FBI forces Apple iPhone X owner to unlock device through Face ID
US law enforcement has forced an Apple iPhone X user to unlock their device with their face as part of an investigation.
Security
While law enforcement in the US can force a suspect to unlock their Apple device via Touch ID, this is believed to be the first recorded incident in which law enforcement in any country has used a search warrant to force a mobile device owner to bypass the facial recognition technology.
A Forbes investigation revealed that on August 10, a 28-year old's home was searched by the US Federal Bureau of Investigation (FBI) on the grounds of a case into potential child abuse.
Law enforcement, search warrant in hand, then demanded that the man unlock his iPhone X which was protected by Face ID. The individual complied, which gave the FBI access to his media, communications, and more.
An affidavit for the search warrant permitted officers to search "any and all notes, documents, records, or correspondence in any format or medium (including, but not limited to, letters, emails, chat logs, electronic messages, other digital files, and web cache information)."
The chat app Kik Messenger provided evidence for the FBI. The individual had unknowingly communicated with an undercover officer over the app who was posing as a father interested in sex with minors.
CNET: Ex-NSA employee gets 5 years in prison for taking home top secret files
The 28-year-old was later charged with receiving and possessing child pornography. However, the use of Face ID did not give law enforcement unfettered access to data stored on the device.
As the FBI did not know the man's passcode, only some information could be accessed and transferred by way of forensic technologies.
There was a time limit of one hour, too, before the phone relocked and this hampered the investigation. Officers involved in the case were able to take pictures to obtain some evidence but -- originally -- could not pull out app use or deleted files.
Court documents obtained by the publication suggest that the limitations of Face ID were walls that officers then attempted to break.
See also: Man who hacked jail systems to free associate sent behind bars
According to these documents, both the Columbus Police Department and the Ohio Bureau of Investigation had access to "technological devices that are capable of obtaining forensic extractions from locked iPhones without the passcode."
This vague statement presumably refers to Cellebrite or Grayshift, two companies that are known to provide law enforcement mobile device unlocking services.
See also: Mobile hacking firm Cellebrite confirms server breach
A lawyer for the accused told Forbes that Cellebrite tools were used in a bid to extract data from the iPhone X, but these efforts have so far been unsuccessful.
The lawyer added, however, that the FBI has turned to "boilerplate language" in warrants to permit access to iPhones through facial recognition technologies.
TechRepublic: iPhone XS: A cheat sheet for professionals
Forcing suspects to provide a fingerprint to unlock TouchID has been used for some time, even on corpses. It seems that Face ID has now followed suit, but suspects cannot be made to disclose passcodes, which remains a problem.
The FBI claims that "thousands" of encrypted devices are hampering investigations, but the agency has previously declined to say how many investigations are being scuppered or provide any evidence to back up these claims.
Last month, the FBI warned companies in the US that the number of Remote Desktop Protocol (RDP) endpoints exposed online is rising, leaving corporate servers potentially open to attack.