Sarai Hannah Ajai Suspicious Apple iPhone 17 Activity; Unexplained Smart-Device Activation Following Passcode Change; Ongoing Emotional Distress and Reputational Harm

 INCIDENT REPORT

Suspicious Apple iPhone 17 Activity; Unexplained Smart-Device Activation Following Passcode Change; Ongoing Emotional Distress and Reputational Harm

Reporting Party: Sarai Hannah Ajai
Device at Issue: Apple iPhone 17
Associated System: Apple Mac Mini M1
Related Smart Device: SwitchBot Strip Lights
Date of Incident: March 24, 2026
Approximate Passcode Change Time: 12:50 PM
Approximate Recorded Event Time: Approximately 1:44 PM local time

I. Executive Summary

On March 24, 2026, I changed the login passcode for my Apple iPhone 17 at approximately 12:50 PM. Later that same day, at approximately 1:44 PM, a recorded video captured an incident in which my strip lights turned on automatically while my Apple iPhone 17 was lying on the desk and was not being held in my hands. At that time, I had gotten up from the desk and walked over to my Apple Mac Mini M1 in order to plug in a security key.

This incident is significant because the strip lights were not scheduled to turn on automatically. The scheduling function for my SwitchBot strip lights was turned off. I did not knowingly issue any command to activate the strip lights. I also do not share my Apple iPhone 17 with any other person, I do not share my Apple iCloud ecosystem with others, and had not provided my Apple iPhone 17 passcode to any person.

Based on those surrounding facts and circumstances, I regard this event as consistent with possible unauthorized remote access, cloning, mirroring, interception, command execution, account compromise, or other unlawful interference involving my Apple iPhone 17 or its connected smart-device control path.

This March 24, 2026 event is not isolated. I have experienced similar unexplained smart-device activations and related harassment-type behavior associated with my Apple iPhone 17 on most days, and sometimes more than once during the day. I am therefore documenting this event as a preserved evidentiary incident within a broader recurring pattern of suspicious conduct.

II. Evidence Reviewed

I reviewed the uploaded video file identified as:

“Wyze Redacted Video of the Hacker Taken control of my Apple iPhone 17 & Turning on the Strip Lights Dated 03-24-26.mp4”

My file is a MP4 video of approximately 56.9 seconds in length. The recording contains visible timestamp overlays showing activity on March 24, 2026 during the 1:44 PM timeframe. The video depicts the relevant desk area, the Apple iPhone 17 lying on the desk, movement by me away from the desk toward the Apple Mac Mini M1, and visible activation of the strip lights during the recorded sequence.

Based on the contents of the video, the recording is consistent with my factual account that the strip lights activated while the Apple iPhone 17 was resting on the desk and was not being held by me. The video therefore serves as direct evidence of the event and its surrounding physical circumstances.

At the same time, I note that the video alone does not conclusively identify the precise technical mechanism that caused the activation. It is evidence of the event itself and of the surrounding circumstances, but not by itself a complete forensic attribution of the intrusion method.

III. Factual Narrative

On March 24, 2026, at approximately 12:50 PM, I changed the passcode to my Apple iPhone 17. Later that same day, at approximately 1:44 PM, my iPhone was lying on the desk while I got up and walked over to my Apple Mac Mini M1 to plug in a security key. During that sequence, my strip lights turned on automatically even though I was not holding or actively using the Apple iPhone 17 at that moment.

This behavior was abnormal and unauthorized. The strip lights were not supposed to activate on any time schedule because the SwitchBot scheduling function had been turned off. I had not intentionally or knowingly activated the strip lights manually. I had not shared my Apple iPhone 17 passcode with any person, and I do not share my Apple iCloud ecosystem or device access with others.

Because the activation occurred after I had changed my Apple iPhone 17 passcode earlier the same day, because the phone was not in my hands when the activation occurred, and because no scheduling function was supposed to trigger the strip lights, I regard the incident as consistent with possible unauthorized external control, device cloning, device mirroring, account compromise, command interception, or comparable intrusion affecting my Apple iPhone 17 or the command path associated with the connected smart-device environment.

This event is not the only occurrence of its kind. I have experienced similar unexplained automatic activations and related forms of harassment associated with my Apple iPhone 17 on most days, and sometimes multiple times during the same day. For that reason, I consider the March 24, 2026 video to be part of a larger ongoing pattern rather than a single unexplained anomaly.

IV. Technical and Evidentiary Significance

This incident is significant from both a technical and evidentiary perspective for several reasons.

First, the Apple iPhone 17 passcode had been changed earlier the same day. That fact makes the subsequent unexplained activation of the strip lights especially concerning because it occurred shortly after a credential-security action was taken.

Second, the Apple iPhone 17 was reportedly lying on the desk and not being actively handled when the strip lights turned on. This reduces the likelihood that the event resulted from immediate, intentional physical interaction with the device.

Third, the SwitchBot strip lights scheduling function was reportedly turned off. That fact reduces the likelihood that the activation was a legitimate scheduled automation.

Fourth, I state that I had not shared my passcode with any person and I do not share my Apple iCloud ecosystem or Apple iPhone 17 access with others. That fact reduces the likelihood of authorized third-party use.

