Accounts, Platforms and Phones: iCloud, Cambridge Analytica and San Bernardino
Skill packs and prompts are provided in English so they work best with the AI tools. Use them as-is.
Where you are: Part VII — Landmark Cases · Lesson 7.4 · This lesson follows Chapter 14 of Dr. Al-Doori's IT Forensics Essentials: cases 6 (the iCloud celebrity photo hack), 9 (Facebook and Cambridge Analytica) and 10 (the San Bernardino iPhone), with the technique of mobile device forensics from section 14.11.
What you'll be able to do
By the end of this lesson you will be able to explain how investigators handle evidence held in accounts, platforms and locked phones, and the legal and ethical tensions involved.
- Explain how account logs and phishing evidence traced the people behind the 2014 iCloud thefts.
- Explain how analysis of data-sharing APIs revealed the Cambridge Analytica data harvesting.
- Describe the San Bernardino iPhone dispute and what it shows about mobile forensics, encryption and the law.
Case 6: The iCloud Celebrity Photo Hack (2014)
The case. In 2014, private photos stolen from celebrities' iCloud accounts were leaked online.
The book's account. Investigators traced unauthorized access to specific IP addresses and to phishing schemes that targeted victims' credentials, and digital footprints led to an arrest. In section 14.11 the book describes the forensic approach: reviewing account-access logs, extracting iCloud data with mobile forensic tools, and reconstructing the phishing emails to identify the attack vector.
What the official record shows. Several people were prosecuted in the US. In one case, the Justice Department reported in 2016 that a Pennsylvania man, Ryan Collins, had run a phishing scheme from November 2012 to September 2014, sending emails that appeared to come from Apple or Google, and had accessed at least 50 iCloud and 72 Gmail accounts, many belonging to celebrities. He was sentenced to 18 months in prison. When his plea agreement was announced in March 2016, investigators reported that they had found no evidence that he leaked the photos himself, a precise distinction between accessing and publishing that a good report also makes.
The book's takeaway: account log analysis and phishing investigation can help trace cybercriminals.
Case 9: Facebook and Cambridge Analytica (2018)
The case. The political consulting firm Cambridge Analytica improperly obtained personal data from millions of Facebook users.
The book's account. Forensic experts analyzed Facebook's data-sharing APIs (the interfaces through which apps receive users' data) and logs to trace how the data was accessed and used. The findings led to significant legal and regulatory consequences.
What the official record shows. In April 2018 Facebook said it believed the information of up to 87 million people, mostly in the US, may have been improperly shared with Cambridge Analytica through a personality-quiz app called "This Is Your Digital Life". On 24 July 2019 the US Federal Trade Commission announced a $5 billion penalty, which it called record-breaking, and new privacy restrictions, finding that Facebook had violated a 2012 order by deceiving users about their ability to control their personal information.
The book's takeaway: forensics of data sharing and APIs can uncover misuse of personal data. Here the "crime scene" was a platform's design and logs, not a device.
Case 10: The San Bernardino iPhone (2015–2016)
The case. After a terrorist attack in San Bernardino, California, in December 2015, the FBI wanted access to a locked iPhone used by one of the attackers.
The book's account. Apple initially refused to unlock the device, citing privacy concerns. The FBI eventually used a third-party tool to bypass the protection and access the data.
What the official record shows. The dispute went to court in early 2016 and ended when the FBI said it had found another way in. In March 2018 the Justice Department's Inspector General published a report on whether FBI statements about its ability to access the phone had been accurate. It found no evidence that the FBI had that capability when it testified and first went to court, while raising concerns about internal communication. In 2021 press reports, starting with The Washington Post, identified the third party as Azimuth Security, an Australian firm.
The book's takeaway: mobile forensics often involves balancing legal, ethical and technical challenges.
The Technique in Focus: Mobile Device Forensics
Mobile forensics recovers and analyzes data from phones and tablets. The book lists Cellebrite UFED and Oxygen Forensic Suite as typical tools. NIST's guidelines on mobile device forensics describe the main extraction levels, from manual (photographing the screen) and logical (data the phone's software exposes) to deeper physical extractions of the memory itself. Two things make phones different from computers:
- Security hardware and encryption. Modern phones encrypt by default and limit passcode guessing (Lesson 1.3), so access depends on the passcode, on the phone's state (Lesson 3.4) and on specialist tools used under legal authority.
- The cloud. Much of a phone's data, such as photos, messages and backups, is also in the cloud, where it is obtained from the provider by legal process.
