Federal investigators have so far failed to retrieve data from a Washington Post reporter’s iPhone after discovering the device was protected by Apple’s Lockdown Mode, a security feature designed to defend against sophisticated cyber threats. The development was disclosed in a recent US government court filing connected to an ongoing investigation into an alleged leak of classified information.
The iPhone, owned by the Washington Post and used by reporter Hannah Natanson, was seized during an FBI search of her Virginia home on January 14. According to documents submitted in the US District Court for the Eastern District of Virginia, agents found the phone powered on and charging, with Lockdown Mode activated on the screen.
After transporting the device to the FBI’s Washington field office, specialists from the bureau’s Computer Analysis Response Team attempted to extract its contents. Their efforts were unsuccessful because of the enhanced protections imposed by Lockdown Mode. Investigators were only able to pull limited information from the SIM card, specifically the associated phone number. Further attempts to access the phone’s data have been suspended following a court-issued standstill order that temporarily restricts examination of the seized devices.
FBI Gains Partial Access to Work Laptop
Although the iPhone resisted forensic access, agents managed to unlock Natanson’s work-issued MacBook Pro during the search. Court filings state that agents informed the reporter they could not require her to reveal passwords, but the search warrant permitted them to use biometric methods, such as fingerprint authentication, to open her devices.
Natanson initially indicated that her devices did not use biometric security. However, when asked to attempt unlocking the laptop, agents assisted her in placing her finger on the fingerprint sensor. The device unlocked immediately, allowing investigators to perform a limited partial imaging of its data.
Some Signal messages were visible on the laptop. Because certain chats were configured to automatically delete after a set period, agents photographed and audio-recorded the visible conversations to preserve potential evidence. According to the government filing, these preservation steps were taken without conducting a detailed review of the content.
Natanson’s personal MacBook Pro, which was powered off and protected by encryption and a password, has not been accessed. In addition to the laptops and phone, the FBI seized a 1TB portable hard drive, a voice recorder, and a Garmin smartwatch. Data from those devices has not been reviewed due to the court’s temporary order halting further analysis.
Encrypted Signal Messages Central to Investigation
A key focus of the investigation is Natanson’s use of Signal, an encrypted messaging app widely favored by journalists and government officials for secure communication. Natanson has stated that her Signal contact list includes around 1,100 current and former government employees.
Prosecutors argue that reviewing these communications is relevant to their case against Aurelio Perez-Lugones, a Maryland-based Pentagon contractor accused of improperly removing classified intelligence materials. Court filings indicate that, before his arrest, the FBI reviewed messages exchanged between Perez-Lugones and Natanson on his device with his permission. Those communications allegedly involved discussions about document classifications and how information might appear in future reporting.
Legal Battle Over Search and Press Protections
The seizure of the reporter’s devices has sparked a legal confrontation between the Justice Department and the Washington Post. Natanson and the newspaper have petitioned the court to order the return of the equipment, arguing that the broad search threatens First Amendment protections and risks exposing confidential journalistic sources.
A federal magistrate judge has temporarily paused further examination of the devices while the court considers the request. The Justice Department opposes returning the materials, maintaining that they are relevant to an active criminal investigation and may contain classified government information.
Government lawyers argue that relying on a narrower subpoena, as suggested by the Post, could jeopardize evidence preservation, particularly given the auto-deletion features of encrypted messaging apps. Prosecutors also contend that Natanson’s statements about biometric access raised concerns about whether evidence could be adequately safeguarded.
Supporting the reporter and the newspaper, the Reporters Committee for Freedom of the Press filed a brief cautioning that the seized devices contain sensitive journalistic work unrelated to the leak investigation. The organization warned that searching through such materials could undermine the confidentiality that investigative reporting depends on.
Apple Lockdown Mode’s Role in Device Security
Apple introduced Lockdown Mode in 2022 as an optional high-security setting aimed at individuals who may face elevated risks of targeted digital attacks. The feature is available across iPhones, iPads, and Macs and must be enabled separately on each device.
When activated, Lockdown Mode significantly restricts device functionality to reduce potential security vulnerabilities. It blocks most message attachments, limits certain web technologies, prevents incoming FaceTime calls from unknown contacts, and imposes additional restrictions on sharing features. Users can designate trusted apps and websites to bypass some of these limitations.
The case highlights how advanced consumer security features can complicate digital forensic investigations, especially when courts are weighing privacy rights against law enforcement needs.
