Yoon’s refusal to share iPhone passcode disrupts special probe

Former President Yoon Suk Yeol arrives for a pretrial detention hearing at the Seoul Central District Court in Seocho District, Seoul, July 9. Yonhap

A special counsel team investigating former President Yoon Suk Yeol is facing an unexpected obstacle: his iPhone, locked not only with a passcode but also facial recognition.

Yoon is currently under investigation by three independent counsel teams. Earlier this month, one of them seized his iPhone and requested digital forensic assistance from the Supreme Prosecutors’ Office, but has reportedly struggled to make progress as Yoon refuses to provide the passcode and the device’s strong encryption offers no easy way in.

Phones can contain critical evidence in criminal investigations, including call records, text messages, internet search history and location data. However, when a suspect refuses to unlock an iPhone, the device’s security measures can make law enforcement efforts significantly more difficult.

IPhones feature multiple layers of security, including not just numeric passcodes but also fingerprint and facial recognition. A six-character passcode combining numbers, special characters and upper- and lowercase letters can have up to 56 billion possible combinations. On top of that, the device can be set to erase all data after 10 failed attempts.

In 2016, the FBI asked Apple to create a security workaround to unlock the iPhone of a terrorism suspect. Apple refused, citing user privacy, and the agency filed a lawsuit but ultimately dropped the case.

Even without Apple’s help, there are programs that can unlock encrypted phones. One of the best-known is forensic software developed by Israeli security firm Cellebrite.

In 2023, police used the latest version of Cellebrite’s iPhone unlocking tool to crack the passcode of an iPhone belonging to Choi, a former chief of staff to the mayor of Guri, Gyeonggi Province. Choi, whose full name was not disclosed, was under investigation for allegedly using insider information to buy land slated for development under borrowed names.

But experts say unlocking Yoon’s iPhone won’t be easy, especially with facial recognition enabled.

“Investigators can usually unlock iPhones eventually, using various programs,” Lim Jong-in, a professor at Korea University School of Cybersecurity, told The Korea Times. “But in Yoon’s case, even if they crack the passcode, the added layer of facial recognition will make it much harder.”

Then-prosecutor Han Dong-hoon attends the inauguration ceremony of Justice Minister Choo Mi-ae at the Ministry of Justice in Gwacheon, Gyeonggi Province, Jan. 3, 2020. Prosecutors later seized Han’s iPhone over alleged collusion with the media but failed to unlock it. Newsis

This isn’t the first time the iPhone’s strong security posed a challenge to a high-profile political investigation in Korea.

In 2020, prosecutors seized an iPhone 11 belonging to Han Dong-hoon — then a research fellow at the Institute of Justice and later a former leader of the People Power Party — while investigating allegations of collusion with the media.

But they failed to unlock the device and dropped the case two years later. At the time, prosecutors said, “Given the current level of technology, further attempts to unlock the phone are no longer considered effective.”

Former Justice Minister Choo Mi-ae once pushed for legislation that would require suspects to disclose their phone passcodes under certain conditions, with penalties for refusing to comply. The move was eventually scrapped amid concerns over potential human rights violations.

Lim said forcing a suspect to reveal their phone passcode could amount to a serious violation of constitutionally guaranteed rights.

“Telling someone to give up their passcode infringes on a basic constitutional right — the right not to testify against oneself in a criminal case,” Lim said. “If someone is exercising that right, they shouldn’t be punished for it.”

Some countries have laws that allow authorities to compel suspects to reveal their phone passcodes.

For example, in the United Kingdom, the Regulation of Investigatory Powers Act allows law enforcement to compel suspects to reveal their phone passcodes. Refusing to comply can lead to criminal penalties. However, the law has faced ongoing criticism in the U.K. for granting the state overly broad investigative powers, and Apple notes on its website that it considers privacy to be a basic human right.