Exploits, Tools & Data Recovery · Passcode Bypass & the Unlocking Industry · Lesson 3 of 5

Apple vs FBI & the Law

Follow the 2016 San Bernardino fight and how US courts treat forced unlocking.

The San Bernardino iPhone

On December 2, 2015, two attackers killed 14 people in San Bernardino, California. One of them, Syed Rizwan Farook, left behind an iPhone 5c issued by his employer, the county. It was locked with a passcode, and the FBI said it couldn't get in without risking the data.

Recall from iOS Internals that wrong guesses bring growing delays, and that the optional Erase Data setting wipes the phone after 10 wrong tries. The FBI didn't know whether Erase Data was on.

On February 16, 2016, at the Justice Department's request, federal Magistrate Judge Sheri Pym ordered Apple to provide "reasonable technical assistance". The order relied on the All Writs Act, a law from 1789 that lets federal courts issue orders needed to carry out their work. In plain terms, it asked Apple to create special software for this one phone that would switch off the auto-erase, remove the delays added by software, and let the FBI enter guesses electronically instead of by hand.

Apple refused and challenged the order. In a public letter, CEO Tim Cook argued that building such a tool would create a backdoor that could be used again and could put every iPhone user at risk. The Justice Department argued the request was narrow, aimed at one phone in a terrorism investigation.

The fight never reached a ruling. The day before a March 22 hearing, the government asked for a delay, saying an outside party had shown it a possible way in. On March 28 it told the court it had "successfully accessed the data" and no longer needed Apple's help. Many early reports guessed that Cellebrite was the helper. In 2021 The Washington Post reported that it was actually a small Australian firm, Azimuth Security, that the FBI paid $900,000, and that the phone held little of use.

Because the government withdrew, no appeals court decided whether the All Writs Act could force a company to build such a tool. The question is still open.

Warrants, fingers and passcodes

Behind the San Bernardino case sits a long-running argument often called the encryption debate. Here are both sides in their strongest form.

• Law enforcement officials argue that strong encryption can put evidence out of reach even when a judge has approved a search. FBI leaders have called this "going dark". They ask for a lawful way in, often called exceptional access.
• Many security experts, privacy groups and tech companies argue that no one knows how to build a door only the good guys can open. A key or tool kept for police could leak, be stolen or be demanded by other governments, weakening security for everyone.

Reasonable people weigh these differently. Notice that today's commercial unlocking tools grew partly out of this stalemate. Instead of a built-in door, agencies buy access that relies on vulnerabilities.

In the US, the starting point is the Fourth Amendment. In Riley v. California (2014) the Supreme Court held that police generally need a warrant to search the data on a phone taken during an arrest. A warrant gives permission to search. It doesn't make the phone open.

Can a person be forced to unlock their own phone? The Fifth Amendment protects people from being compelled to testify against themselves, and courts disagree about how it applies:

• Biometrics. In 2024 a federal appeals court (the Ninth Circuit, in United States v. Payne) held that forcing a suspect's thumb onto a phone wasn't testimony. In January 2025 another (the D.C. Circuit, in United States v. Brown) held that, on the facts of its case, a forced thumbprint unlock was testimonial and protected.
• Passcodes. A passcode is something you know, so revealing it looks more like testimony. Even so, state courts have split. Pennsylvania's top court refused to force disclosure in 2019, while New Jersey's allowed it in 2020, reasoning that what it would reveal was already known to the state.

The Supreme Court hasn't settled either question. Other countries have their own rules, and none of this is legal advice.