Phone SeizedWhat is on your phoneWhat Apple and Android’s own security notes say
What Apple and Android’s own security notes say
What you must do, what you can refuse, and what they can do
Every claim below links to the source it comes from, with the wording quoted so you can check it yourself.
What the sources say
What a document, a report, an agency publication or a provision says, quoted as it is worded.
Apple’s “About the security content of iOS 18.3.1 and iPadOS 18.3.1” (as fetched on 2 Nov 2026) says: “Released February 10, 2025” (page marked “Published Date: June 12, 2025”). For its “Accessibility” entry it says: “Impact: A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.”; and “Description: An authorization issue was addressed with improved state management.” The entry carries the identifier “CVE-2025-24200”. This is Apple’s statement about its own software.
Apple, "About the security content of iOS 18.3.1 and iPadOS 18.3.1" (support.apple.com/en-us/122174), entry "Accessibility" under "Released February 10, 2025", page marked "Published Date: June 12, 2025", as fetched 2026-11-02
“iOS 18.3.1 and iPadOS 18.3.1 Released February 10, 2025 Accessibility—Impact: A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. Description: An authorization issue was addressed with improved state management. CVE-2025-24200”
Read it at support.apple.comquote checked 2026-11-02
Apple’s UK-English support page “Allow USB and other accessories to connect to your iPhone or iPad” (marked as published on 24 Oct 2025; as fetched on 2 Nov 2026) says, under “Unlock your device”: “By default, you need to first unlock your iPhone or iPad to connect to an accessory or computer – such as USB or Thunderbolt devices, Smart Connector accessories for iPad, or a Mac or PC. Once you unlock your device, your accessory remains connected, even if your device is locked again.”
Apple, "Allow USB and other accessories to connect to your iPhone or iPad" (support.apple.com/en-gb/111806), section "Unlock your device", page marked "Published Date: October 24, 2025", as fetched 2026-11-02
“By default, you need to first unlock your iPhone or iPad to connect to an accessory or computer—such as USB or Thunderbolt devices, Smart Connector accessories for iPad, or a Mac or PC. Once you unlock your device, your accessory remains connected, even if your device is locked again.”
Read it at support.apple.comquote checked 2026-11-02
The Android Open Source Project’s “Full-disk encryption” page (as fetched on 2 Nov 2026) says, in a caution: “Only devices that launched with Android 9 or lower can use full-disk encryption. Devices that launched with Android 10 or higher must use file-based encryption instead. Android 10-12 support full-disk encryption only for devices that upgraded from Android 9 or lower. Android 13 removes support for full-disk encryption entirely.”
Android Open Source Project, "Full-disk encryption" (source.android.com), as fetched 2026-11-02
“Only devices that launched with Android 9 or lower can use full-disk encryption. Devices that launched with Android 10 or higher must use file-based encryption instead. Android 10-12 support full-disk encryption only for devices that upgraded from Android 9 or lower. Android 13 removes support for full-disk encryption entirely.”
Read it at source.android.comquote checked 2026-11-02
The Android Open Source Project’s “Rate-limiting” page (as fetched on 2 Nov 2026) defines its term: “user-configured lockscreen knowledge factors (LSKFs) such as PINs, patterns, and passwords.” In its section on a stronger default policy it says: “Historically, the required rate-limiting policy has been fairly lenient. For example, an implementation meeting the minimum requirements of Android 16 allows up to 10 guesses in the first minute, 20 in 6 minutes, 50 in 25 minutes, 110 in 24 hours, and 1800 guesses in 5 years.” Later in that section it says: “Android 16 QPR2 and higher provides a stronger default LSKF rate-limiting policy. This policy allows up to 6 guesses in the first minute, 7 in 6 minutes, 8 in 25 minutes, 12 in 24 hours, and 19 in 5 years. No further guesses are allowed after 20 incorrect guesses. The full timeout schedule is shown in the following table. It’s subject to change in future Android versions.” The sentences name Android versions, not phones.
