Apple is locking out thieves, cops from stolen/seized iPhones that are lying unused

Law enforcement officials, facing additional hurdles in accessing data from iPhones they have seized are unhappy. But security experts believe the real risk comes from thieves, and have highlighted how the new feature prevents criminals from keeping a stolen iPhone operational for months

featured-image

Apple has thrown a curveball into the tech-security landscape with a subtle yet impactful feature in iOS 18.1, and it’s causing quite the stir among law enforcement. The latest update introduces an “inactivity reboot” mechanism that significantly bolsters iPhone security, according to several experts in the field.

This new feature triggers iPhones to automatically reboot if left unlocked for a long enough period, resetting them to a more secure state. As a result, law enforcement officials trying to break into devices stored for examination have found themselves unexpectedly locked out. The development was first reported by 404 Media which revealed that law enforcement agencies were left scratching their heads, with iPhones seemingly rebooting on their own.



The mystery, however, is gradually unravelling. Dr Jiska Classen from the Hasso Plattner Institute confirmed the existence of the “inactivity reboot” function. Screenshots shared by 404 Media showcased snippets of the relevant iOS code, highlighting how the timer operates.

Meanwhile, a forensic specialist from Magnet Forensics, Christopher Vance, detailed the timer’s workings in a closed chat group for law enforcement and forensic experts. According to Vance, the timer kicks in when a device remains in an “AFU” state—short for After First Unlock, meaning the phone has been unlocked at least once but is locked again. The device then reboots to a more secure “BFU” state, or Before First Unlock, which is much tougher for forensic tools to crack.

The kicker? The reboot isn’t triggered by network connectivity or charging, just inactivity. Vance, whose insights were shared anonymously by a source within the closed chat group, emphasised the urgency for officials to act fast. He warned peers to extract data from iPhones in the AFU state as quickly as possible to avoid data loss.

After four days of inactivity, a locked iPhone will reboot itself. This update marks yet another chapter in the ongoing tug-of-war between tech giants like Apple, who prioritise user privacy, and law enforcement agencies seeking access to data on seized devices. Initially, police speculated that their issues stemmed from seized phones not being connected to a cellular network or, even wilder, that an iOS 18 device could somehow signal others nearby to reboot.

However, experts have since dismissed these theories, pointing to the passage of time as the culprit. Security expert are defending Apple’s move. They argue that the real risk comes from thieves, not law enforcement, and have highlighted how the new feature prevents criminals from keeping a stolen iPhone operational for months while trying to crack it.

While rebooting might seem inconvenient, it’s a small price to pay for greater protection. Of course, not everyone is celebrating. Law enforcement officials, who now face additional hurdles in accessing data, may see things differently.

As Vance stressed, the clock is ticking for extracting information, making it crucial for officials to adjust to these new security measures. Apple’s latest update, it seems, is a strong statement in the ongoing debate over privacy versus data access, one that could reshape the future of digital security..