Channel 2 Investigates

Technology allows police departments to unlock iPhones, download data

A secret iPhone hacking device used by law enforcement agencies is being paid for with your tax dollars.

It’s called GrayKey, a device that unlocks newer-model iPhones and downloads the data. The technology is shrouded in secrecy and Apple Inc. has made shutting the device down a priority.

Reporter Paige Kelton from WSB-TV’s sister station, Action News Jax, dug through a 400-page Georgia Bureau of Investigation report about the night suspended Glynn County Police Lt. Cory Sasser killed his estranged wife, Katie Sasser, her friend John Hall Jr., and then committed suicide.

In the report, she found an obscure reference to something we now know is GrayKey technology.

Agents, unable to unlock Sasser’s iPhone X after his death, reached out to a GBI forensics investigator who admitted the agency had “recently acquired equipment that might unlock the iPhone.”

The agency then obtained the search warrant, granting agents access to the data.

"There's no such thing as a backdoor that only one person can use,” says Thomas Reed of anti-malware software company Malwarebytes.

Reed published the only picture we have of the GrayKey device, adding he was tipped off by a member of law enforcement who was uncomfortable with what the key could do.

"He felt like the public had a right to know about that, that it shouldn't be a secret,” Reed said.

RECENT INVESTIGATIONS:

According to Reed, GrayKey was developed by a former Apple Inc. engineer and is only offered for sale to law enforcement.

Apple itself has repeatedly refused to help federal and local agencies hack into the iPhones of criminal suspects, citing privacy concerns.

GrayKey is made by Grayshift LLC. According to Georgia state business records, the company began operating in April 2018 and is based in an Atlanta suburb.

But Action News Jax found the address listed is a mailbox at a UPS store.

The Grayshift website can only be accessed by subscribers and Kelton's requests for information and an interview went unanswered.

A search of public records found police agencies across the country spending tens of thousands of dollars on GrayKey hacking technology.

Action News Jax also found in recent months upwards of a dozen federal agencies, such as the IRS, Secret Service, Coast Guard and Immigration and Customs Enforcement have awarded Grayshift LLC, more than $1 million in government contracts.

While the Fourth Amendment of the Constitution protects you from unreasonable searches and seizures, Action News Jax Law and Safety Expert and Former FBI agent Dale Carson fears technology is outpacing oversight.

"Unless there's a physical law that says you can't do it and if you do this is the penalty, then they're likely to continue to do it,” Carson said.

Tech experts share those concerns and fear the government's expanded use of phone hacking technology could backfire, with devices like GrayKey, potentially unlocking a new threat to privacy.

"If one person can access a backdoor, lots of other people are going to figure it out and pick that lock'" Reed said.

Recently, Apple Inc. rolled out its new IOS update, which contains a patch called  "USB restricted mode.” It requires a passcode when the iPhone is plugged into a computer.

Sources say the update, which enables the restricted mode automatically, appears to have rendered GrayKey useless in iPhone X models. But sources say older model iPhones are still vulnerable, and the data is at least partially or fully transferable.

Action News Jax reached out to Apple Inc. for comment about GrayKey technology and its new update. They're still waiting for a response.

This article was written by Paige Kelton, Action News Jax