Android Open Source Project, "Rate-limiting" (source.android.com/docs/security/features/authentication/rate-limiting), section "Stronger default rate-limiting policy in Android 16 QPR2 and higher", footer "Last updated 2026-09-30 UTC", as fetched 2026-11-02
“user-configured lockscreen knowledge factors (LSKFs) such as PINs, patterns, and passwords.—Historically, the required rate-limiting policy has been fairly lenient. For example, an implementation meeting the minimum requirements of Android 16 allows up to 10 guesses in the first minute, 20 in 6 minutes, 50 in 25 minutes, 110 in 24 hours, and 1800 guesses in 5 years.—Android 16 QPR2 and higher provides a stronger default LSKF rate-limiting policy. This policy allows up to 6 guesses in the first minute, 7 in 6 minutes, 8 in 25 minutes, 12 in 24 hours, and 19 in 5 years. No further guesses are allowed after 20 incorrect guesses. The full timeout schedule is shown in the following table. It's subject to change in future Android versions.”
Read it at source.android.comquote checked 2026-11-02
The same “Rate-limiting” page (as fetched on 2 Nov 2026) says: “Android 16 QPR2 and higher includes updated Gatekeeper and Weaver implementations that enforce the rate-limiting policy in the table.” In its “Software rate-limiter” section it says: “Android 16 QPR2 and higher includes an optional secondary rate-limiter, SoftwareRateLimiter. It is implemented in the system server and lets devices offer a stronger rate-limiting policy when the TEE or SE can’t be updated.”
Android Open Source Project, "Rate-limiting" (source.android.com/docs/security/features/authentication/rate-limiting), sections "Updated rate-limiters" and "Software rate-limiter", as fetched 2026-11-02
“Android 16 QPR2 and higher includes updated Gatekeeper and Weaver implementations that enforce the rate-limiting policy in the table.—Android 16 QPR2 and higher includes an optional secondary rate-limiter, SoftwareRateLimiter. It is implemented in the system server and lets devices offer a stronger rate-limiting policy when the TEE or SE can't be updated.”
Read it at source.android.comquote checked 2026-11-02
The Android Open Source Project’s “Android Security Bulletin-February 2025” (as fetched on 2 Nov 2026) says: “Published February 3, 2025”; “The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2025-02-05 or later address all of these issues.” In a note it also says: “There are indications that CVE-2024-53104 may be under limited, targeted exploitation.”
Android Open Source Project, "Android Security Bulletin-February 2025" (source.android.com/docs/security/bulletin/2025-02-01), published 3 Feb 2025, as fetched 2026-11-02
“Published February 3, 2025 The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2025-02-05 or later address all of these issues.—There are indications that CVE-2024-53104 may be under limited, targeted exploitation.”
Read it at source.android.comquote checked 2026-11-02
The Android Open Source Project’s “Android Security Bulletin—March 2025” (as fetched on 2 Nov 2026) is marked “Published March 3, 2025” and “Updated March 20, 2025”. It says: “The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2025-03-05 or later address all of these issues.” Its note reads: “There are indications that the following may be under limited, targeted exploitation. CVE-2024-43093 CVE-2024-50302”.
Android Open Source Project, "Android Security Bulletin—March 2025" (source.android.com/docs/security/bulletin/2025-03-01), published 3 Mar 2025, updated 20 Mar 2025, as fetched 2026-11-02
“Published March 3, 2025—Updated March 20, 2025 The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2025-03-05 or later address all of these issues.—There are indications that the following may be under limited, targeted exploitation. CVE-2024-43093 CVE-2024-50302”
Read it at source.android.comquote checked 2026-11-02
Short answer
Short answer. The notes quoted here say what particular releases addressed or changed, in their makers’ words (Apple: “An authorization issue was addressed with improved state management”; Android: “Security patch levels of 2025-02-05 or later address all of these issues”, in its February 2025 bulletin; “Android 16 QPR2 and higher provides a stronger default LSKF rate-limiting policy”, where LSKF is its term for a PIN, pattern or password). They do not say what that means for any person’s phone, and this page does not either. It gives no advice.
Apple, in Apple’s own words
Apple’s security-content page for iOS 18.3.1 and iPadOS 18.3.1, as fetched on 2 November 2026, lists the release as “Released February 10, 2025” (page marked “Published Date: June 12, 2025”). Its “Accessibility” entry has an “Available for” line, which this page does not reproduce: it applies to that one release, and Apple’s notes for other releases have their own lines. Its “Impact” line for that entry reads: “A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.” Its “Description” line reads: “An authorization issue was addressed with improved state management.” The entry carries the identifier “CVE-2025-24200”. The quoted text does not define “USB Restricted Mode”, and this page does not.
