The iPhone password is known as ‘ironclad security.’ (Photo provided by Yonhap)
SEOUL, July 28 (Korea Bizwire) — South Korea is grappling with the increasing challenge of suspects refusing to reveal their smartphone passwords—a trend spotlighted most recently by former President Yoon Suk-yeol’s reported noncompliance in a high-profile investigation into the death of military corporal Chae.
Prosecutors say Yoon’s refusal to unlock his device has hindered the special probe, adding to a growing list of stalled inquiries involving encrypted iPhones.
The issue reflects a broader global dilemma in criminal justice, where mobile phones—repositories of calls, messages, search history, and GPS data—serve as digital “black boxes.” Investigators note that securing phone access can sometimes account for “half the work” in an investigation.
However, Apple’s iPhones pose formidable obstacles. The devices are equipped with multi-layered security including complex alphanumeric passcodes, biometric authentication, and data-wipe protocols triggered by failed password attempts. In theory, the number of possible passcode combinations can exceed 56 billion.
A photo of former President Yoon Suk Yeol talking on the phone at the Supreme Prosecutors’ Office in Seocho-dong in 2019, when he was serving as Prosecutor General.
In 2016, even the FBI famously failed to compel Apple to unlock an iPhone used by a terror suspect, launching a legal standoff. The agency eventually relied on Cellebrite, an Israeli tech firm, whose tools clone and brute-force passwords via embedded hacking software.
Some South Korean police and prosecutors have acquired similar equipment, but the process is prohibitively expensive, time-consuming, and increasingly ineffective against updated iOS versions.
“Success rates vary wildly depending on the iPhone model and software version,” said a police official. Cellebrite’s tools reportedly no longer work on devices running iOS 17.4 or later, released in March 2024. “In the battle between sword and shield, the shield is always one step ahead,” said Lim Jong-in, a professor at Korea University’s Graduate School of Information Security.
The legal and political debate over compelling password disclosure is intensifying. While some lawmakers argue for penalties against suspects who refuse, citing examples like the U.K.’s Regulation of Investigatory Powers Act (RIPA)—which allows for prison sentences of up to five years—others warn it could infringe on the constitutional right against self-incrimination.
Password Standoff Raises Constitutional Questions Over Self-Incrimination (Image supported by ChatGPT)
Former Justice Minister Choo Mi-ae once floated a bill informally dubbed the “Han Dong-hoon Prevention Act” after a similar case, but it failed to advance. Most recently, during Justice Minister nominee Jeong Seong-ho’s confirmation hearing, a lawmaker from the Democratic Party argued that non-disclosure should warrant additional charges.
Legal experts remain divided. Attorney Kim Jin-bae of Law Firm The Prime suggested that rather than mandating disclosure, authorities could treat refusal as an aggravating factor in sentencing or develop better psychological persuasion techniques.
In a recent case in Songdo, police reportedly convinced a murder suspect to voluntarily unlock his iPhone after prolonged dialogue.
As privacy protections and encryption continue to evolve, South Korea’s legal system faces a mounting challenge: how to balance civil liberties with the need for digital transparency in criminal justice.
M. H. Lee (mhlee@koreabizwire.com)
