What’s Happening with Law Enforcement?
Documents obtained by 404 media reveal that American law enforcement officers have noticed a peculiar behavior in several seized iPhones. These devices, securely stored for investigative purposes, have been spontaneously restarting, which complicates the unlocking process.
It seems that devices running iOS 18 are more prone to this behavior, especially if they have been disconnected from their mobile network for an extended period of time.
It is believed that iPhones with iOS 18.0 brought into the lab, under certain conditions, were communicating with other iPhones stored in the vault. This communication triggered a signal causing the devices to restart after a certain amount of time had passed since the last device activity or network connection
, according to a police report.
For law enforcement, this can be highly detrimental when trying to extract digital evidence from devices. Although Apple still refuses (a stance unchanged since the San Bernardino case) to unlock recovered iPhones, except under court order, it remains very challenging to bypass iPhone security (FaceID, TouchID, or passcode) although it can still be forced with specific tools, including those from Cellebrite.
Enhanced Protection
As a reminder, iOS 17 introduced enhanced protection for the iPhone, particularly concerning data security in case the device was stolen and someone obtained the device’s passcode. When the stolen device protection is enabled, authentication via Face ID or Touch ID is mandatory in addition to the passcode for certain actions.
This includes displaying passwords or access keys stored in the iCloud keychain, requesting a new Apple Card, deactivating lost mode, erasing all content and settings, or using payment methods stored in Safari.
Moreover, Apple has added an extra layer of security for particularly sensitive actions, such as changing the password of the Apple ID associated with the iPhone. In this case, one must wait a security delay. Practically, the user will need to authenticate with Face ID (or Touch ID), wait an hour, and authenticate again with Face ID (Touch ID).
The registration function can be found in the Settings app > Face ID & Code > Protection for Stolen Device. Apple has stated that it plans to release additional documentation over time about the protection of stolen devices to clarify how the feature works. The option will be available on all iPhone models compatible with iOS 17, including iPhone XS and later models.