Real-World Example
Imagine (a fictional scenario) a stalking investigation in which police need messages from a suspect's iPhone. The phone is locked and has been in an evidence bag for six days. The mobile specialist records that it has restarted, so it is now in its harder "Before First Unlock" state. The direct route is slow and uncertain. In parallel, investigators obtain a court order for the suspect's cloud account. The provider returns account records and some data, but reports that the user had turned on end-to-end encryption for backups, so their contents cannot be provided. The case moves forward on the victim's own phone, the account records and witness statements. Phones are often reached around, not through.
From the Book to 2026
What the book teaches. iCloud: account logs and phishing reconstruction traced the attackers. Cambridge Analytica: API and log analysis exposed data misuse. San Bernardino: a third-party tool unlocked the phone after Apple refused, showing the legal, ethical and technical tensions of mobile forensics.
Why it made sense. These three cases are still the clearest illustrations of account, platform and mobile forensics.
What has changed. The record now adds detail: multiple prosecutions in the iCloud thefts, with no evidence that one convicted phisher leaked the photos; an 87-million-person estimate and a $5 billion FTC penalty for Cambridge Analytica; and an Inspector General's review of the San Bernardino dispute. End-to-end encryption has spread to the cloud. Apple's optional Advanced Data Protection for iCloud gives the user's devices sole access to the keys for most iCloud data, including backups and photos, so not even Apple can decrypt it. And phones keep adding protections such as iOS's inactivity reboot. Device and cloud evidence are both harder to reach than in the book's cases.
What to do now. Plan mobile and cloud evidence together. Preserve and request account records quickly, act fast on seized phones, and be ready to build a case from other sources when encrypted data cannot be reached.
Watch: The Judge's Order to Apple
This PBS NewsHour report from February 2016 covers the court order requiring Apple to help the FBI access the San Bernardino iPhone, and the privacy concerns it raised.
Questions to keep in mind as you watch:
- What exactly was Apple being asked to do, and why did it object?
- What arguments are made on the side of investigators, and on the side of privacy?
- Knowing how the dispute ended, which concerns raised at the time turned out to matter most?
The video complements what you just read. The lesson is complete without it. For an optional report on how the FBI eventually got into the phone, see the further-study link on this lesson.
What Would You Do?
A colleague drafts a press statement saying "the hacker who leaked the celebrity photos has been jailed", referring to a defendant convicted of phishing iCloud accounts. What would you correct, and why? Decide, then compare with the model answer in the note below.
Knowledge Check
In the iCloud thefts, where did the most important evidence come from?
What did Facebook state in April 2018 about Cambridge Analytica?
Why are modern phones often reached around rather than through?
Answers explained
- Question 1: b. The thefts happened through accounts, so the account logs, phishing messages and provider records held the evidence.
- Question 2: d. Facebook estimated up to 87 million people. The FTC later penalized Facebook $5 billion (b is wrong).
- Question 3: a. Encryption and lockout protections push investigators toward other sources. Phones hold a great deal of data (b), and examinations are lawful with proper authority (c).
On "What Would You Do?": Correct it. The public record for that defendant concerns phishing and unauthorized access to accounts, and investigators reported no evidence that he leaked the photos. The statement should say exactly what he was convicted of, such as "unauthorized access to email and iCloud accounts", and avoid linking him to the leak. Wrong statements can be defamatory and undermine trust in the investigation.
Key Takeaways
- iCloud 2014: phishing and account logs, not device forensics, traced the account thefts. Accessing and leaking were distinct, and so were the conclusions.
- Cambridge Analytica: API and log analysis showed how data on up to 87 million people was obtained; the FTC imposed a $5 billion penalty in 2019.
- San Bernardino: a locked iPhone, a court fight, a third-party unlock and an Inspector General's review. Mobile forensics sits where law, ethics and technology meet.
- End-to-end encryption on devices and in the cloud means investigators must plan multiple routes to evidence.
Sources
- Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 14 (cases 6, 9 and 10; section 14.11)
- US Attorney's Office, Middle District of Pennsylvania — Lancaster County man sentenced to 18 months for hacking Apple and Google email accounts (October 2016)
- Infosecurity Magazine — Celebgate iCloud Hacker Pleads Guilty (17 March 2016)
- Meta — An Update on Our Plans to Restrict Data Access on Facebook (April 2018)
- US Federal Trade Commission — FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook (24 July 2019)
- US Department of Justice, Office of the Inspector General — Report on the accuracy of FBI statements concerning its capability to access data on an iPhone (March 2018)
- The Register — Report: Aussie biz Azimuth cracked San Bernardino shooter's iPhone, ending Apple-FBI privacy standoff (April 2021)
- NIST — SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics
- Apple Support — iCloud data security overview (Advanced Data Protection)