What To Do After Your Phone Is Released from Confiscation
Building on my series about hardening mobile devices for privacy, today I want to discuss what to do after a phone is returned from police custody. Although I’m writing with police confiscation in mind, the same questions apply whenever your phone has been out of your possession and you have reason to believe it may have been examined or altered. The concern is not limited to police or immigration authorities. A former partner, coworker, repair technician, or anyone else with physical access could give you reason to reconsider whether you trust the device.
Okay. Your Phone’s Back. What Now?
The officer slides your phone across the counter. The screen’s dark, the case is scuffed, and you're relieved to have it back — you can rejoin connected society. The instinct, that pull, is almost automatic: press the power button, answer the tons of messages that have piled up, and get on with your day.
Hang on. Take a breath first.
When your phone is returned, don't assume that because no one tells you it was searched, it wasn't. Likewise, don't assume that because it was out of your possession, it necessarily was searched or altered. You usually won't know either way. You can ask whether the phone was searched or copied, but officers generally do not have to give you a complete account when returning it, particularly while an investigation remains open. A lawyer may later obtain more information through the warrant record, property documentation, or the evidence-sharing process in a criminal case.
Meanwhile, regardless of whether your phone was held for hours or several weeks, you’ve been through a lot. Maybe piling on more anxiety isn’t the right move. You need to think clearly about what you might do next. Think about a few things:
Is anyone in your life urgently waiting to hear from you?
Is there any reason to suspect you’re being surveilled? That the authorities are still interested in where you go, and who you might talk to?
Was there anything on the device that you really need, or urgently need to see?
Do I need to preserve the device as evidence?
This is where I feel you need to think carefully about turning that phone on. Maybe this is my professional paranoia speaking, but once a device has been out of my control, I have to ask whether I still trust it.
If the answer to all these questions are no, nuke the device.
Nuking Your Device
If you believe your phone may have been examined, altered, or returned under circumstances that leave you unable to trust it — and you don't urgently need what's on it — consider erasing it and restoring it from a backup you trust.
In our workshops, I try to coach people about attachment when it comes to phones. Don’t get attached. It’s just a computer, even something we’d consider disposable. In the wrong hands, that device and your attachment to it — your trust, your anxiety about getting reconnected with your friends and family — can be used against you.
I don’t know about you, but I don’t trust anything that’s been out of my possession. So, options:
Leverage the work you did earlier by forcing your phone to self-destruct.
Login to the device and restore it to factory settings.
If you aren’t ready to decide, throw it into your Faraday Bag and deal with it later.
A factory reset removes any changes that may have been made to the phone's software while also giving you a known starting point before restoring your own data.
Change The Number
You can take this logic a step further and think about having your carrier rotate (change) your mobile phone number.
Again, attachment.
You feel it now, don’t you. You’re attached to a random set of digits you were assigned years ago, and that feeling of ownership may be clouding your judgment. You know who had it knows the number — why not change it to offer you more security through obscurity? As changing your number is a nuisance, consider:
Is your phone central to organizing and community resistance?
Are your contacts at risk?
You’re concerned about future monitoring or harassment?
You’re relocating to another safe place after an arrest?
It’s a pain, but then again, it’s just a number. Let go. Any old number will do. It’s one less datapoint needed by others to trace and follow you.
Moving Beyond Paranoia
Okay, now let’s step out of my head as a cybersecurity expert and think more rationally.
For most, nothing unusual will have happened.
Modern phones are difficult to unlock without the passcode. Even so, the time to check your device is before you begin using it again, not months later when something seems odd.
When you’re safe:
Start by looking for anything that surprises you. Did the phone ask for your passcode immediately, or did it unlock in an unexpected way? Are there new apps you don't recognize? Does anything look different? A changed wallpaper isn't proof of anything, but unexpected changes deserve your attention.
Spend a few minutes reviewing the accounts that matter most. If your phone gives you a way to see recent sign-ins to your email or cloud storage, take a look. You're asking, "Does anything here seem out of place?"
Change the passwords to the accounts you value most. Your email account is a good place to begin because it often serves as the master key for resetting other passwords. If you use a password manager—a secure app that stores your passwords—changing a few important passwords becomes much less painful.
Review the device for alteration. If you’ve a bit of technical know-how and curiosity, try looking under the hood. Are there new Face ID or fingerprint enrollments? Bluetooth pairings? Unknown Wi-FI networks? New VPN profiles? Unfamiliar accessibility settings? Weird, unfamiliar apps?
Reflect on your experience. Were you asked to unlock the phone? Did it ever leave your sight? Were accessories, memory cards, or SIM cards removed and later replaced? Those details may matter later if questions arise, and they're easiest to remember while the experience is still fresh. Write them down.
The point isn't to become suspicious of everything [ahem, adjusting my collar]. Rather it's to avoid assuming that because your phone looks normal, nothing deserves a second glance.
An Argument Against Immediately Wiping the Device
Before erasing anything or even opening and using the device, consider whether the phone itself may be evidence.
Photograph it from several angles before turning it on, preserve the paperwork that came with it, and write down what happened while your memory is fresh. Seal it in masking tape (or evidence tape if you have it), preserving the integrity of the device.
Here, we are documenting its condition and preserving its state so we may speak with an attorney on whether a criminal case or civil-rights complaint may follow.
Take a Beat
Technology rewards us for moving quickly. We answer the notification. We tap "Continue." We rush back into our routines. But after a phone has been confiscated, slowing down for fifteen minutes can be one of the smartest things you do.
Your phone is more than a piece of electronics. It's your conversations with friends, your photographs, your banking, your work, your memories, and often your identity. Increasingly, it’s a private confidant, even something we might personify and consider a friend. When it comes back into your hands, treat it with skepticism.
Before answering that first text, take a few quiet minutes to decide what you need from the phone, and what you need to do before trusting it again. You may inspect it, preserve it for your attorney, erase it, or replace it altogether. The right choice depends on your circumstances. The important thing is that the choice belongs to you, not to the stack of notifications blinking on the screen.
R
