ICE Buys iPhone Hacking Tool That Beats Apple’s 72-Hour Lock

U.S. Immigration and Customs Enforcement has purchased a hacking tool that police departments across the country already use to work around one of Apple’s most important iPhone security features. The product is called GrayKey Preserve, and its main job is to stop a built-in timer that makes locked iPhones much harder to search once three days have passed. 

For investigators, it offers more breathing room. For privacy advocates, it raises fresh worries about how far government agencies can reach into personal devices. GrayKey is not a new name in the world of digital forensics. The tool has been sold to law enforcement agencies for several years and is known for helping investigators pull data from locked smartphones. 

Via Forbes 

It is made by Grayshift, a company that later became part of the forensics firm Magnet Forensics. The Preserve feature adds a specific function aimed directly at Apple’s newer protections, which is why its arrival in ICE’s toolbox has drawn so much attention.

The move places ICE alongside many local and state police forces that already rely on the same technology. Agents and officers can now use it to keep seized iPhones in a more accessible state while they wait for legal approval to search them. Supporters see it as a practical step for solving crimes. Critics see it as another example of surveillance tools spreading quietly through federal agencies with little public discussion about limits or oversight.

Via Forbes 

Maine Arrest Shows the Tool at Work

A real case from Maine shows exactly how this technology plays out in the field. In mid-December 2025, police found and arrested a convicted drug trafficker at a convenience store in Westbrook. He had broken the conditions of his parole, which gave officers grounds to take him into custody.  The arrest itself was routine, but what happened next showed why tools like GrayKey Preserve have become so valuable to investigators. 

When officers seized and searched the rental car the man had been driving, they found four iPhones inside. Multiple phones in one vehicle can be a red flag in drug cases, since they may hold contacts, messages, photos, and other records tied to criminal activity. Each of those devices could contain important evidence. The challenge for police was that every one of those iPhones was protected by Apple’s security system, and a clock was already ticking on each one.

Via Bloomberg 

In this case, the local police had access to GrayKey Preserve. That meant they could stop the timer on the phones and keep them in a condition that allowed a later search. Instead of rushing, officers had time to go through the proper legal process and get a warrant. Once approved, they could still search the phones for chats, images, videos, and web browsing history, even after the usual three-day window had closed.

Understanding Apple’s 72-Hour Reboot Feature

Apple introduced a new security feature in the fall of 2024 that changed the game for phone searches. The feature automatically restarts an iPhone if it stays locked for 72 hours or more. At first glance, a simple restart might not sound like a big deal. In reality, it has a major effect on how protected the data inside the phone becomes, and it was designed with theft and unauthorized access in mind.

Via Money Control 

The reason comes down to how iPhones handle encryption. After a person unlocks a phone for the first time following a restart, some of the data becomes easier for the system to access in the background. Forensic experts often call this the “after first unlock” state. Once the phone reboots, it returns to a much stricter state where far more data stays fully encrypted until the correct passcode is entered again. Breaking into a phone in that condition is significantly harder.

Apple built this feature mainly to protect everyday users. If a thief steals an iPhone and holds onto it hoping to crack it later, the automatic reboot locks things down tight. The same protection, however, also affects police. A phone taken from a suspect will reset itself after three days, making evidence much tougher to reach. That is why investigators often describe the 72 hours as a race against the clock.

Via TechCrunch 

How GrayKey Preserve Stops the Clock

GrayKey Preserve is built to interrupt that countdown. When police or agents connect a seized iPhone to the tool, it halts the 72-hour timer so the phone does not restart on its own. The device stays in its current, more accessible state. 

This gives investigators a way to hold the phone in place, almost like pressing pause, while they handle the rest of the legal steps needed for a search. The key benefit for law enforcement is time. Getting a warrant is not always fast. 

Via Tech Spot

Officers have to prepare paperwork, explain why they believe evidence is on the device, and wait for a judge to sign off. In busy cases, or in cases with many devices like the Maine arrest, three days can disappear quickly. Preserve removes that pressure and lets the process move at a normal pace instead of a frantic one.

Via Heise 

It is important to understand what Preserve does and does not do by itself. Stopping the timer keeps the phone from locking down further, but the actual search still depends on other forensic tools and, legally, on a warrant. Preserve is more of a holding tool than a full unlocking tool. Still, by keeping phones in an easier state, it makes the later extraction of messages, photos, and other data far more likely to succeed.

Why Time Matters So Much in Phone Searches

Smartphones have become some of the most important sources of evidence in modern investigations. A single device can hold years of messages, call logs, location history, photos, videos, and internet searches. In drug cases, fraud cases, and many other crimes, the details stored on a phone can connect suspects to people, places, and events. Losing access to that information can weaken a case or even stop it in its tracks.

Via Police 1

Before Apple’s reboot feature, investigators had more flexibility. A seized phone could sit in an evidence locker for days or weeks while officers waited for warrants or for technical tools to catch up. The automatic restart changed that. Suddenly, every seized iPhone came with a short deadline. Police who did not move quickly could end up holding a device that had locked itself into its most secure state.

That shift forced law enforcement to look for new answers. Tools like GrayKey Preserve are a direct response to Apple’s change. They restore some of the flexibility investigators had before. From the police point of view, this helps them follow proper legal procedures without losing evidence. From the privacy side, it shows how every new security feature tends to trigger a matching effort to get around it.

Via Wired 

Privacy Worries Meet Legal Approval

Privacy activists have raised concerns about ICE gaining access to GrayKey Preserve. Their worries center on how the agency might use the tool and how many people’s phones could end up searched. Immigration enforcement touches a large number of people, and critics fear that powerful phone tools could be used widely, reaching personal information about families, friends, and communities that have nothing to do with any crime.

Lawyers who have looked at the issue, however, believe the use of the tool is legal. The key point is that Preserve does not search the phone by itself. It only keeps the device from rebooting. Agents and officers still need a warrant before they can actually dig into the phone’s contents. As long as that legal step is followed, using the tool to hold a phone in place appears to fit within current rules.

Via CPO Magazine

This leaves a gap between what is legal and what some people feel comfortable with. The law may allow it, but activists argue that the bigger question is about trust and oversight. They want clear rules on when the tool can be used, how long phones can be held, and who checks that agencies follow the process. Those debates are likely to grow as more agencies adopt similar technology.

What This Means for iPhone Owners

For everyday iPhone owners, the news is a reminder that phone security is always changing. Apple keeps adding protections, and forensic companies keep finding ways to work around them. The 72-hour reboot is still a strong feature against thieves and other bad actors. It simply does not stop government agencies that have access to specialized tools and the legal power to seize devices.

Via LA Times

People who care about their privacy still have steps they can take. Using a strong passcode instead of a short one makes phones much harder to crack. Keeping software updated ensures they have Apple’s latest protections. Knowing their legal rights during police encounters, including the right to refuse unlocking a phone in many situations, can also matter. None of these steps are perfect, but together they raise the bar for anyone trying to access personal data.

Via VOA 

The story of ICE and GrayKey Preserve is part of a much larger tug of war between tech companies, law enforcement, and privacy groups. Each side has real interests, from solving crimes to protecting personal freedom. As tools grow more powerful, people will keep asking where the line should be drawn. For now, the clock that Apple built into the iPhone can be paused, and that fact will shape how phone searches happen for years to come.