Apple is fighting a Federal Judge’s Order that it help law enforcement unlock the iPhone used by one of the terrorists who carried out the San Bernardino attacks in early December:
WASHINGTON — A judge in California on Tuesday ordered Apple to help the F.B.I. unlock an iPhone used by one of the attackers in the assault in San Bernardino that killed 14 people in December.
The ruling handed the F.B.I. a potentially important victory in its long-running battle with Apple and other Silicon Valley companies over the government’s ability to get access to encrypted data in investigations. Apple has maintained that requiring it to provide the “keys” to its technology would compromise the security of the information of hundreds of millions of users.
The F.B.I. says that its experts have been unable to get into the iPhone 5c used by Syed Rizwan Farook, who was killed by the police along with his wife, Tashfeen Malik, after they attacked Mr. Farook’s co-workers at a holiday gathering.
Prosecutors said in a court filing that Apple had the “exclusive” means to bypass the security features on the phone, but that the company had “declined to provide that assistance voluntarily.” F.B.I. experts say that because of the phone’s security features, they risk losing the data permanently after 10 failed attempts to enter the password.
The Justice Department had secured a search warrant for the phone, which is owned by Mr. Farook’s former employer, the San Bernardino County Department of Public Health. But prosecutors said they saw little choice but to seek the additional order compelling Apple’s assistance.
In an unusually detailed directive, Magistrate Judge Sheri Pym of the Federal District Court for the District of Central California ordered Apple to provide “reasonable technical assistance” to the F.B.I. in unlocking the phone. That assistance should allow investigators to “bypass or erase the auto-erase function” on the phone, among other steps, she wrote.
In a statement, Timothy D. Cook, Apple’s chief executive, said the company would oppose the order and resist efforts to provide a “back door” to the iPhone, and he called the implications of the government’s demands “chilling.”
“For many years, we have used encryption to protect our customers’ personal data because we believe it’s the only way to keep their information safe,” the company said in the statement. “We have even put that data out of our own reach, because we believe the contents of your iPhone are none of our business.”
Prosecutors said the contents of the phone could provide crucial evidence about the attackers’ communications and contacts before the shooting.
(…)
Eileen M. Decker, the United States attorney in Los Angeles, where the investigation is being handled, said the effort to compel Apple’s technical cooperation marked “another step — a potentially important step — in the process of learning everything we possibly can about the attack in San Bernardino.”
Prosecutors “have made a solemn commitment to the victims and their families that we will leave no stone unturned as we gather as much information and evidence as possible,” Ms. Decker said.
James B. Comey, the F.B.I. director, has been at odds with Apple and other technology companies for months over whether they should provide de-encryption technology for their products. Without it, he has argued, the bureau is at risk of “going dark” in its investigations. The Democratic presidential candidate Hillary Clinton and most of the Republican hopefuls support Mr. Comey’s stance.
Apple and other technology companies say that creating an opening in their products for government investigators would also create a vulnerability that Chinese, Iranian, Russian or North Korean hackers could exploit.
More from The Washington Post:
The order, signed Tuesday by a magistrate judge in Riverside, Calif., does not ask Apple to break the phone’s encryption but rather to disable the feature that wipes the data on the phone after 10 incorrect tries at entering a password. That way, the government can try to crack the password using “brute force” — attempting tens of millions of combinations without risking the deletion of the data.
The order comes a week after FBI Director James B. Comey told Congress that the bureau has not been able to open the phone belonging to one of the killers. “It has been two months now, and we are still working on it,” he said.
The Silicon Valley giant has steadfastly maintained that it is unable to unlock its newer iPhones for law enforcement, even when officers obtain a warrant, because they are engineered in such a way that Apple does not hold the decryption key. Only the phone’s user — or someone who knew the password — would be able to unlock the phone.
The FBI’s efforts may show how impervious the new technology is to efforts to circumvent it. According to industry officials, Apple cannot unilaterally dismantle or override the 10-tries-and-wipe feature. Only the user or person who controls the phone’s settings can do so.
However, U.S. Magistrate Judge Sheri Pym said in her order, Apple can write software that can bypass the feature. Federal prosecutors stated in a memo accompanying the order that the software would affect only the seized phone.
In the statement , Cook said such a step would dangerously weaken iPhone security.
“Once created,” he wrote, “the technique could be used over and over again, on any number of devices. In the physical world, it would be the equivalent of a master key, capable of opening hundreds of millions of locks — from restaurants and banks to stores and homes. No reasonable person would find that acceptable.”
The Apple CEO said that “opposing this order is not something we take lightly. We feel we must speak up in the face of what we see as an overreach by the U.S. government.”
(…)
The phone ran on Apple’s iOS 9 operating system, which was built with default device encryption. When a user creates a password, that phrase generates a key that is used in combination with a hardware key on a chip inside the phone. Together, the keys encrypt the device’s data.
If the autowipe function is suspended, the FBI can run a massive number of combinations of letters, symbols and numbers until the right combination is found.
