{"id":63708,"date":"2026-02-04T23:57:17","date_gmt":"2026-02-04T22:57:17","guid":{"rendered":"https:\/\/www.apfelpatient.de\/?p=63708"},"modified":"2026-02-05T00:00:16","modified_gmt":"2026-02-04T23:00:16","slug":"fbi-blocking-mode-fails-on-reporters-iphone","status":"publish","type":"post","link":"https:\/\/www.apfelpatient.de\/en\/news\/blockierungsmodus-fbi-scheitert-am-iphone-einer-reporterin","title":{"rendered":"Lockdown Mode: FBI fails to crack a reporter's iPhone"},"content":{"rendered":"

Apple's Lockdown Mode is actually intended for extreme exceptional cases. It's aimed at people who are specifically threatened by sophisticated digital attacks. A recent case from the US now demonstrates very concretely what this function can do. Even the FBI couldn't access the data on a seized iPhone because Lockdown Mode was active.<\/strong><\/p>\n\n\n\n

The incident involves a Washington Post journalist and an ongoing investigation into potential leaks of classified information. It connects several sensitive issues: press freedom, government investigations, digital forensics, and the question of how much control governments should have over personal devices. At the same time, the case provides a rare real-world example of how Apple's security mechanisms actually work beyond marketing claims.<\/p>\n\n\n\n

Search of the apartment of a Washington Post reporter<\/h4>\n\n\n\n

As reported by the online news outlet 404 Media<\/a>, the Federal Bureau of Investigation searched the home of Washington Post reporter Hannah Natanson earlier this year. The search was part of an investigation into alleged leaks of confidential or classified information.<\/p>\n\n\n\n

Hannah Natanson works for the Washington Post. According to her author profile<\/a>, she has reported on Donald Trump's reshuffling of the US federal government and its consequences. She was also part of a reporting team that won the 2022 Pulitzer Prize for Public Service for its coverage of the storming of the US Capitol on January 6.<\/p>\n\n\n\n

Seized devices<\/h4>\n\n\n\n

During the search in January, FBI agents seized several electronic devices from Natanson's apartment. These included a MacBook Pro and an iPhone 13. Such measures are not unusual in investigations of this kind, as digital devices are considered potential sources of communication data, documents, or metadata.<\/p>\n\n\n\n

FBI fails with iPhone<\/h4>\n\n\n\n

Of particular relevance is what happened after the seizure. The FBI's Computer Analysis Response Team (CART), a special unit for the forensic analysis of digital devices, attempted to extract data from the iPhone. According to court documents, however, this attempt was unsuccessful.<\/p>\n\n\n\n

The reason:<\/strong> The iPhone was in Lockdown Mode. The documents explicitly state that CART was unable to extract any data from the device due to this mode. The corresponding document was written by the US government and argues against the return of the seized devices.<\/p>\n\n\n\n

Timeline according to court records<\/h4>\n\n\n\n

The court document<\/a> mentioning the Lockdown Mode was filed on January 30th. This was about two weeks after the search of Natanson's apartment. It can therefore be inferred that the FBI did not have access to the iPhone's data during this period.<\/p>\n\n\n\n

In practice, this means that<\/strong> up until the report was submitted, the FBI had not been able to unlock the device or secure any data. Whether access was subsequently gained is not publicly known and cannot be determined based on the available information.<\/p>\n\n\n\n

What Lockdown Mode actually is<\/h4>\n\n\n\n

Lockdown Mode is a security feature from Apple that was introduced with iOS 16 and later versions. It is also available on iPadOS 16, watchOS 10, and macOS Ventura or later.<\/p>\n\n\n\n

Apple describes<\/a> Lockdown Mode as an optional, particularly stringent security measure. It is intended for a very small group of people who, due to their work or personal circumstances, could be specifically targeted by sophisticated digital attacks. According to Apple, this mode is unnecessary for most users.<\/p>\n\n\n\n

Technical limitations in Lockdown Mode<\/h4>\n\n\n\n

When Lockdown Mode is activated, the device no longer behaves as usual. To minimize potential attack vectors, numerous functions are restricted or completely disabled. These include, among others:<\/p>\n\n\n\n