They would need physical access to the device and know your unlock code.