Apple’s UK-English support page “Allow USB and other accessories to connect to your iPhone or iPad” (marked as published on 24 October 2025), as fetched on 2 November 2026, says under “Unlock your device”: “By default, you need to first unlock your iPhone or iPad to connect to an accessory or computer – such as USB or Thunderbolt devices, Smart Connector accessories for iPad, or a Mac or PC. Once you unlock your device, your accessory remains connected, even if your device is locked again.” That page does not use the name “USB Restricted Mode”.
Android, in the Android Open Source Project’s own words
In a caution at the top of its “Full-disk encryption” page, as fetched on 2 November 2026, the Android Open Source Project says: “Only devices that launched with Android 9 or lower can use full-disk encryption. Devices that launched with Android 10 or higher must use file-based encryption instead. Android 10-12 support full-disk encryption only for devices that upgraded from Android 9 or lower. Android 13 removes support for full-disk encryption entirely.” Those sentences give version milestones.
The Android Open Source Project’s “Rate-limiting” page, as fetched on 2 November 2026, defines its term: “user-configured lockscreen knowledge factors (LSKFs) such as PINs, patterns, and passwords.” In its section on a stronger default policy it says: “Historically, the required rate-limiting policy has been fairly lenient. For example, an implementation meeting the minimum requirements of Android 16 allows up to 10 guesses in the first minute, 20 in 6 minutes, 50 in 25 minutes, 110 in 24 hours, and 1800 guesses in 5 years.” Later in that section it says: “Android 16 QPR2 and higher provides a stronger default LSKF rate-limiting policy. This policy allows up to 6 guesses in the first minute, 7 in 6 minutes, 8 in 25 minutes, 12 in 24 hours, and 19 in 5 years. No further guesses are allowed after 20 incorrect guesses. The full timeout schedule is shown in the following table. It’s subject to change in future Android versions.”
The same page also says: “Android 16 QPR2 and higher includes updated Gatekeeper and Weaver implementations that enforce the rate-limiting policy in the table.” In its “Software rate-limiter” section it says: “Android 16 QPR2 and higher includes an optional secondary rate-limiter, SoftwareRateLimiter. It is implemented in the system server and lets devices offer a stronger rate-limiting policy when the TEE or SE can’t be updated.” Gatekeeper, Weaver, TEE and SE are the page’s own terms and this page does not explain them. The sentences quoted from that page name Android versions, not phones. This page does not say which phones run Android 16 QPR2 or higher, and it does not say that the guess limit above applies to any given phone. The table that page refers to is not reproduced here.
The Android Open Source Project’s Android Security Bulletin for February 2025, marked “Published February 3, 2025”, as fetched on 2 November 2026, says: “The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2025-02-05 or later address all of these issues.” In a note it also says: “There are indications that CVE-2024-53104 may be under limited, targeted exploitation.”
Its bulletin for March 2025, as fetched on 2 November 2026, is marked “Published March 3, 2025” and “Updated March 20, 2025”. It says: “The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2025-03-05 or later address all of these issues.” Its note reads: “There are indications that the following may be under limited, targeted exploitation. CVE-2024-43093 CVE-2024-50302”.
Our reading
This section is this site’s reading of the quotations above. It states no device fact and no legal fact; those stay in the quoted items. It is not advice, and this site does not endorse a product.
We would read the makers’ own notes first, because they are the makers’ own documents: Apple’s pages and the Android Open Source Project’s pages. Within them we would read first the dated lines, where a page prints one.
The quotations carry different dates: Apple’s security note, a release of 10 February 2025 (the page marked published 12 June 2025); Apple’s accessories page, marked 24 October 2025; the Android bulletins, 3 February and 3 March 2025 (the March one marked updated 20 March 2025); the Android pages on encryption and rate-limiting, as fetched on 2 November 2026.
Nothing on this page is advice about what to do when a phone is sought or has been taken.
Where to go next
- What a phone extraction can actually see: in its sources’ own words.
Last reviewed . Next review due . No lawyer has reviewed this page — see [email protected] if you think something here is wrong.