But there’s a complication.
If the combinations are run on the phone itself, the process can be painfully slow, taking, according to Apple, 5½ years for a six-digit lower-case password mixing numbers and letters.
If run on a supercomputer, it can be done many thousands of times faster. But to do it that way, the FBI would need the hardware key, which is built into the phone. Apple says it does not keep a copy of that key. To get that key, one could use a number of techniques, including melting the plastic off the chip and hitting it with bursts of lasers or radio frequencies to recover bits of the key.
Matthew D. Green, a cryptography expert at Johns Hopkins University, said the FBI could crack a six-digit numeric code in about 22 hours.
“But once there’s numbers and letters, that’s when things get interesting,” he said. “It might take 10 years to crack a strong password on the phone, which means they might be stuck till 2026.”
The government requested the order under the All Writs Act, a law dating to the colonial era that has been used as a source of authority to issue orders that are not otherwise covered by a statute. Though Apple has previously complied with court orders under that statute to retrieve data from iPhones running earlier versions of its operating system, it is now resisting such an order in a separate iPhone case in Brooklyn. That case, unlike the one in California, involves a phone with software that allows the firm to extract data.
The government contends that courts over the years have issued orders based on that law for the unencrypted contents of computers, for credit card records and for security camera videotapes. It noted that the Supreme Court in 1977 held that the law gave courts the authority to direct a phone company to execute a search warrant for numbers dialed by a particular customer.
Some legal scholars, however, said the use of the All Writs Act in the California Apple case presents a slippery slope issue. “If the writ can compel Apple to write customized software to unlock a phone, where does it end?” said Ahmed Ghappour, a professor at the University of California’s Hastings College of the Law. “Can the government use it to compel Facebook to customize an algorithm that predicts crime? It’s not clear where the line will be drawn, if at all.”
Not surprisingly, this story is raising many of the same issues regarding the conflict between privacy and individual liberty on the one hand and the governments needing access to the proper tools to investigate criminal and terrorist activity on the other. From the government’s point of view, obviously, this is an easy issue. The government says it needs access to the data on the phone in order to determine if Farook and his wife had contact with domestic or foreign terror suspects or potential co-conspirators in advance of the attacks, and if that means that Apple has to sacrifice the commitments it has made to its customers regarding the security of their data and their phones, then so be it. From Apple’s point of view, there seem to be a myriad of issues motivating the decision to take what has the potential to be an unpopular decision given the circumstances of this case. First of all, there is the fact that ever since the company made the decision to strengthen security on its phones in a manner that essentially allows customers to encrypt data in a manner that makes it nearly impossible to access without the appropriate pass code, the concerns about data security have only become more prominent and that providing a backdoor that does not exist right now would only serve to make the data itself less secure overall. Second, as the Post article notes the use of the All Writs Act in this manner appears to be unprecedented and, if upheld, would essentially allow the government to do almost anything in the name of law enforcement and intelligence gathering. Finally, and perhaps most strongly, it’s important to note that law enforcement isn’t asking Apple to provide information that it already has, which is what an ordinary search warrant does. It is essentially asking a Federal Court to compel Apple to do something, in this case create a backdoor that does not exist. This arguably falls well outside the scope of the Fourth Amendment and, if upheld, would give law enforcement authority to compel technology companies to do almost anything conceivable in the name of a purported investigation or surveillance of a target. That seems to go well beyond what the Constitution and existing law permits law enforcement to do.
This is a debate that has been ongoing ever since Apple announced the changes it was making to the operating system for its mobile devices that would increase security, changes that Google soon adopted on its own for the Android operating system. Almost immediately after the announcement was made, various law enforcement officials claimed that this would make it harder for them to do their jobs and the Director of the Federal Bureau of Investigation hinted that the Bureau may seek a legislative fix that would essentially purport to compel Apple and Google to provide the FBI and other agencies with a backdoor into encrypted phones. To date, it doesn’t appear that any real action has taken place in that area in Congress, though it’s possible that may change now that the new technology has become an issue in the San Bernardino investigation, although it’s unclear whether or nor there is even legislation on this issue pending in either the House or Senate and not at all clear whether any such proposed legislation would pass scrutiny in Court.
In any case, as things stand it strikes me that Apple has the better argument in this matter. Notwithstanding the intelligence value that might be contained in the phone, the overall issue of liberty and security that would be adversely impacted if the Court’s order stands in this case is too important for Apple to simply give in to the government’s demands without having the matter tested in the relevant courts. Additionally, the fact that the government’s request here involves something far beyond simply asking Apple to pass along information it already has in its possession sees to place this outside of the kind of investigatory methods permitted by the Fourth and Fifth Amendment and amounts to a precedent that states that the government should be free to ask any company to do something to make it easier to access data over which it does not have either custody or control. Because of that, Apple is correct to be fighting the good fight here and should take the matter as far through the appellate system as it can, because the implications of this order standing are far too broad reaching to be left to a Magistrate Judge in California.
