The mysterious automatic restarts of the iPhone, a new headache for the police

In the United States, police officers suspect Apple of having implemented a new mechanism to make it even more difficult to search iPhones. After a period of time without a network connection, smartphones restart on their own, adding a layer of difficulty to breaking into the device and retrieving the data needed for an investigation.

Several groups specializing in the analysis of mobile devices as part of legal investigations have reported a very curious story to the site 404media. Of the iPhone sous iOS 18stored in a secure location to be unlocked and then searched, restarted on their own after a prolonged period without access to the cellular network.

A new secret weapon for iPhones?

This is a problem for investigators, because after a restart, an iPhone switches to BFU (“before first unlock”) mode, where data is particularly well protected. The tools for deciphering the unlocking code (like Cellebrite boxes) are then almost impossible to “crack” the smartphone.

In BFU mode, iOS limits access to sensitive data and encryption keys that unlock only after user authentication. Technical devices used by law enforcement cannot bypass this advanced security mode without the access code, making unlock attempts ineffective.

This is why law enforcement makes sure to have iPhones on hand that have already been unlocked at least once (in AFU mode, “after first unlock”). It will certainly be necessary to use brute force to penetrate the smartphone, but at least this solution remains available. Which is obviously much more difficult in BFU mode…

According to the document (from the Detroit police) which is currently circulating among law enforcement agencies in the United States, one of the hypotheses is that Apple has implemented a new security function in iOS 18. The system exploitation would order nearby iPhones to restart if they have been disconnected from a cellular network for a certain amount of time. The smartphone would therefore have to be on the one hand far from network access, and on the other hand in the presence of other smartphones.

Oddly, this restart procedure would have occurred on iPhones placed in airplane mode, and even a smartphone stored in a Faraday box which nevertheless blocks all electronic signals! This story is therefore very intriguing, but the note does exist. Apple has not commented on the matter. However, the manufacturer works closely with the police to present its security solutions. It is therefore surprising that he did not warn anyone of the (hypothetical) existence of such a function.