iPhones Kept by Law Enforcement Allegedly Reboot Themselves, Locking Them Out

iPhones that have been stored for forensic examination are allegedly now rebooting themselves, making it much harder for police to get the info they need. 

The reports come from a document put together by Detroit, Michigan law enforcement officials, obtained by 404 Media.

After the mysterious reboot, the devices supposedly enter what is called the Before First Unlock (BFU) state. This makes cracking them, for example, to get data about criminal activity, much harder.

The document seen by 404 Media theorized that the iPhones rebooted in “a short amount of time” when removed from a cellular network, potentially around 24 hours.

According to the document, one of the iPhones was even in Airplane mode and one was inside what is called a Faraday box.

This is a type of container that blocks electronic signals from reaching the iPhone, stopping them from accessing telecom coverage, as well as things like Bluetooth and Wi-Fi. 

The police speculate that the mysterious reboot may have been because of “an iOS 18.0 security feature addition”.

The document also theorizes that the iPhone devices with iOS 18.0 brought into the lab, communicated with the other iPhone devices, sending a signal to the phones to reboot.

According to 404, they believe these findings could even apply to iOS 18.0 devices that the forensics team was using for personal use.

Not all experts agreed with the document’s conclusion however.

Matthew Green, an associate professor at Johns Hopkins University, said theories were “deeply suspect,”.

He told 404: “The idea that phones should reboot periodically after an extended period with no network is brilliant and I’m amazed if indeed Apple did it on purpose.” 

Apple itself has yet to comment on the news. 

However, Jiska Naehrdine an independent cybersecurity researcher, claimed that Apple did introduce an “inactivity reboot” in iOS 18.1, citing code hosted on GitHub.

She commented on the design choice: “This is a cheap & great mitigation!”

“While most people won’t have their phone forensically analyzed, many more will have their devices stolen,” she added. “It protects user data in both cases.”

The police document urged forensics specialists to isolate their recently opened—After First Unlock (AFU)—smartphones from iOS devices and to identify which of them have rebooted and may have lost their AFU states.

“The issue needs to be communicated far and wide across the forensic and investigative realms for awareness, spread the word,” the report ends.

About Will McCurdy

Contributor

I’m a reporter covering weekend news. Before joining PCMag in 2024, I picked up bylines in BBC News, The Guardian, The Times of London, The Daily Beast, Vice, Slate, Fast Company, The Evening Standard, The i, TechRadar, and Decrypt Media.

I’ve been a PC gamer since you had to install games from multiple CD-ROMs by hand. As a reporter, I’m passionate about the intersection of tech and human lives. I’ve covered everything from crypto scandals to the art world, as well as conspiracy theories, UK politics, and Russia and foreign affairs.

Read Will’s full bio

Read the latest from Will McCurdy