FBI Couldn't Get Into Reporter's iPhone Because It Had Lockdown Mode Enabled
12 129The FBI has been unable to access a Washington Post reporter's seized iPhone because it was in Lockdown Mode, a sometimes overlooked feature that makes iPhones broadly more secure, according to recently filed court records. 404Media: The court record shows what devices and data the FBI was able to ultimately access, and which devices it could not, after raiding the home of the reporter, Hannah Natanson, in January as part of an investigation into leaks of classified information. It also provides rare insight into the apparent effectiveness of Lockdown Mode, or at least how effective it might be before the FBI may try other techniques to access the device.
"Because the iPhone was in Lockdown mode, CART could not extract that device," the court record reads, referring to the FBI's Computer Analysis Response Team, a unit focused on performing forensic analyses of seized devices. The document is written by the government, and is opposing the return of Natanson's devices.
The FBI raided Natanson's home as part of its investigation into government contractor Aurelio Perez-Lugones, who is charged with, among other things, retention of national defense information. The government believes Perez-Lugones was a source of Natanson's, and provided her with various pieces of classified information. While executing a search warrant for his mobile phone, investigators reviewed Signal messages between Pere-Lugones and the reporter, the Department of Justice previously said.
12 comments
Re:Bad Apple Ad (Score: 5, Informative)
by mccalli ( 323026 ) on Thursday February 05, 2026 @09:58AM (#65970298)
Because it would be unusable. Lockdown mode is pretty severe [apple.com], it's not something you want to deal with day to day.
Re:Bad Apple Ad (Score: 5, Informative)
by Pseudonymous Powers ( 4097097 ) on Thursday February 05, 2026 @10:52AM (#65970418)
From the link:
How Lockdown Mode protects your device
When Lockdown Mode is enabled, some apps and features will function differently, including:
Messages: most message attachment types are blocked, other than certain images, video and audio. Some features, such as links and link previews, will be unavailable.
Web browsing: certain complex web technologies are blocked, which may cause some websites to load more slowly or not operate correctly. In addition, web fonts may not be displayed, and images may be replaced with a missing image icon.
FaceTime: incoming FaceTime calls will be blocked unless you have previously called that person or contact within the past 30 days. Features such as SharePlay and Live Photos are unavailable.
Apple services: incoming invitations for Apple services, such as invitations to manage a home in the Home app, will be blocked unless you have previously invited that person. Focus and any related status will not work as expected. Game Center is also disabled.
Photos: when you share photos, location information will be excluded. Shared albums are removed from the Photos app, and new Shared Album invitations are blocked. You can still view these shared albums on other devices that haven’t enabled Lockdown Mode.
Device connections: to connect your iPhone or iPad to an accessory or another computer, the device needs to be unlocked. To connect your Mac laptop with Apple silicon to an accessory, your Mac needs to be unlocked and you need to provide explicit approval.
Wireless connectivity: your device won’t automatically join non-secure Wi-Fi networks and will disconnect from a non-secure Wi-Fi network when you turn on Lockdown Mode. 2G and 3G mobile support is turned off for iPhone and iPad.
Configuration profiles: configuration profiles can’t be installed, and the device can’t be enrolled in Mobile Device Management or device supervision while in Lockdown Mode.
Phone calls and plain text messages continue to work while Lockdown Mode is turned on, although incoming calls won’t ring on a paired Apple Watch. Emergency features, such as SOS emergency calls, will not be affected.
Re:Comments (Score: 5, Insightful)
by sinij ( 911942 ) on Thursday February 05, 2026 @09:31AM (#65970222)
I know you get off on stoking political division, so there is no surprise that you vomited your latest post as soon as this story dropped.
However, reasonable people a) would agree that going after journalists to uncover confidential source is not good for free speech regardless of the context, b) would agree that right against self-incrimination should not disappear just because it is "on a computer" or "on a phone".
Re: Comments (Score: 5, Informative)
by D-OveRMinD ( 1517467 ) on Thursday February 05, 2026 @12:50PM (#65970672)
Nothing you mentioned happened. It's all in your little fragmented MAGA mind. Immigration doesn't effect you directly, but in fact, made your products from oranges to houses cheaper. No one anywhere was trying to "trans" your kids. Etc. Fuck all the way off.
Re:Comments (Score: 5, Insightful)
by ArchieBunker ( 132337 ) on Thursday February 05, 2026 @02:03PM (#65970804)
All those things had zero effect on your life. What improved?
