Cops suspect iOS 18 iPhones are communicating to force reboots

Original Article ↗ Hacker News Discussion ↗

Law enforcement agencies claim that iPhones running iOS 18 are somehow communicating with each other to trigger reboots when kept offline, allegedly thwarting forensic extraction while devices are in a locked-but-powered (“After First Unlock”) state. Commenters overwhelmingly consider this technically implausible and instead attribute the behavior to bugs, watchdog timers, or a newly introduced security feature that forces a reboot after long periods without unlock or network access, similar to options already present in Android and GrapheneOS. The episode is framed as another round in the ongoing cat-and-mouse game between device makers hardening encryption and investigators seeking reliable ways to access seized phones.

Main Law-Enforcement Claim

  • Some forensic labs report that iPhones on iOS 18, kept locked and offline (including in airplane mode and Faraday enclosures), unexpectedly reboot.
  • A hypothesis from those labs: iPhones “communicate” with nearby iPhones and coordinate reboots after extended offline periods to frustrate extractions in the AFU (“After First Unlock”) state.

Community Skepticism

  • Many commenters consider the “phones talking to each other to force reboots” theory technically implausible and “chain-email”‑level speculation.
  • Core objection: a timer or watchdog can trigger reboots locally; there’s no need for peer coordination.
  • The Faraday-box scenario especially undermines the idea of RF-based inter-device signaling, aside from edge cases where cages are imperfect.

Alternative Technical Explanations

  • Common suggestions:
    • A bug or memory leak in iOS 18, possibly in the baseband / 5G or Find My stack, exposed by long periods without network.
    • A watchdog timer that reboots when radios or connectivity appear “stuck.”
    • Log or cache growth while repeatedly failing to connect, eventually crashing something critical.
  • iOS 18.1 release notes mention fixing “unexpected restarts” on iPhone 16 models, which many see as strong evidence for “bug, not secret feature.”

Possible Security Feature

  • Others argue an intentional “auto-reboot after inactivity” is plausible and desirable, similar to GrapheneOS’s feature that reboots after X hours without unlock.
  • A linked analysis suggests iOS 18.1 introduces something like “reboot after 96 hours of no unlock,” apparently tied to time-since-last-unlock rather than network status.
  • Some see this as an excellent defense against long-term AFU exploitation by forensic tools.

Security vs. Usability

  • Pro-feature side: moving devices back to BFU after extended inactivity greatly raises the bar for data extraction and anti-theft; false positives are a minor annoyance.
  • Concerned side: automatic reboots could be problematic in long offline scenarios (remote areas, multi-day trips, flights, GPS-only use) unless thresholds are long and/or configurable.

Law Enforcement, Vendors, and User Tactics

  • Thread revisits Apple’s stance: strong encryption, no deliberate backdoors, but cooperation via data they can access (e.g., non‑E2EE iCloud backups by default).
  • Several commenters advocate user practices: powering down (BFU) or hard-locking (disabling biometrics) before border crossings, arrests, or seizures, while noting BFU is strictly stronger than just “requiring passcode.”