Your Bear Phone Client Guide

A Bear phone is a locked-down phone that Watchmen Investigations sets up for a specific job. This page explains, in plain language, what it does when it is in your hands and what you will see if your investigator backs up your iPhone onto it.

This guide is for clients. It describes what you will see and what you agree to. It does not cover how Watchmen staff manage the phones.

What a Bear phone is

It is an Android phone that only runs one app, the Watson app. It is not a general-purpose phone: there is no app store, no browsing, no messaging, and the usual Android settings are not reachable. That is on purpose. A phone that can only do a few things is much harder to tamper with, and nothing you do on it can leak into a normal phone account.

Staff can lock it from the office, and it checks in with Watchmen's system every few minutes.

If a phone is assigned to you

Your name is on it. The lock screen and home screen show who the phone is assigned to, so there is no doubt it is yours for this engagement.
You see your own open cases only. A short brief for each open case. You do not get a portal login on the phone and nothing else from the portal is visible.
It unlocks with a code from us. Your investigator or case manager gives you the code. Guessing is deliberately slow: after 5 wrong tries the phone makes you wait 30 seconds, and the wait grows with more wrong tries, so a thief cannot simply try combinations.
Swipe up or touch to enter the code. The lock screen is the app's own screen, not Android's. If it looks different from a normal phone, that is normal.
It signs itself out if it loses contact. The phone has to reach Watchmen's system at least every 5 minutes. If it cannot (airplane mode, no signal, switched off for a while), it signs out and erases its local copy of your information. When it reconnects it signs back in by itself. So: keep Wi-Fi or mobile data on, and keep it charged.
Wi-Fi. The Wi-Fi tile lets you join a network (enter its password). Only an administrator can remove a network afterwards.

What the phone reports back

Because it is a managed device, it tells Watchmen's system its battery level, whether it is online, roughly where it is, and which app version it runs. It also keeps a security log of unusual activity on the device itself, for example repeated wrong unlock codes or something probing the phone. It is a separate device, so it cannot see anything on your personal phone. The one exception is an iPhone backup you agree to (below). If you have a question about what is logged for your engagement, ask your investigator.

The Bug Sweep tile

The phone can walk a room looking for signs of hidden transmitters, cameras and other bugs, using its radios, sensors and camera. On a client phone the sweep is kept on the device (it is not filed under a case automatically). Your investigator will tell you when and how to use it. It is a screening aid, not a replacement for a professional sweep with specialist equipment, and a clean result does not prove a room is clear.

Lost or stolen

Tell your investigator or Watchmen right away. Staff can end the phone's access and tell it to erase itself from the office, immediately if it is online, or the first time it reaches the internet. You do not need to do anything on the phone itself.

If your investigator backs up your iPhone

Sometimes a case needs a copy of what is on your iPhone (for example, to preserve messages as evidence). The Bear phone has an iPhone Backup tool for that. Its first screen is a consent screen, and nothing is read from your iPhone until you agree. Here is the whole flow, one screen at a time.

Step 1: Consent

The investigator hands you the Bear phone. The screen reads "The owner must agree first" and lists what you are agreeing to. Tap What they agree to to read it. The statements are:

I am the owner of this iPhone, or I have the owner's permission to back it up.
I understand this copies personal data from the iPhone (it may include photos, messages, contacts and app data) onto this Watson device.
I understand the copy stays on this device, is handled only by Watchmen staff, and is kept until it is delivered or deleted.
I understand I can stop at any time by unplugging the iPhone, and can ask for the copy to be deleted.

Type your full name, tick The owner has read this and agrees, and press Continue. Your name, the time and the exact wording you saw are written to a record. Your agreement is good for 15 minutes; if you have not finished connecting by then, it expires and you simply agree again. You can tap End session at any point to withdraw it.

Step 2: Connect

Plug the iPhone in with a USB cable and keep it unlocked. A cable adapter or a powered hub often helps.
The Bear phone shows a pop-up asking to use the USB device, with an arrow pointing at it. Tap Allow.
Press Connect. Your iPhone asks Trust This Computer? Tap Trust and enter your iPhone passcode if asked. You enter the passcode on your own iPhone. Without your tap, nothing can be copied: this prompt cannot be skipped.

If the screen says Charging only, the cable is only charging the phone. Tell your investigator; the usual fix is a different cable, an adapter or a powered hub. Also note that an iPhone goes back to charge-only about an hour after it was last unlocked, so keep it awake.

Step 3: Choose what to copy

The screen shows your iPhone's name, model and iOS version and asks "What do you need?". You and the investigator tick only what the case requires:

Messages, notes, contacts, calls: the fastest option, usually a few megabytes. You can narrow it further to just Messages, Notes, Contacts or Calls.
Photos, Videos, Music, Voice recordings, Documents and books: the screen counts the files and shows a size and time estimate for each.
Everything else Apple includes: Apple's own system backup. It is the largest and slowest piece.

Choosing less means less personal data leaves your phone and a shorter wait. The backup stops as soon as the chosen items are saved. If an earlier backup of this iPhone was interrupted, you are offered Continue it or Start new.

Step 4: The backup runs

The screen shows what is being copied right now, how long it has been going and how much is saved. Roughly once a minute it saves a checkpoint. A checkpoint is a safe point to resume from, with a one-sentence summary of what is in it.

Stop (keeps what is saved) ends it at any time. Whatever was already copied is kept.
If the cable comes out or the connection drops, the screen says Backup paused. Nothing is lost: plug back in and it continues exactly where it stopped. If you would rather not continue, choose Cancel this backup; nothing more is copied.
How long? The cable limits the speed to roughly 25 to 35 MB per second at best, so a full photo library can take hours. That is why choosing only what is needed matters. Apple's system data is slower again. The time estimates on the Choose screen are your best guide.

When it finishes

The screen says Backup complete and how long it took. Staff can then open the backup in an on-phone viewer to look at photos, messages, contacts, notes, calls and apps. That viewer asks for the phone's device code first, because the backup contains personal data. Every file is fingerprinted (SHA-256) as it is copied, and a Verify function can later re-check that nothing was altered, which is what makes the copy usable as evidence.

What happens to the copy

It is made onto the Bear phone, not onto your iPhone, and your iPhone is not changed. Nothing is deleted from it.
Only Watchmen staff handle it, and it is kept until it is delivered to you or the case team, or deleted.
You can ask for it to be deleted at any time, and you can stop at any time by unplugging the iPhone.

Questions people ask

Does the investigator see my passcode? No. You type it on your own iPhone in answer to the Trust prompt.

Can they copy everything without telling me? No. The consent screen comes first, and the iPhone's Trust prompt needs your own tap and passcode.

Can I choose to copy only some things? Yes, that is the Choose step. Say what the case needs and tick only that.

What if I change my mind? Unplug the iPhone or tap End session, and ask for the copy to be deleted.

The phone will not unlock or acts strangely. Contact your investigator or case manager. Do not try to reset it: the phone is locked down so a reset is blocked.

Privacy note. A backup can contain very personal material. Agree to it only for what the case needs, and ask your investigator what will be kept, who sees it and when it will be deleted.