Apple has been in a long-running battle with law enforcement over the ease at which the latter can access evidence stored on iPhones. Apple has been steadily changing the hardware inside its phones to make accessing private user data harder, but more recently it’s began making changes to the operating system to make confiscating data harder still. The most recent change–in the company’s new iOS 12–is a big one, and could be provocative enough to bring Apple’s simmering war with law enforcement to a boil once again.
Apple first trotted out a new feature called “USB Restricted Mode” in iOS 11.4 public beta some months ago. The feature allowed the user to shut down their phone’s USB port 7 days after the last login. After seven days the USB port would become useless to law enforcement as an entry point to access encrypted data. Agents would be forced to try to find the user’s passcode, a job usually done with a “brute force” approach wherein a computer works for days and days entering possible passcodes into the phone.
Now, with iOS 12, Apple changed the name of the feature to “Disable USB Access,” and dramatically shortened the time interval to one hour, leaving law enforcement almost no time to recover a suspect’s device and hack in to the data. The new feature is now out in the iOS 12 developer beta, which is why it’s now being noticed and analyzed. The new operating system will become available to the general public next fall.
Apple may have made the change in direct response to two tools with which law enforcement has had success recovering evidence from recovered phones–Grayshift’s GrayKey device, and Cellebrite’s UFED devices. Both devices use the USB port on iPhones to gain access. There’s a good chance both devices will, in most scenarios, become useless in accessing iPhone data.
If that Cellebrite name sounds familiar, it’s because the Department of Justice used the Israeli company’s hardware to crack into the iPhone used by Syed Farook, who shot up a county building in San Bernardino, California in December 2015. Cellebrite’s device was a last resort. The DOJ spent a most of a year in court trying to force Apple to help it unlock Farook’s phone, but the company refused–loudly. The feds gave up in the end, but they’ve never forgotten it. The introduction of the new Disable USB Access mode could crank up the public shouting match once again.