Apple's Lockdown Mode is just one of many ways that can keep your iPhone data secure, as the FBI has once more been finding out.
In January 2026, the FBI raided the home of Washington Post journalist Hannah Natanson, and removed devices including an iPhone. Natanson and her newspaper immediately filed a court motion that currently means the FBI isn't allowed to search those devices — but it tried.
The FBI is investigating alleged leaks of classified information to the press. There are constitutional issues over whether the FBI can raid a personal home, though, and can be apparently legally entitled to force Natanson to unlock her MacBook Pro with Touch ID.
"This extraordinary, aggressive action is deeply concerning and raises profound questions and concern around the constitutional protections for our work," the Washington Post executive editor Matt Murray told staff.
But what the court documents show is that during the time the FBI was attempting to search Natanson's devices, they could not get into her iPhone. As spotted by 404media, the FBI's filing opposing the return of Natanson's devices says that:
Because the iPhone was in Lockdown mode, CART [Computer Analysis Response Team] could not extract that device. Similarly, the personal MacBook Pro could not be imaged yet.
Lockdown Mode
Introduced in 2022, Lockdown Mode is an optional feature that Apple has said is for people facing "grave, targeted threats to their digital security." When enabled, Lockdown Mode:
- Blocks most message attachment types
- Disables technologies such as just-in-time JavaScript compilation
- Stops wired data connections
- Prevents new configuration profiles being installed
Lockdown Mode is an optional feature that must be set up.
At launch, Apple offered a $2 million bounty for any security researchers who could break it. Apple also said that it would continue to add new protections.
In this specific case, it's not clear what happened at Natanson's home. While the FBI says it couldn't image (or copy) her MacBook Pro, prior reports say that officers forced her to unlock it.
While Natanson is said to have told agents that she does not use biometric authentication, they had her use her finger on the Touch ID button and it unlocked.
With the iPhone, it would appear that Natanson does not use biometrics. Reportedly, the three warrants the FBI held included the right for them to force her to unlock with Face ID.
According to court documents, Natanson was informed at her home that "though she was not compelled to provide her passcodes, the FBI could use her biometrics to open any devices."
It's not clear at all why warrants with that exceptional permission did not also mean she was compelled to give the agents her PIN.
What Apple protects
Lockdown Mode is available to all iPhone owners, although it is not recommended for regular users. That's because Apple calls it "extreme protection" against cyberattacks, and using it means giving up some common iPhone benefits.
As well as features that seem related to security, such as blocking attachments in Messages, Lockdown Mode also disables shared photo albums. Game Center is turned off too, and "Focus and any related status will not work as expected."
But Lockdown Mode isn't Apple's only method of protecting user security. It has what it calls an "inactivity reboot," which is automatically in place for all users.
If a user does not unlock their iPhone after some unknown period of time, then since iOS 18.1 in 2024, the device will reboot itself. Law enforcement officers are not fans.
The idea is that this protects users because it means the iPhone restarts in the "before first unlock" (BFU) state. In this state the iPhone is more secure than after the user has unlocked it.
Advanced Data Protection encrypts much of an iPhone user's data
Then all iPhones — except in the UK — now also have Advanced Data Protection. This is for all users, whether or not they are under direct threat, because it secures everything from device backups to Wallet passes with encryption.
What Apple will provide law enforcement
Apple publicly maintains a 21-page, 10,000-word "Legal Process Guidelines" document that details what it will, and what it can, do when it receives a subpoena. The document, and Apple's practices, do get updated, but broadly what it says is that Apple will:
- Details of a user's iCloud account
- Access to any unencrypted data stored there
That's about it, and especially as most user data is encrypted, there is ultimately little that even Apple can retrieve.
Note, too, that this information is not handed over casually. Requests for the details must be accompanied with a subpoena or even a warrant. But in cases such as the San Bernardino shootings, Apple has provided this detail.
Alternatives to Apple
Back in 2020, the FBI was pressing Apple to unlock certain iPhones, but at the same time had itself been able to crack the encryption on the then-new iPhone 11 Pro Max. Reportedly, the bureau used the third-party GrayKey data forensics tool.
Security and user privacy are constantly at odds with one another, and each side keeps updating their technologies. By November 2024, it was reported that GrayKey was being blocked from any data by iOS 18.1.
Even as that report became public, it was likely that GrayKey had progressed. Now, some 14 months later, it's not known whether the forensic tool is still being blocked effectively.
It would seem that it is, since the FBI did not manage to unlock Natanson's iPhone. However, there's no confirmation that these agents had that tool.
What there is confirmation of is that the bureau is not willing to back down on its seizure of Natanson's devices.
"Ms. Natanson and her employer, the Washington Post, claim the Government's seizure of this evidence violated the First Amendment and that it must be returned to them," says the FBI court filing. "They are wrong."
