The FBI has been unable to access a Washington Post reporter’s seized iPhone because it was in Lockdown Mode, a sometimes overlooked feature that makes iPhones broadly more secure, according to recently filed court records.

The court record shows what devices and data the FBI was able to ultimately access, and which devices it could not, after raiding the home of the reporter, Hannah Natanson, in January as part of an investigation into leaks of classified information. It also provides rare insight into the apparent effectiveness of Lockdown Mode, or at least how effective it might be before the FBI may try other techniques to access the device.

“Because the iPhone was in Lockdown mode, CART could not extract that device,” the court record reads, referring to the FBI’s Computer Analysis Response Team, a unit focused on performing forensic analyses of seized devices. The document is written by the government, and is opposing the return of Natanson’s devices.

Archive: http://archive.today/gfTg9

top 98 comments

sorted by: hot top controversial new old
[–] 284 points 9 months ago (19 children)

This news sparks joy. It’s a shame the FBI is wasting their time on petty political bullshit like this instead of going after real crime. What a shameful chapter for the FBI, and that’s really saying something given their illustrious history.

  • source
  • hideshow 19 child comments
  • [–] 91 points 9 months ago (6 children)

    You act like there's a cabal of kid rapist running the world.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 14 points 9 months ago (5 children)

    The "funny" thing is that anybody thinking that a mere 5 years ago would have been deemed a conspiracy nutter.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 19 points 9 months ago (4 children)

    That's not by accident. Every right wing conspiracy is a ridiculous pastiche of the shit they are really getting up to, or intend to in the near future. No doubt Pizzagate was invented to make people incredulous about claims of secret cabals of kid rapists in elite circles. Every accusation a confession.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 11 points 9 months ago

    Every accusation [is] a confession

    That is indeed something which has been very visibly and very often proven, again and again and again, in the last couple of years.

    I reckon it was always so, but we just forgot it during the period after WWII and the ressurging of the far-right.

  • source
  • parent
  • [–] 3 points 9 months ago (1 child)

    I bet they are making the frogs gay, too.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 9 months ago*

    Well... yes? AFAIK that was Alex Jones talking about endocrine disruption caused by atrazine in herbicides. Frogs turning gay seems a silly thing to focus on, but the health and environmental effects of herbicides and pesticides are a valid concern. By turning it into a joke, intentionally or not, he was doing his bit to invalidate serious discussion of the issue.

  • source
  • parent
  • [–] 71 points 9 months ago (2 children)

    If they had any decency at all they should be arresting the president.

    But hell would need to freeze over first. 😡

  • source
  • parent
  • hideshow 2 child comments
  • [–] 26 points 9 months ago (1 child)

    They did that, twice. Even got a trial and 34 felonies. Repercussions? None. Honestly if you do your job and not only see nothing come of it but said felon has an impact on your job now I can sympathize a bit.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 25 points 9 months ago

    Right!?

    Like ohhh. So important to see if someone liked a post. Meanwhile tech espionage and terrorists take over the world.

    How dare we 'radicalize' over the idea of free Healthcare.

    Absolute sham of 'protection'.

  • source
  • parent
  • [–] 17 points 9 months ago* (1 child)

    Honestly I don't even believe this stuff anymore. I feel like our government would set up shit just to make it look like they don't have as much control as they really do.

    Just a nice little theater act to try to make people think privacy can still be a thing.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 14 points 9 months ago* (4 children)

    It’s really great, isn’t it? But I’d leave you with one theoretical angle to consider…

    What if the FBI actually did get into the phone? If so, then why would this information have been made public?

    The only reason why, that I can think of right now, is that the FBI wants more people using Lockout. If so, the only reason I can possibly imagine for that is—there are actually some good commonly available techniques to keep them out of your devices, of which Lockout is insufficient. They’d want more people assuming that it is sufficient, and this news could accomplish that.

    Purely theoretical… but the bigger point here, whether that framing is strategically true or miraculously over-thinking things, is that something does work. No matter what, you know something works.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 13 points 9 months ago

    It’s not like it was a press release, it was gleaned from a court document. I suppose they could be happy with what info they got off of it enough to let this prosecution fail if they can follow up the chain, but I’m still skeptical. Who knows, maybe they have a functional quantum computer they don’t want to advertise

  • source
  • parent
  • [–] 7 points 9 months ago (1 child)

    You create a great story but violates K.i.S.S.

