Yeah it was unlocked. My friend said what they did initially was to completely disconnect it from all cellular networks so Find My couldn't remotely disable it. This also meant they couldn't connect to cloud services but there was enough data/documents stored on the device that they still were able to get his SSN, Passport, cached messages, etc.