For those at high risk of being directly and individually targeted by spyware—for example, if you’re a journalist, politician, human rights advocate, or political activist—Lockdown Mode should be on your radar.
Governments, criminals, and industrial espionage agents typically deploy spyware against uniquely identified, high-value targets. Spyware, which largely relies on zero-day exploits, can be deployed as easily as texting someone a message, even if the message is never read.
With spyware installed, a remote operator may be able to exfiltrate (remotely copy off your device) all your data, access your microphone or camera without tipping you off, intercept messages sent by secure apps directly on your device, prevent messages from being sent or reaching you, plant evidence, and much more.
Apple considers spyware a significant violation of personal privacy. While in some countries there are legal methods to deploy spyware, it’s often used in contravention of national laws within countries and for national-security purposes or to violate the human rights of citizens or residents. Often, spyware is used by one country against those living in another country, including travelers, emigres, exiles, or refugees from the first country. China is notorious for pursuing current and former Chinese citizens living abroad. Apple funds researchers who try to uncover the use of this kind of software and protect against it, as part of their internal security work.
As a further effort to block intrusion, Apple added Lockdown Mode, a sort of super-firewall to resist known pathways for exploits by those who find themselves targets. Lockdown Mode works on an iPhone, iPad, Mac, or Apple Watch.
With Lockdown Mode engaged, your device will filter rich incoming media, block metadata, and prevent you from receiving invitations to any of Apple’s services. Messages blocks attachments and will receive and display only text and images, while disabling links and link previews. In Safari, Apple disables certain browser-based features that allow sophisticated code to run in web apps. (You can add exceptions and manage them, too.)
Starting with Apple’s version 26 operating systems, Messages always automatically disables links to URLs and phone numbers in messages the app identifies as spam.
Lockdown Mode also blocks incoming communications and invitations from people with whom you haven’t previously initiated contact. That is, if someone called you via FaceTime and you spoke with them, they will be unable to call you with Lockdown Mode on. If you called them in the past, however, they’ll be able to. SharePlay and Live Photos are also disabled.
Apple also blocks the installation of configuration profiles, often used to shunt network traffic for interception and to bypass security rules, and a device can’t be enrolled in mobile device management (MDM), commonly used in organizations to manage devices; MDM allows remote configuration and the overriding of user settings.
You can’t join a Wi-Fi network when Lockdown Mode is enabled unless the network has a password set. Also, the location is removed by default from images or videos shared in Photos, and Shared Albums aren’t available.
On the hardware side, you have to unlock your device before attaching to a computer or any accessory via the USB or Thunderbolt port. On a Mac, all accessories must be approved, independent of your option for accessory attachment described in the Mac settings worth changing.
How to turn it on
If you are one of those targets or just want to try out this technology, it’s simple to use. Here’s how to turn it on:
- Go to System Settings > Privacy & Security > Lockdown Mode and click Turn On next to the Lockdown Mode label, or go to Settings > Privacy & Security and tap Turn On Lockdown Mode.
- At the warning screen, read through the extensive list of limitations, and then click or tap Turn On Lockdown Mode. (Click Cancel to exit, or tap the close button.).
- Apple provides one additional warning that Lockdown Mode should be enabled on all your devices, and prompts you to click Turn On & Restart—or click Cancel to exit.
- Enter your administrator password and click OK. (You may be prompted earlier in the process for this password.)
- Your device restarts. On all other devices linked to the same iCloud account you receive a notification or popup dialog that prompts you to restart with Lockdown Mode. You can exit the dialog or click Later. You may receive this warning multiple times at intervals.
Living with Lockdown Mode
After your device restarts and you log in or enter the passcode, you will likely notice few differences.
When you’re browsing in Safari, a Lockdown Enabled banner appears at the top of every page: on the toolbar for a Mac and below the Location bar on iPhone/iPad. If you want to add a given site to the list of ones excluded from Lockdown strictures, Control-click/right-click in the address bar on a Mac and choose Settings for site name. Uncheck Enable Lockdown Mode. On iPhone/iPad, tap the Page Menu button in the address bar and tap the More button, then disable Lockdown Mode. You’re prompted to confirm your choice with an explanation of what that means. The banner on that page now reads Lockdown Off in red type.
You can change which websites are excluded from Lockdown Mode in Safari > Settings > Websites > Lockdown Mode on a Mac. This view shows both open websites and those you made a choice about. In this context, On means that the site has Lockdown Mode protections enabled, while Off means you have disabled any such protections for that site.
On an iPhone or iPad, go to Settings > Apps > Safari > Lockdown Mode, where you only see websites listed that you specifically disabled Lockdown Mode protections. Website exclusions don’t sync across platforms, either.
Outside of Safari, you’ll notice the difference when you attempt to perform an action that’s not permitted in Lockdown Mode. For instance, try to install a profile or view a file attachment in Messages, and you see descriptive error messages.
After you restart with Lockdown Mode disabled, you still won’t be able to open anything blocked in Messages on that device. Double-click a file and you see the same error.
To disable Lockdown Mode, follow the steps above and click Turn Off or tap Turn Off Lockdown Mode and then confirm by clicking or tapping Turn Off & Restart. You should be asked to authenticate via Touch ID or using a password. Your Mac restarts as normal and has full functionality re-enabled.
Apple’s withdrawn lawsuit
Apple sued an Israeli company offering spyware software to governments, but abruptly withdrew the suit in September 2024. They said in their filing, “Any disclosure, even under the most stringent controls, puts this information at risk. Due to the developments since this suit was filed, proceeding forward at this time would now present too significant a risk to Apple’s threat-intelligence program.”