    • not saying they got in means they can’t use it as evidence. Sometimes there’s still due process
    • even if they can get into lockdown mode, it’s clearly harder than not lockdown. Why conspire to make it harder?
  • source
  • parent
  • hideshow 1 child comment
  • [–] 13 points 9 months ago

    I don't think that's a rational line of thinking, because there are documented filings of attempted file access into FOSS programs that the FBI are unable to influence and are completely unable to access, such as Veracrypt/LUKS encrypted PCs and GrapheneOS in BFU/Duress password entry status.

    Now, Apple is indeed a proprietary ecosystem, and as such unable to have community outside assurances that their system is completely trustworthy. However, Lockdown has now joined the ranks of other systems of data security that have been proven effective against a warrant, perpetuating the cycle in which nations such as the UK (and the US during the Crypto Wars) have tried to overtly undermine the technology through public actions after failures to covertly crack them. You cannot classify mathematics, physics, or cryptography, and there is no such thing as a perfect backdoor (despite some senators' opinions).

    With all that being said, I still wouldn't trust an iPhone, but I don't think that proposed line of thinking meshes with the FBI.

  • source
  • parent
  • [–] 36 points 9 months ago* (last edited 9 months ago) (6 children)

    One shortcoming of lockdown mode, as far as I can tell: you can pair your phone and watch so locking your phone will lock your watch as well, but you can’t do the reverse. It seems more likely that a hostile party would get access to your phone first while you still (temporarily) have control of your watch, so being able to lock your phone from your watch would be extremely useful. (Or for that matter, set lockdown mode to trigger automatically if your watch is removed or your watch and phone move to different locations.)

  • source
  • hideshow 6 child comments
  • [+] -8 points 9 months ago (2 children)

    That seems like a very simple problem to just not need to worry about.

    Just don't buy a smartwatch.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 112 points 9 months ago (29 children)

    Best advertisement I've heard for an iPhone ever. Now that Android moving to the same walled garden business model...

  • source
  • hideshow 29 child comments
  • [–] 10 points 9 months ago (11 children)

    Android phones have lockdown mode too. Hold the power button to show the shutdown menu and click lockdown.

    phone screenshot

  • source
  • parent
  • hideshow 11 child comments
  • [–] 20 points 9 months ago (1 child)

    They're not the same. Android lockdown is a temporary lock screen state. iOS lockdown is a full OS hardening, affects the way the phone operates full-time.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 9 months ago

    Ah, my bad. I looked it up and while Android does have an analog to what iOS calls "lockdown", Android uses different terminology for it, since "Lockdown" is, as you said, lock the lockscreen to be password/pin-only (which would still be a reasonable approach before being forced to turn over your phone to somebody since those are things that are harder to be compelled to provide).

    Android's version of iOS "Lockdown" is called "Advanced Protection Mode".

  • source
  • parent
  • [–] 8 points 9 months ago (4 children)

    Having it and it working as well are two different things. historically Apple has been ahead in security that can slow down or stop law enforcement. And before before you jump to the same conclusions as someone else, I never have owned an iPhone, nor wanted to.

  • source
  • parent
  • hideshow 4 child comments
  • [–] -2 points 9 months ago (3 children)

    That's incorrect. Google's Android has several industry leading security features the iPhone doesn't support.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 6 points 9 months ago (2 children)

    That’s… not what they said.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 10 points 9 months ago* (1 child)

    There's a lot of copium in this thread. Joke is I've been pretty hardcore Android since day one, I have never owned an iPhone. I am just capable of some level of objectivity. Shit, there's podcasts out there from early in the Android v iOS days where I was the token Android guy defending it as the IBM compatible equivalent of its day. Telling these hard core iPhone guys that Apple would lose the market share fight worldwide because of the closed nature, the same way they lost it on the desktop. But yeah, there's people here denouncing me as an Apple fanboy because I was capable of complimenting a strength it has.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 9 months ago (2 children)

    joke on you! google's recent requirement is that all phone vendors make the power button open an AI menu instead of the shutdown menu! on most phones it can be fixed, but it's often hidden very deep in the settings.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 9 months ago*

    I'd forgotten because the first thing I did when that rolled out was revert it so long-press on the power button was the power menu. IIRC the new default is like long-press-power-and-volume-down or some garbage like that to show the power menu.

  • source
  • parent
  • [–] 0 points 9 months ago

    AI will take as to the future shit 🤣 You: Hey Google (or the hell the new assistant names are), I'm beening arrested could you lock donw my phone!" The bot: Sorry, I couldn't get that. connecting to the ChatGPT/ Gemini servers

  • source
  • parent
  • [+] 6 points 9 months ago* (14 children)
  • [–] 5 points 9 months ago

    That is a misnomer. The android's "lockdown" is equivalent of on an iPhone pressing power button + up button to bring up the power menu which immediately disables biometrics. It only disables biometrics, doesn't really "hardens" the phone in anyway.

