Editor’s take: A security feature introduced in the latest version of Apple’s mobile operating system is reportedly causing headaches for law enforcement officials. It’s a contentious issue among some, but one that Apple likely won’t compromise on.

404 Media reported last week that some iPhones in the possession of law enforcement were mysteriously restartingmaking it more difficult for forensic experts to break into them and extract data as part of investigations.

It wasn’t really clear why or how this was happening at the time, but now we have a better understanding of what’s going on.

A security researcher at the Hasso Plattner Institute in Germany has apparently solved the case. According to Jiska Classen and others, Apple added a feature known as “restart from inactivity” to iOS 18.1, which restarts a device if it’s been idle for a certain amount of time.

Apple has indeed added a feature called “restart from inactivity” in iOS 18.1. This is implemented in keybagd and the AppleSEPKeyStore kernel extension. It seems to have nothing to do with phone/wireless network status. Keystore is used when unlocking the device. pic.twitter.com/O3jijuqpN0

– Jiska (@naehrdine) November 8, 2024

Details are still emerging, though leading theory is that Apple’s new feature restarts a device after four days of inactivity. No doubt Apple justifies the feature as an added layer of security, making iOS devices even less desirable to thieves looking to resell devices or harvest private data from them.

With less than a week to jailbreak a stolen device before it restarts, thieves may decide to ditch iPhones in favor of Android phones that don’t have such a restriction.

If that makes it harder for law enforcement to do their job, well…so be it. As we’ve seen in the past, Apple has little interest doing his best to hack into his own devices to aid in police investigations.

As for the new feature, four days of inactivity feels adequate to trigger the feature. It’s long enough that it doesn’t continuously activate by accident to the point where it becomes a nuisance, but short enough to potentially have a significant anti-theft impact. And if the feature is triggered, all the owner needs to do is unlock the phone in the usual way using the passcode.