months ago

    Eh, I get what you mean, but let me explain how it works in Sweden.

    Our courts practice something called "fri bevisprövning", this means that no evidence can be declared unusable, and can be used in court, obviously the evidence has to be documented and validated as being real, but the manner of how it was collected does not matter.

    Now, if it was collected in an illegal way, that illegal act is a different case altogether.


    To be frank it makes a lot of sense, it stops procedural issues from denying the use of evidence, while punishing the illegal act used to collect it.


    Now, I know the US has good reasons for the laws they use regarding evidence, I just disagree that it is the only way to do it.

  • source
  • parent
  • [–] 1 point 9 months ago
    [–] 1 point 9 months ago (3 children)

    Wait, people were ever using biometric unlock?

    Oh... oh... did the obviously inevitable thing that would happen under that paradigm... happen under that paradigm?

    Wow, how surprising.

  • source
  • hideshow 3 child comments
  • [–] 4 points 9 months ago (2 children)

    Hell some phones have a spot on the back that's explicitly for scanning their fingerprint.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 9 months ago (1 child)

    You mean a fingerprint scanner? Like the ones that have been on all phones for years? Or, explicitly on the back, like the LG G3 did in 2014? The way you phrased that it seems like it was new information to you.

  • source
  • parent
  • hideshow 1 child comment
  • 22 comments in c/privacy@lemmy.ca view that post
    [–] 18 points 9 months ago

    Biometrics for phones were always a security risk.

    Every security measure is vulnerable to the wrench method. But at least with passwords you have to make the decision to say it out loud. With biometrics, it can just be unlocked while you sleep.

    The only security advantage is that with passwords you can just look at/film the screen. But you'd need very high res images of your fingerprint + advanced 3d printing.

  • source
  • [–] 34 points 9 months ago (3 children)

    GrapheneOS has a duress password: a different PIN you can type in at any unlock prompt that tells your phone to wipe your SIM and contents

    ❤️ 1
  • source
  • hideshow 3 child comments
  • [–] 10 points 9 months ago

    GrapheneOS also will restart after 18 hours without being unlocked by default, you can adjust this down to as little as 10 minutes or as long as 72 hours. A reboot forces a phone into the most secure Before First Unlock status. Biometrics do not work there.

  • source
  • parent
  • [–] 2 points 9 months ago

    Graphene uses 3 kinds of unlock methods - if you choose to use them.

    The main password/pin unlock you'd see whenever you first unlock your phone.

    A biometric fingerprint to use after first unlock.

    And Graphene has a secondary pin so that it requires a code AFTER using your fingerprint.

    This duress password and pin (you have both options) can be used at first unlock or whenever it prompts for the password and after biometrics where it asks for the secondary pin.

    Both will wipe your phone.

  • source
  • parent
  • [–] 6 points 9 months ago

    I want a system where you can define duress biometrics. For example, right middle finger and left thumb open the phone. Right forefinger locks the phone and disables further use of biometrics.

  • source
  • [–] 5 points 9 months ago (1 child)

    It's always a concern when travelling to another country. There's the decision between biometrics, passcode and/or burner. When travelling, always keep in mind that legality varies, and a country's compliance with their laws varies as well...

    Prepare ahead of time, always.

  • source
  • hideshow 1 child comment
  • [–] 2 points 9 months ago

    In addition to this: airport security cameras are REALLY good these days. So if you are in a risk group and want to use a passcode to secure yourself, make sure you don't unlock your phone at the airport at all.

    These days, with QR boarding passes etc, a burner may be a better alternative for such people.

  • source
  • parent
  • [–] 5 points 9 months ago (2 children)

    What if I quickly restarted my phone? I'd only need to hold the side button for a second or two and then it would require my gesture to unlock. They can't force that right? I'm. Not American but I'd like to see them try.

  • source
  • hideshow 2 child comments
  • [–] 8 points 9 months ago (7 children)

    Hold down the side button and either volume button for two seconds until the "Slide to power off" screen appears, then tap cancel to lock it*. Alternatively, press the side/power button 5 times rapidly to activate Emergency SOS and lock the phone.

  • source
  • hideshow 7 child comments
  • [–] 4 points 9 months ago (4 children)

    Is this for iPhone or Android?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 4 points 9 months ago

    Use a password or pin, and if your phone has it turn off auto connection to USB devices attached.

  • source
  • [–] 3 points 9 months ago

    A friend of mine was recently questioned by the FBI in regards to a potential crime that his employer allegedly committed (I can't go into the details). They asked him to give them his phone and unlock it. He asked them what if he didn't want to unlock it. They told him they would hold him down and use his biometrics to open it. As soon as he told me this story I disabled biometric unlock on my phone. It's really not that much of an inconvenience. I can still use my fingerprint to login to banking apps and stuff, it's not that big of an adjustment to put in my code every time I have to unlock my phone.

  • source
  • [–] 3 points 9 months ago

    Think of your phone as a safe, and your fingerprint as the key.

    With a warrant the police cannot force you to divulge the location of the key to your safe, but they can absolutely open your safe if they find it. (Yes they can pick the safe or cut it open but that's irrelevant to this analogy) If your safe uses a code to unlock they cannot force you to give them the code. (Again yes they'll get into the safe eventually, somehow, but irrelevant).

    It then follows that with a warrant the police cannot force you to divulge if you use facial recognition or which finger you use, but they can just try things until it works. And again they cannot force you to give them a pin or passcode to your phone.

    Key concept here is don't use fingerprints or facial recognition to secure your phone.

  • source
  • 9 comments in c/privacy@programming.dev view that post
    [–] 23 points 9 months ago (1 child)

    As I understand it even the alphanumeric passcodes they can break with password guessing, they make Limitless clones of the phone encryption bit so it getting shut down after a certain number of attempts doesn't stop them from Limitless guesses until they get it.

  • source
  • hideshow 1 child comment
  • [–] 4 points 9 months ago

    This is why folks need to use encrypted keys + binary paraphrases (p¶), so you can insert as many Unicode characters as you want as your p¶.

    Too bad not many 📱manufactures require a dedicated SD key slot for digital keys.

  • source
  • parent
  • [–] 14 points 9 months ago (6 children)

    Pressing the power button five times on an iPhone makes it require the PIN to unlock.

  • source
  • hideshow 6 child comments
  • [–] 12 points 9 months ago (2 children)

    Android has an equivalent lockdown mode. Open the power menu by holding Power and Volume Up. Then select lockdown.

  • source
  • parent
  • hideshow 2 child comments