Osegi
Security·2 min read

Krakow attacker's iPhone may need Apple's help to unlock

Polish investigators have four phones from the Krakow attacker, and one is an iPhone that may be locked tight. If they can't crack it, they may have to ask Apple.

A locked iPhone on a table next to three other smartphones in an evidence-style arrangement.
Image: Spider's Web

Polish police have four phones from the Krakow attacker, and one of them is an iPhone that could turn out to be a hard nut to crack. Prosecutors say they may have to ask Apple for help.

The phones were found in the attacker's car, together with a weapon and about 500 rounds of ammunition, according to Rzeczpospolita. All four went to the Krakow branch of the Central Bureau for Combating Cybercrime (CBZC), where analysis is under way. Investigators already have access to the attacker's computer, prosecutor Eryk Stasielak said.

"It is possible that in this case we will need help from Apple, which would mean sending a request for legal assistance to the American side," Stasielak said.

Why is the iPhone hard to unlock?

Modern iPhones encrypt their data, and hardware features protect the cryptographic keys. The passcode is part of that system, built to keep outsiders out. Michał Tatar, a digital forensics expert at Mediarecovery, explains that a phone that has been fully powered off loses the keys needed to decrypt its files. After a restart, the passcode is needed to bring them back. How hard it gets depends on the iPhone model and the iOS version, and getting in may require specialist tools that exploit software flaws.

Tatar also suggests a workaround: if the attacker owned older devices, they may be less well protected. If he used the same passcode everywhere, cracking an old phone could open the others.

What are investigators looking for?

Investigators haven't said which phone was the main one, or whether some were bought just for the attack. A former police officer turned crime expert, Andrzej Mroczek, guesses each phone had a different job, such as filming and uploading, or navigation. That is his hypothesis, not a finding.

The contents matter more than the count. Investigators are checking his contacts and how often he spoke to them before the attack. They have established he used Telegram, so activity there will be examined closely. The goal is to learn whether he acted alone. SIM cards may also show whether the phones were new and in whose name they were registered, though prosecutors haven't released those details.

Apps worth a look

SUMO: the number puzzle

Tap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.

Tags:iphoneapplekrakowencryptiondigital forensicstelegram

More from this day

See all →

More in: Security

See all →