Apple's Lockdown Mode blocked FBI forensic teams from accessing a Washington Post reporter's iPhone earlier this year, court records show. The January raid targeted journalist Hannah Natanson as part of a classified information leak investigation.
The FBI's Computer Analysis Response Team (CART) attempted to extract data from Natanson's iPhone 13 but failed.
Agents found the phone powered on and charging with its display showing Lockdown Mode active.
Apple introduced Lockdown Mode in 2022 with iOS 16 as "extreme protection" against sophisticated cyber attacks. The feature targets journalists, government officials, and others facing mercenary spyware threats. It works across iPhones, iPads, Macs, and Apple Watches running compatible software.
When enabled, Lockdown Mode severely restricts device functionality. Most message attachments and link previews are blocked in iMessage. FaceTime calls from unknown contacts are filtered, with calls limited to recent contacts within 30 days.
Web browsing experiences degrade significantly. Safari blocks complex web technologies, causing some websites to load slowly or not at all.
The feature also prevents device connections to accessories or computers unless the iPhone is unlocked. This hardware restriction proved critical against FBI forensic tools.
As digital forensics experts note, "many advanced forensic techniques and law enforcement tools rely on vulnerabilities that Lockdown Mode explicitly blocks or limits." Commercial tools like GrayKey and Cellebrite require physical connections that Lockdown Mode prevents.
The FBI had more success with other seized devices. Agents compelled Natanson to unlock a Washington Post-owned MacBook Pro using her fingerprint during the January 14 raid. A 2024 federal appeals court ruling allows police to force biometric unlocks but not password disclosure.
Natanson's personal MacBook Pro remained protected by password encryption. The FBI extracted only telephone number data from the iPhone's SIM card through automated tools, court documents reveal.
Apple describes Lockdown Mode as "optional, extreme protection" for "the very few individuals who might be personally targeted by some of the most sophisticated digital threats." The company warns that "your device won't function like it typically does" when the feature is active.
Beyond blocking forensic access, Lockdown Mode protects against mercenary spyware like NSO Group's Pegasus. Citizen Lab documented in 2022 how the feature successfully stopped an attempted hack on a human rights defender's iPhone.
To enable Lockdown Mode, users need iOS 16 or later, iPadOS 16 or later, watchOS 10 or later, or macOS Ventura or later. On iPhone, navigate to Settings > Privacy & Security > Lockdown Mode > Turn On Lockdown Mode. The device will restart after confirmation.
Each Apple device requires separate Lockdown Mode activation, though enabling it on an iPhone automatically activates it on a paired Apple Watch. Users should back up devices before enabling the feature due to its restrictive nature.
The Natanson case highlights growing tensions between device encryption and law enforcement access. While the FBI paused extraction efforts due to a court standstill order, the incident demonstrates Lockdown Mode's real-world effectiveness against government forensic capabilities.
For high-risk individuals, Lockdown Mode provides an additional layer beyond Apple's Advanced Data Protection, which encrypts iCloud backups. The feature's tradeoffs, reduced functionality for enhanced security, proved sufficient to block FBI forensic teams for at least two weeks following the January raid.
