A locked screen. No malware, no metadata fight. Just four digits nobody will type.
I’ve sat with cases where the whole dispute turns on code, and cases where it turns on data. This one turns on neither. It turns on access. A phone sits in an evidence locker. Nobody disputes what’s inside it matters. Nobody disputes it’s locked. The suspect isn’t talking, and constitutionally, he doesn’t have to.
What looks like a dead end is actually the whole case.
What actually happened
In November 2025, the Jerusalem Magistrate’s Court decided ה”ת 34927-09-25, Awisat v. State of Israel. Police had seized the petitioner’s phone during an investigation and couldn’t open it. He hadn’t handed over the access code. So he went to court and asked for the phone back, arguing there was no evidentiary need left to justify holding it, and that his property right in the device outweighed a police interest that, so far, had produced nothing. The State pushed back. It didn’t deny that his silence was blocking the investigative unit (it couldn’t), but it argued that continuing technological developments might still open the device. The court sided with the State: it held that the data on the phone carried real evidentiary potential, that material recovered from it could serve as evidence at trial if access became possible, and it refused to order the phone returned.
Notice what’s missing: nobody ordered him to hand over the code. That’s worth sitting with.
The right to silence didn’t move. Neither did the phone.
Israeli criminal procedure protects a suspect’s right not to incriminate himself, and no reported Israeli ruling has forced a suspect to speak a passcode aloud. Courts have gone as far as compelling a physical act, like a fingerprint, to unlock a device, but not a spoken code pulled from memory. Still, the privilege stops at the suspect’s mouth. It doesn’t require the State to hand back a piece of physical evidence just because the suspect won’t help open it. So the phone stays exactly where it is. The State keeps trying. And the only thing standing between “still investigating” and “indefinite seizure without access” is time and proof of effort.
That’s a forensic and technical question, not a rhetorical one. And it’s exactly where cases like this get decided by people who never learn to ask it properly.
The extraction log is the artifact, not the passcode.
A generalist lawyer arguing this case reaches for property rights and delay. A generalist IT witness explains, in the abstract, that “modern encryption is very strong.” Neither one gives the court anything it can actually test.
What the court needs is the forensic-extraction attempt log: every access attempt the State’s tooling made against that specific device, the partial images it produced if any, the hash values used to verify each one, the device’s encryption state and chip generation, and the elapsed time between seizure and the hearing. Hash-verified images and a documented extraction record are baseline under mobile-forensics standards, not a courtesy. Cellebrite’s UFED, the platform most associated with mobile-device extraction in Israeli police work, is built to produce that kind of documentation. That log is the difference between “we are actively trying, and here is the technical reason it’s slow” and “we seized a phone and parked it on a shelf.”
A court-appointed software expert reads that log the way a court-appointed accountant reads a ledger: define the narrow technical question (has the State made a genuine, competent, proportionate attempt to access this specific device?), list exactly what was produced, apply a repeatable method to assess it against what the tooling can actually do, state plainly what can’t be verified from the record, and be ready to explain all of it under cross-examination. That opinion is testable. “Encryption is strong” is not.
What an expert witness must show in a phone-seizure case
If you represent the suspect: don’t just ask for the phone back. Ask for the extraction log, every attempt logged in it, and the technical basis for the State’s claim that “developments” might still open it. If that log is thin or stale, that’s your argument for return, not an abstract property-rights claim.
If you represent the State: don’t wait to be asked. A documented, competent, time-stamped extraction record is what turns “we’re still trying” from an assertion into evidence a judge can actually rely on.
Either way, the fight was never about the passcode. It’s about whether the technical effort behind that seizure can survive being tested in open court.
In a case like this what decides it is a software expert witness written to hold up under cross-examination.
This article discusses a published court decision for legal-education purposes only. It is not legal advice. Verify the current status of the case and consult counsel before relying on it.