Kapila Chandrasena Phone Data: What Can Apple Really Provide Under a Sri Lankan Court Order?

The SriLankan Airlines Airbus investigation raises a wider question about how Apple responds to foreign court orders

Colombo Fire Investigative Desk

The investigation into former SriLankan Airlines Chief Executive Officer Kapila Chandrasena has now entered an important digital-evidence phase, with Sri Lankan authorities seeking access to data associated with his mobile phone.

The Criminal Investigation Department (CID) informed the Fort Magistrate on 9 September that a court order obtained in relation to the phone data had been forwarded to the relevant telecommunications company in the United States on 18 August. The development came during the continuing magisterial inquiry connected with the SriLankan Airlines Airbus investigation.

The development raises a significant question for investigators and the public:

What can Apple actually provide when a foreign court orders the company to hand over information relating to an iPhone?

The answer is considerably more complicated than the phrase “unlocking an iPhone” suggests.

Apple does respond to court orders

Apple operates a global legal process for handling government and law-enforcement requests.

The company states that government authorities around the world can submit legally valid requests for customer information. Depending on the jurisdiction, these may include court orders, warrants, production orders, judicial requests and other forms of legal process.

Apple says its legal team reviews requests to determine whether they have a valid legal basis. Where the request is valid, Apple says it provides data responsive to the request. Where a request is unclear, overbroad or lacks a valid legal basis, Apple may challenge or reject it.

Apple also publishes country-specific transparency information, including for Sri Lanka, demonstrating that the company has an established framework for handling government requests from jurisdictions around the world.

Therefore, a Sri Lankan court order does not automatically mean that Apple will simply open an iPhone and hand investigators everything stored on it.

There is a legal and technical process.

The crucial distinction: phone data versus Apple-held data

This distinction could become critical in the Chandrasena investigation.

An iPhone may contain information stored directly on the physical device. It may also communicate with Apple's services and an Apple Account, potentially creating information stored in Apple's systems.

Those are not necessarily the same thing.

Apple's transparency documentation says account requests can seek information associated with an Apple Account, including account-holder information and connections to Apple services. Depending on the circumstances, requests may also concern content such as photos, email, device backups, contacts and calendars.

Consequently, investigators seeking evidence relating to a suspect's phone may need to identify precisely what information they are asking Apple to produce.

The request could concern an Apple Account.

It could concern iCloud material.

It could concern device identifiers.

It could concern connections to Apple services.

Or it could concern other information that Apple actually possesses.

But can Apple unlock a modern iPhone?

Here lies the biggest misconception.

Apple's published legal-process guidelines state that for devices running iOS 8 and later, Apple is unable to perform an extraction of data from a passcode-locked iOS device because the relevant data is encrypted and Apple does not possess the encryption key.

Apple's guidelines also state explicitly that it does not have access to the user's passcode.

That means a court order does not necessarily give Apple the technical ability to bypass the passcode of a modern iPhone.

The court can order Apple to provide information that Apple legally and technically possesses.

It cannot necessarily order Apple to perform a technical operation that Apple says it cannot perform.

This distinction is fundamental.

The San Bernardino precedent

The issue is not new.

In the United States, Apple famously fought a government demand relating to the iPhone used by one of the San Bernardino attackers.

The US government sought an order requiring Apple to assist in accessing the device. Apple opposed the demand, raising concerns about creating a tool that would weaken its security protections.

The litigation ultimately ended after the US government obtained assistance from a third party and informed the court that it could access the phone without Apple's assistance.

The episode became one of the world's most significant legal and technological confrontations over encrypted smartphones.

It also demonstrated the difference between legal authority to seek evidence and technical ability to obtain encrypted evidence.

What happens when another country issues the order?

Apple's published international guidelines recognise legal requests from countries outside the United States.

Apple says international requests must comply with applicable legal requirements. Its transparency materials also explain that requests from foreign governments may sometimes proceed through mechanisms involving the United States government, including Mutual Legal Assistance Treaty arrangements or other cooperative procedures.

This becomes particularly relevant when a Sri Lankan investigation seeks information held by a company or service provider in the United States.

The Sri Lankan authorities therefore have to ensure that the legal request reaches the appropriate Apple entity and satisfies the applicable requirements.

In practical terms, the process is not simply:

Sri Lankan judge → Apple → iPhone unlocked.

It may instead involve:

Sri Lankan investigation → court order → appropriate legal process → Apple legal review → identification of data held by Apple → production of responsive material.

Why the Chandrasena case matters

The Chandrasena investigation is significant because digital communications can potentially establish relationships, chronology and communications surrounding transactions.

But investigators must distinguish between information that may be stored by Apple and information that exists exclusively on a locked physical device.

If the relevant evidence is contained in an Apple Account or iCloud service and Apple possesses the material, a properly drafted and legally valid request may potentially result in its disclosure.

Apple's own iCloud terms acknowledge that the company may access, preserve or disclose account information or content where legally required or where it has a good-faith basis that disclosure is necessary to comply with legal process.

That does not mean every item will automatically be available.

Some information may be encrypted in a manner that prevents Apple from decrypting it.

The encryption barrier

Modern Apple security architecture is specifically designed to prevent even Apple from possessing unrestricted access to a user's protected information.

Apple states that it has never created a backdoor or master key for its products and services and says it has never allowed a government direct access to Apple servers.

This is why a court order should not be described inaccurately as an order to “force Apple to unlock an iPhone.”

The legally and technically accurate description is that the authorities have sought data through Apple's legal process.

Whether Apple can provide the requested information depends on what data exists, where it is stored, what encryption protects it, and what legal process applies.

The evidence trail may extend beyond Apple

There is another important aspect for investigators.

A mobile phone does not operate in isolation.

Even where Apple cannot provide the contents of a locked device, investigators may potentially obtain relevant evidence from other sources, depending on the circumstances and applicable law.

These could include telecommunications records, subscriber information, network records, financial records, email services, cloud services, corporate records and communications held by other parties.

The investigation should therefore not depend upon a single technological gateway.

A test of Sri Lanka's digital-investigation capability

The Chandrasena case could ultimately become an important test of Sri Lanka's ability to pursue complex international digital evidence.

The country may obtain a perfectly valid court order.

But obtaining the order is only the beginning.

Investigators must understand the architecture of the technology, identify the correct custodian of the evidence, use the correct international legal mechanism and formulate requests sufficiently precisely for the foreign company to process them.

Apple's transparency system demonstrates that this is a routine part of modern international law enforcement, with Apple receiving government requests from jurisdictions across the world.

The question now before investigators

The critical question is therefore not simply:

“Will Apple unlock Kapila Chandrasena's phone?”

The more accurate question is:

“What data relating to Kapila Chandrasena does Apple possess, what data can legally be obtained under the Sri Lankan court order, and what information can Apple technically provide?”

That distinction could determine how much digital evidence investigators ultimately obtain.

If Apple possesses responsive account or cloud data and the Sri Lankan request satisfies the applicable legal requirements, the company has a mechanism for reviewing and responding to the request.

But if investigators are seeking the contents of a modern, passcode-locked iPhone itself, Apple's published position is clear: for iOS 8 and later, Apple says it cannot perform the device extraction because it does not possess the encryption key.

The outcome of the Chandrasena request will therefore provide an important indication of how effectively Sri Lankan investigators can navigate the increasingly complicated intersection of criminal investigations, international judicial cooperation, cloud computing and end-to-end encryption.

And in an investigation involving alleged international aviation transactions, that digital trail could prove to be just as important as the paper trail.