In a striking demonstration of modern smartphone security, Apple’s Lockdown Mode successfully blocked the FBI from extracting data from a seized iPhone belonging to Washington Post reporter Hannah Natanson. The incident, detailed in recent court filings, underscores the growing strength of on-device privacy protections—even against federal law enforcement tools.
The events unfolded on January 14, 2026, when FBI agents executed a search warrant at Natanson’s home in Virginia. The raid was part of an ongoing investigation into a Pentagon contractor, Aurelio Perez-Lugones, accused of unlawfully retaining and transmitting classified national defense information. Agents confiscated several electronic devices from the residence, including an iPhone 13, a silver MacBook Pro (work laptop), another MacBook, a voice recorder, a portable hard drive, and other items.
According to a court declaration from FBI Assistant Director Roman Rozhavsky, the iPhone was discovered powered on, charging on a stand, with its screen clearly displaying that it was in Lockdown Mode. The FBI’s Computer Analysis Response Team (CART)—the bureau’s specialized unit for forensic device examinations—attempted to extract data from the phone but was unable to do so. The filing explicitly states: “Because the iPhone was in Lockdown mode, CART could not extract that device.”
In contrast, agents were able to access Natanson’s work MacBook Pro. Although Natanson initially stated she did not use biometrics on her devices, the search warrant authorized the use of her fingerprints or facial recognition to unlock them. Agents had her place her right index finger on the MacBook’s Touch ID sensor, which immediately unlocked the laptop. Some data was obtained from this device, as well as limited information from other sources like Signal messages on a contractor’s phone.
Lockdown Mode, introduced by Apple with iOS 16 in 2022 and refined in subsequent updates, is an optional, high-security setting designed for users who face serious threats from sophisticated cyberattacks, such as state-sponsored spyware (e.g., Pegasus) or nation-state actors. It is not intended for average users, as it intentionally disables or restricts many features to eliminate potential exploit pathways:
- Most message attachments are blocked.
- Just-in-Time (JIT) compilation is disabled in Safari, reducing risks from web-based exploits.
- Wired USB accessories are restricted when the device is locked.
- Certain incoming invitations, configurations, and network protocols are limited.
- Other attack surfaces, like link previews and complex configurations, are curtailed.
Apple has described Lockdown Mode as providing “extreme” protection, and the company has offered substantial bug bounties (up to $2 million initially) for any vulnerabilities discovered that could bypass it. While it can slow performance in some areas and break compatibility with certain apps or websites, it has proven remarkably effective against forensic extraction tools commonly used by law enforcement.
This case revives echoes of past Apple-FBI clashes, such as the 2015-2016 San Bernardino shooting investigation, where Apple resisted government demands to create a backdoor into an iPhone. Here, no such order was needed or issued—the protection was already enabled by the user. Privacy advocates and digital security experts have hailed the outcome as validation of strong, user-controlled encryption and hardened software modes.
The seized devices, including the locked iPhone, remain subject to a court standstill order requested by Natanson and The Washington Post, halting further FBI access attempts while legal challenges proceed. The incident highlights a key tension in the digital age: the balance between investigative powers and individual privacy rights, especially for journalists who handle sensitive sources and information.
For those at elevated risk—journalists, activists, dissidents, or public figures—Apple recommends considering Lockdown Mode, accessible via Settings > Privacy & Security > Lockdown Mode on compatible iPhones (running iOS 16 or later). However, users should weigh the trade-offs in usability before enabling it.
About The Author