  • source
  • parent
  • [–] -1 points 9 months ago* (12 children)

    And the FBI can't get in? I doubt that. It has always been notoriously easy for law enforcement to get in to Android phones.

  • source
  • parent
  • hideshow 12 child comments
  • [–] 5 points 9 months ago (2 children)

    Even if you turned the phone off? It should be secure on a cold boot before entering the password, as nothing is unencrypted yet.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 0 points 9 months ago (1 child)

    You know, I have not kept up. Things may have improved recently. But historically there's always been flaws in the security.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 9 months ago

    And that is the big reason why you should update. It's a cat and mouse situation. This is the reason why GrapheneOS offer security previews and encourage you to install them.

  • source
  • parent
  • [+] 6 points 9 months ago (2 children)
  • [–] 18 points 9 months ago* (1 child)

    Here are the instructions to enable and description of how it works. Seems really complete.

    https://support.apple.com/en-us/105120

  • source
  • hideshow 1 child comment
  • [–] 40 points 9 months ago

    Stop requiring accounts just to view content.

    Fucking scumbags

  • source
  • [–] 43 points 9 months ago (10 children)

    The FBI just wants the public to think their phone is secure. I got news for you, it's not secure. Look up Snowden.

  • source
  • hideshow 10 child comments
  • [–] 21 points 9 months ago (8 children)

    Reminder that none of your data is safe on a cloud. Law enforcement can get a judge to sign off and make Google/Apple decrypt your cloud data and give it to them.

    If you really want your data private you have to put it on an encrypted hard drive. Recommend Veracrypt.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 0 points 9 months ago (5 children)

    and even then, unless you unlock it for law enforcements upon request. you will serve lifetime in imprisonment or until you agree to unlock it and whatever if any crime is within the locker to continue imprisonment. so safeguarding data really doesn't matter in the end anyway because any sensitive data kept anywhere will be used against you either by the law or by criminals. which often times seems to be one and the same.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 8 points 9 months ago

    unless you unlock it for law enforcements upon request. you will serve lifetime in imprisonment or until you agree to unlock it

    I'm like 99% sure that isn't how that works. Held in contempt of court, maybe, but lifetime imprisonment, doubt it.

  • source
  • parent
  • [–] 7 points 9 months ago (1 child)

    Clearly you are not a lawyer, not educated in law, nor do you know a single thing regarding what you are talking about, yet you felt compelled to leave a comment full of complete disinformation. Is letting people on the internet know how dumb you are a family tradition, or is this something new you are trying out for yourself?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 14 points 9 months ago (3 children)

    Dunno what this has to do with the Ginza Apple Store. The intern just used the first stock photo they could find, I guess.

  • source
  • hideshow 3 child comments
  • [–] 31 points 9 months ago (16 children)

    This is just an advertisement. There is no phone the government cannot get into if they wanted.

  • source
  • hideshow 16 child comments
  • [–] 15 points 9 months ago (6 children)

    Is this an advertisement? Sure, yes. The government can get into any phone? No.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 7 points 9 months ago (4 children)

    Virtually any phone I would say, yeah. Either by rubberhose cryptanalysis or by sheer time, money, and tools, they most likely can.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 8 points 9 months ago (3 children)

    So "any phone" turned into "virtually any phone", and the owner needs to be alive and apprehended, and then they "most likely" can, maybe.

    See, I mostly agree with what you said. But you can see how we have moved the goalpost away from "there is no phone the government cannot get into", to "the government can get into most phones", which is quite a different statement.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 8 points 9 months ago* (2 children)

    I am not moving goalposts or making different statements, I'm not the user you were replying to.

    I also mostly agree with you, but my angle is that the difference between "the government can get into virtually any phone" and "the government can get into most phones" is that the latter makes it seem like you can be "smart/knowledgeable enough" to avoid that, and that's untrue. You should assume everything you keep on your phone can be extracted because of the nature of smartphone manufacturers, the supply chain etc, but I do not believe no phone can't be broken into like OP was saying, thus "virtually any phone" seems fitting.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 9 months ago (1 child)

    I get what you are saying but I'm seeing this from a different perspective.

    The first statement is saying "there is nothing you can do". You shouldn't care about your privacy, you shouldn't try to be careful, you shouldn't fight for yourself. The government is all powerful and you should accept your fate. That's why I don't like these sweeping absolute statements. They promote giving up.

