A purportedly new iOS 18 security feature reboots iPhones that haven’t been unlocked in a few days, aggravating authorities by making it more difficult to break into suspects’ iPhones.
According to Matthew Green, a cryptographer and Johns Hopkins scholar, the law enforcement officers’ premise concerning iOS 18 devices is “deeply suspect,” but he appreciates the concept.
“The idea that phones should reboot periodically after an extended period with no network is absolutely brilliant and I’m amazed if indeed Apple did it on purpose,” he told me.
In a follow-up story, security specialists confirmed that law enforcement officers were alerting one another to the fact that phones being held for forensic analysis appeared to be restarting themselves, as earlier reported by 404 Media.
Those phones are more difficult for password-cracking software to unlock after a reset.
After First Unlock, or AFU, is a device state in which the owner has used Face ID or a passcode to unlock their device at least once since turning it on.
With the use of iPhone unlocking technologies from businesses like Cellebrite, law enforcement may more easily access a device in AFU mode. It seems that restarting complicates the procedure.
“The purpose of this notice is to spread awareness of a situation involving iPhones, which is causing iPhone devices to reboot in a short amount of time (observations are possibly within 24 hours) when removed from a cellular network.
“If the iPhone was in an After First Unlock (AFU) state, the device returns to a Before First Unlock (BFU) state after the reboot.
“This can be very detrimental to the acquisition of digital evidence from devices that are not supported in any state outside of AFU,” the police wrote in the report.
When restarted, both iOS and Android devices enter the “Before First Unlock” (BFU) state, requiring you to enter your passcode or PIN to unlock your phone.
This limits the data that forensics experts can extract, according to a blog post from Dakota State University’s digital forensics lab.