Re:Comments (Score: 5, Insightful)
by karmawarrior ( 311177 ) on Thursday February 05, 2026 @10:52AM (#65970420)
> However, reasonable people a) would agree that going after journalists to uncover confidential source is not good for free speech regardless of the context, b) would agree that right against self-incrimination should not disappear just because it is "on a computer" or "on a phone"
I must have missed the massive protests from Republicans about this then if the first part of your comment is correct. You ARE claiming Republicans do share the views you attribute to "reasonable people", correct?
Don't keep classified defense info! (Score: 5, Insightful)
by Puls4r ( 724907 ) on Thursday February 05, 2026 @09:19AM (#65970208)
Unless you're the past president.
Just one more brick in the wall of the oligarchs proving that they can live by a different set of rules.
Re:Don't keep classified defense info! (Score: 5, Insightful)
by karmawarrior ( 311177 ) on Thursday February 05, 2026 @10:54AM (#65970422)
> A former senator and vice president does not have the same authority to declassify docs as they see fir. See the difference?
No. Because a former President doesn't have any authority to declassify docs either. And the former President you're defending here did NOT cooperate with the FBI despite "being caught red handed."
totalitarians go after reporters (Score: 5, Insightful)
by oumuamua ( 6173784 ) on Thursday February 05, 2026 @09:38AM (#65970240)
More than the phone was siezed and there is a special 1980 law protecting reporters and going after ALL their sources (do you think this administration stopped with just one?)
https://www.rcfp.org/natanson-... [rcfp.org]
Initiate self-destruct sequence. (Score: 5, Insightful)
by codebase7 ( 9682010 ) on Thursday February 05, 2026 @10:07AM (#65970334)
Even if you did get the thing back, no sane person who actually cares about OpSec would use it. It's compromised. Even if they couldn't access the data, there's no telling what else they did succeed in doing to it. Hell, attempting to use it might allow them to finally access that data, complete with automatic transmission to their analysts.
Lockdown mode is better than nothing, but in reality the best option would be automatic, instant, and silent destruction of any data that the adversary might want to get their hands on. After all, adversaries rarely allow you to get the device back anyway. (And there's typically a ploy at work for them if they do.)
Re: Initiate self-destruct sequence. (Score: 5, Interesting)
by OrangeTide ( 124937 ) on Thursday February 05, 2026 @10:45AM (#65970406)
It's tough to initiate that when you're not certain when a device will fall into the wrong hangs. A lock down plus time out for self erase might be a reasonable compromise.
My old friend used to put a hundreds of fake URLs that he monitored as a canary or trip wire (I forgot what he called it). The longish path to a fake file was unlikely to be found accidentally, but if someone access his device and attempted to access the links that would inadvertently alert him. This can be helpful for detecting a remote attack, or knowing when an agency successfully unlocked a device. With the intention that he'd get a lawyer to go after any improper procedure to reach an acquittal
Doesn't matter anyway (Score: 5, Insightful)
by fahrbot-bot ( 874524 ) on Thursday February 05, 2026 @04:07PM (#65971128)
Raiding the Washington Post reporter's home and seizing things is more about harassment and intimidation than the investigation into the government contractor Aurelio Perez-Lugone. The reporter isn't listed in the criminal complaint against the contractor and the raid on her was requested by the Pentagon. This sort of thing hasn't happened before in a situation like this.
FBI searches reporter's home, raising concerns about intimidation of free press [pbs.org]
So the criminal complaint against this contractor does not mention any ties to The Washington Post reporter, yet the attorney general, Pam Bondi,on X said that the search was requested by the Pentagon "at the home of a Washington Post journalist, who was obtaining and reporting classified and illegally leaked information from a Pentagon contractor."
One, it is notable that the attorney general is pointing out that the Department of Justice has a suspect in custody and in fact has charged that suspect. And so it raises the question as to why the Justice Department and the FBI would take the extraordinary step of executing a search warrant at the home of a reporter and seizing her electronic devices.
The other point that I would make here is that this is actually something that we haven't seen before. Again, we're talking about the FBI raiding the home of a journalist in a national security leak case. At the Reporters Committee for Freedom of the Press, where I work, we track these cases closely.
We are not aware of another case where the Justice Department has executed a search warrant in a national security leak case against a journalist or against a news outlet. It's unprecedented.