    The other is "this is hard, but it's possible to win". And sure, you probably won't win if the government is specifically targeting you and sending agents with rubber hoses against you. But in all likelihood they aren't. And there are many things you can do to prevent actual passive surveillance affecting you.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 6 points 9 months ago (7 children)

    Big claims require big proof. But I bet all you have is a hunch.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 7 points 9 months ago* (3 children)

    The big claim is that they couldn't get into the reporter's iPhone. You are right to demand proof before believing something so obviously made up.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 5 points 9 months ago (2 children)

    Unless there's an incredible amount of people "not in" on some universal secret, maths gonna maths, and physics gonna physics. Actual encryption works well in a proven way, computational power isn't as infinite as some people think, and decent software implementations exists.

    Getting hold of anything properly encrypted with no access to the key still requires an incredible amount of computing power to brute force. Weak/bad implementations can leave enough info back to speed this up, malicious software can make use of an extra, undocumented encryption key, etc. but a decent implementation would not be easy to break in.

    Now, this does not say anything about what Apple actually do. They claim to have proper encryption, but with anything closed source, you only have your belief to back you up. But it's not an extraordinary claim to say that this can be done competently. And Apple would have a good incentive in doing so: good PR, and no real downside for them since people happily unlock their phone to keep their software running and doing whatever it wants locally.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 9 months ago* (2 children)

    Big claims require big proof. But I bet all you have is a hunch.

    I work alongside law enforcement. Part of my job involves helping detectives follow the instructions Apple/Google provide to them for downloading and unencrypting people's phone data once a judge has given permission for them to request it from Apple/Google.

    Now, I'm not familiar with "Lockdown Mode". Maybe that uses separate encryption to encrypt data stored on your phone that ISN'T cloud synced data. But even then, if that Lockdown Mode is software created by the manufacturer, then they could have the decryption algorithm to decrypt it and I wouldn't trust it. I would only trust open-source encryption software, like Veracrypt.

    Bottom line is I'm here to guarantee you that if the data is synced with a cloud, which most people's phone data is, it absolutely can be obtained by law enforcement.

    Not that it's particularly relevant, but typically when law enforcement get into the data, it's usually because they have reasonable suspicion and it's usually kiddie porn or chat logs proving they were trying to meet up with underage individuals. And I'm here to tell you that shit is way more prevalent than I think most people realize.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 10 points 9 months ago (5 children)

    I tried GrapheneOS on my Pixel, and it's pretty cool, but unfortunately I want my phone to have full functionality. I'll sacrifice some privacy and just practice digital minimalism, which ultimately is the best form of privacy.

  • source
  • hideshow 5 child comments
  • [–] 10 points 9 months ago (4 children)
  • [–] 4 points 9 months ago (3 children)

    I just got tired of everything being a hack. I simply need my phone to work and I also see a bit of irony installing play services just to receive proper notifications. I know I know the whole app sandboxing bit. But still, it seems counterintuitive I don't have to worry if my phone's going to let me down if I'm driving a need to download some obscure parking app or if I need tap to pay to function which in the United States I do. One time I was at Costco, renewing my membership, they needed me to download the app real quick to do something on the account. But because the app wouldn't function right, my wife had to do it.

    I needed to buy some ribs the other day, but I forgot my wallet. If I had tapped to pay on my phone, that wouldn't have been an issue.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 0 points 9 months ago

    You don't NEED tap to pay. I literally never use it, ever, unless I have a card with a bad chip (happened once).

    Forgetting your wallet like a dummy doesn't mean you NEED tap to pay, it means you need to remember to bring your wallet.

    Also, there is nothing you NEED the Costco app for, an org like that can't lock things behind an app to function because their customer base is too broad, they will inevitably have old people with T9 Nokia bricks still. It might have been the most convenient way to achieve it, but it's not a requirement - even if that particular sales associate didn't know how and would have to phone a friend.

    All that to say I'm not trying to convince you to use gOS; I fully recognize that security is on one end of the spectrum from convenience, and we all choose where we want to be on that spectrum. But I felt the need to counter your claims.... Nobody NEEDS tap to pay smh. If you care about privacy at all you wouldn't be linking cards to apple or Google, adding yet another layer of giant data collection to some of your most intimate data.

  • source
  • parent
  • [–] 14 points 9 months ago* (last edited 9 months ago)

    they’ll just pay israelis (cellbrite) to crack it

  • source
  • load more comments
    view more: next ›
    74 comments in c/privacy@lemmy.dbzer0.com view that post
    9 comments in c/privacy@programming.dev view that post
    2 comments in c/pulse_of_truth@infosec.pub view that post
    2 comments in c/apple_enthusiast@lemmy.world view that post