Fifth, I report that similar incidents have occurred repeatedly. This recurring pattern increases the need for log preservation, correlation review, and formal technical investigation.

Taken together, these factors support a reasonable basis for preservation of data and forensic review to determine whether the event resulted from an unauthorized account access, compromised credentials, cloned or mirrored device state, unauthorized smart-device control, token/session compromise, or another form of unlawful interference.

V. Potentially Related Federal Statutes

The following federal statutes may be relevant depending on what a proper forensic investigation ultimately establishes:

1. Computer Fraud and Abuse Act — 18 U.S.C. § 1030

If any person intentionally accessed a protected computer, smartphone, related account, or connected digital system without authorization, exceeded authorized access, obtained information, transmitted unauthorized commands, or caused damage or impairment, that conduct may implicate the Computer Fraud and Abuse Act.

2. Interception of Electronic Communications — 18 U.S.C. § 2511

If electronic communications, device-control commands, account traffic, or associated transmissions were intentionally intercepted, procured, disclosed, or used without authorization, that conduct may implicate the federal statute governing interception of wire and electronic communications.

3. Unlawful Access to Stored Communications — 18 U.S.C. § 2701

If stored electronic communications, cloud-linked records, account data, app records, or related stored information were accessed without authorization, that conduct may implicate the Stored Communications Act.

4. Fraud and Related Activity in Connection With Identification Documents and Information — 18 U.S.C. § 1028

If identifying information, authentication credentials, account-linked identifiers, or related means of identification were used without lawful authority in connection with impersonation, account takeover, or fraudulent device/account access, that conduct may implicate 18 U.S.C. § 1028.

5. Aggravated Identity Theft — 18 U.S.C. § 1028A

If any person knowingly used another person’s means of identification during and in relation to certain predicate federal offenses, aggravated identity theft may also be implicated.

VI. Emotional Distress and Reputational Harm

The repeated incidents described in this report have caused me significant emotional distress, fear, disruption, and ongoing concern for my personal security and reputation. The conduct at issue has not only interfered with my devices, accounts, and apartment home environment, but has also affected my sense of safety and stability in daily life.

I am further concerned that the broader pattern of behavior appears intended to harass, intimidate, destabilize, and create a false impression that I am mentally unstable or suffering from mental illness. I expressly deny that characterization. I include this statement not as a medical conclusion, but to document the emotional distress, stigma, and reputational harm I have experienced in connection with these repeated incidents and the surrounding hackers misconducts.

I further state that the ongoing nature of these events has compounded the seriousness of the harm. Repeated unexplained device behavior, coupled with circumstances that appear designed to undermine my credibility or create false perceptions about my condition, has substantially increased my distress and concern regarding both personal safety and reputational injury.

VII. Requested Preservation and Investigative Actions

I request preservation of all records, logs, metadata, and related technical information reasonably connected to this incident, including but not limited to:

• Apple account-access logs, trusted-device records, authentication logs, and security-event records
• Apple iPhone 17 device logs, sign-in records, account linkage data, and session information
• SwitchBot account logs, command histories, automation histories, device associations, and event records
• Wi-Fi/router connection logs, DHCP assignments, device-association records, and access logs
• Any cloud synchronization records, app authorization histories, or push-command records associated with the strip lights activation
• Any records that may reveal remote control activity, mirrored-device control, token reuse, session hijacking, unauthorized device pairing, or unlawful account linkage

I further request technical review and forensic analysis to determine whether the March 24, 2026 event resulted from unauthorized access, credential compromise, cloned or mirrored device state, unauthorized remote command execution, compromised smart-device control infrastructure, or other unlawful interference.

VIII. Reporting Position

I am not stating that the video alone scientifically proves the precise attack vector or the exact technical means used. I am stating that the recorded event, when considered together with the surrounding facts, is consistent with unauthorized interference and is serious enough to warrant formal preservation and investigation.

The combination of a same-day passcode change, the iPhone lying on the desk, the absence of manual handling at the moment of activation, the disabled scheduling function, the lack of authorized sharing, and the repeated pattern of similar incidents provides a credible and documented basis for concern that my Apple iPhone 17, associated accounts, or related smart-device control environment has been unlawfully compromised or interfered with.

I also include in this report the resulting emotional distress and reputational concern caused by the recurring nature of the misconduct and by what appears to be an effort to falsely portray me as mentally unstable. I deny that portrayal and submit this report in part to preserve a clear, factual record of the incident and its effects.

IX. Conclusion

I submit this incident report to memorialize the March 24, 2026 event as a preserved evidentiary record of suspicious and potentially unlawful interference involving my Apple iPhone 17 and associated smart-device controls. The video documents a concrete incident in which the strip lights activated while the iPhone was not being held, after a same-day passcode change, under circumstances inconsistent with ordinary authorized use.

This event, viewed together with the repeated pattern of similar incidents, supports the need for preservation of evidence, forensic investigation, and formal review. I further document that these repeated incidents have caused substantial emotional distress, personal disruption, and reputational concern, including concern that the surrounding hacker misconduct is intended to create a false appearance that I am mentally unstable, which I expressly deny.

I therefore request that this event be treated as a serious cybersecurity, privacy, evidentiary, and personal-harm matter requiring preservation and investigation.

Sincerely,

Sarai Hannah Ajai