Apple iPhone Lockdown Mode Prevents FBI Forensic Extraction of Seized Journalist Device
Court filings in a US leak investigation indicate the FBI was unable to forensically extract data from Washington Post reporter Hannah Natanson’s iPhone because Apple’s Lockdown Mode was enabled. The government document states the FBI’s Computer Analysis Response Team (CART) “could not extract that device,” offering a rare, real-world data point on Lockdown Mode’s effectiveness against at least some standard law-enforcement mobile forensics workflows.
The filings also describe limited recovery from the device’s SIM card via a CART tool that produced an auto-generated HTML report containing only the phone number, and note the FBI paused further extraction attempts due to a court “Standstill Order.” The search and seizure occurred amid an investigation into government contractor Aurelio Perez-Lugones, whom prosecutors believe was a source for classified information; investigators also reviewed Signal messages between Perez-Lugones and the reporter as part of the case. Apple positions Lockdown Mode (introduced in 2022 for iPhone/iPad/Mac) as a high-risk protection that reduces attack surface by restricting attachments, inbound FaceTime from unknown contacts, certain web technologies, and other features.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
Lockdown Mode prevents FBI data extraction from seized iPhone
After the seizure, the FBI was unable to extract data from the journalist's locked iPhone because Apple's Lockdown Mode was enabled. Multiple reports described the case as an example of Lockdown Mode frustrating law-enforcement forensic access.
FBI seizes Washington Post reporter's iPhone
The FBI seized a Washington Post journalist's iPhone during an investigation. The reporting identifies this seizure as the incident in which investigators later tried to access data on the device.
Apple introduces iPhone Lockdown Mode
Apple released Lockdown Mode as an optional iPhone security feature designed for people at high risk of targeted attacks, sharply restricting device functionality to reduce the attack surface. Later reporting noted the feature can also impede some forensic extraction methods against locked devices.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
3 references tracked. Mallory keeps watching after this page renders.
iPhone Lockdown Mode protects your data, even from the FBI - here's how to use it | ZDNET
zdnet.com
Open sourceiPhone Lockdown Mode Protects Washington Post Reporter - Schneier on Security
schneier.com
Open sourceFBI stymied by Apple's Lockdown Mode after seizing journalist's iPhone - Ars Technica
arstechnica.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple Says Lockdown Mode Has Blocked Mercenary Spyware Attacks
Apple said it has not observed any successful mercenary spyware compromises on devices with **Lockdown Mode** enabled, nearly four years after launching the opt-in protection for users at elevated risk of targeted surveillance. Introduced in 2022, the feature hardens iPhones and other Apple devices by disabling or restricting functions that have repeatedly been abused in spyware campaigns, particularly the remotely reachable components used in **zero-click** exploit chains. Independent findings cited by Apple support the claim. Researchers at **Amnesty International** and **Citizen Lab** said they have not seen evidence of successful infections on Lockdown Mode-enabled iPhones, and Citizen Lab documented cases in which the feature blocked **Pegasus** and **Predator** spyware attacks. Google researchers also reported at least one spyware campaign that abandoned infection attempts after detecting Lockdown Mode, while security researcher Patrick Wardle said the feature’s aggressive reduction of attack surface makes it especially effective against exploit delivery methods used by mercenary spyware operators.
Jun 29, 2026
Debate Over Mobile OS Lockdown Measures to Reduce Malware and Targeted Attacks
Discussion focused on whether stronger *platform-level restrictions* are necessary to curb mobile threats, contrasting Android’s openness with iOS’s “lockdown” approach. One thread highlights Google’s plan to require centralized **developer registration/verification** for apps installed on Android-certified devices (even if distributed outside Google Play), framed as a way to reduce malware and prevent repeat offenders from re-signing and redistributing blocked apps; it also notes Android’s recent mitigations such as **Restricted Settings** (Android 14) and **Enhanced Confirmation Mode** (Android 15) as partial technical barriers against common scam/phishing tactics. Separately, iOS **Lockdown Mode** is presented as an extreme, reversible hardening option intended for high-risk users (e.g., journalists, activists) that reduces attack surface by disabling or restricting features (e.g., most message attachments/link previews, certain web technologies, incoming FaceTime from unknowns, accessory connections while locked, non-secure Wi‑Fi, and installation of device management profiles). The article cites reporting that a seized journalist phone could not be accessed using law-enforcement forensic tooling when Lockdown Mode was enabled, underscoring how aggressive feature reduction can materially impede both targeted exploitation and post-seizure forensic access.
Jun 29, 2026
FBI Recovered Deleted Signal Messages From iPhone Notification Storage
Federal court reporting in Texas showed that the FBI recovered incoming **Signal** message content from an iPhone even after the app had been deleted and messages were set to disappear. The messages were cited as evidence in a case tied to the attack on the ICE Prairieland Detention Facility in Alvarado, where one police officer was shot; reporting identified defendant Lynette Sharp as having pleaded guilty to providing material support to terrorists. The recovered content reportedly came from iOS notification data stored on the device, not from any compromise of Signal’s end-to-end encryption. The exposure appears to stem from message previews cached by iOS when Signal notifications were displayed, allowing forensic tools used by law enforcement to extract at least some incoming message text while outgoing messages were not similarly recoverable. Privacy advocates including **EPIC** and the **EFF** called the issue a serious concern and urged users to limit notification exposure by changing Signal’s notification setting so previews show no sensitive content, such as **"No name or message"**.
Jun 29, 2026