Apple's Lockdown Mode, a security feature designed to protect high-risk users such as journalists, dissidents, and human-rights defenders, has been shrouded in mystery since its launch in 2022. While it has a proven track record of blocking advanced attacks, its notifications are often confusing and unclear, leaving users wondering what's being blocked and why.

Lockdown Mode is designed to reduce the likelihood of hackers armed with sophisticated spyware or zero-days successfully breaking Apple's operating system protections and spying on its users. In practice, it removes some normal Apple device features, such as fonts loaded from the internet that can track users, the ability to receive certain types of files, and location data from photos shared. In exchange, Lockdown Mode makes it harder for hackers to gain access to users' devices.

Despite its effectiveness, exactly how Lockdown Mode works remains unclear, and its notifications are often puzzling. Users have reported receiving notifications stating that Lockdown Mode has blocked someone from contacting them, even when they are already in contact with that person. These notifications often pop up when users are already messaging that person on iMessage, making it unclear if they will stop receiving messages or if some messages have already disappeared due to Lockdown Mode.

One user, a journalist, reported receiving a Lockdown Mode notification mentioning someone by name who they hadn't talked to in months, and from whom they didn't receive a message or call afterwards. Another user reported seeing a "Lockdown Mode blocked…" notification with a friend's name on it, suggesting that Lockdown Mode can be triggered simply by viewing someone's contact.

Runa Sandvik, a hacker who helps journalists and high-risk individuals protect themselves, told TechCrunch that the notifications are not helpful and do not include any context. "I'd love to see Apple either share more information so that we know what to 'do' with them, or not display them at all," Sandvik said.

In an experiment, a journalist and Harlo Holmes, chief information security officer at the Freedom of the Press Foundation, tested Lockdown Mode by deleting each other from their contact lists and starting a new conversation on iMessage. The journalist received a "Lockdown Mode blocked…" notification, but still received Holmes' message. They exchanged text, emojis, and a cat picture, but the stickers they sent were blocked and replaced with a Unicode character of a question mark or a nondescript file attachment.

The blocking was only visible to the recipient, which makes sense, as Apple wouldn't want to tip off government hackers that their attempt to hack someone not only didn't work but also alerted the targeted individual that something went wrong. However, the journalist still doesn't know what the notifications are supposed to tell them.

Apple did not provide on-the-record remarks by press time, but an Apple spokesperson acknowledged receiving the journalist's message, indicating that Lockdown Mode didn't block it. Despite the confusion surrounding Lockdown Mode's notifications, it is still a powerful security feature that high-risk users should enable to protect themselves from advanced attacks.

As the digital landscape continues to evolve, it's essential for tech companies like Apple to prioritize transparency and clarity in their security features. By doing so, they can empower users to take control of their online safety and make informed decisions about their digital lives.