Ricochet is the best place on the internet to discuss the issues of the day, either through commenting on posts or writing your own for our active and dynamic community in a fully moderated environment. In addition, the Ricochet Audio Network offers over 50 original podcasts with new episodes released every day.
Apple’s iPhone Blunder
Can the United States government compel Apple to help break into the phone of Syed Rizwan Farook, who, along with his wife Tafsheen Malik, gunned down fourteen innocent people last December at the Inland Regional Center in San Bernardino? That question has sparked fireworks in recent days. The dispute arises because Apple has equipped its new iPhones with encryption settings that erase the data contained on the phone whenever ten false password entries have been made. It was agreed on all sides that only Apple has the technology that might overcome the encryption device.
In her short order of February 16, Magistrate Judge Sheri Pym instructed Apple to offer that assistance, pursuant to the All Writs Act, which dates back to the First Congress in 1789. The heart of the matter lies in whether the government—more specifically the FBI—can require computer companies to build in back doors to their systems to allow the government to enter.
I participated in hearings that then-Senator John Ashcroft held in March 1998, and spoke in opposition to the measure, along with Kathleen Sullivan, then a professor of law at Stanford Law School. The greatest risk of the built-in back door is that the government will not be the only party that will enter through it. Back doors necessarily compromise the integrity of a security system. There were therefore serious constitutional as well as practical objections to these early proposals. It would be highly dangerous to allow the government to seize confidential data sources without first obtaining a search warrant, except in conditions of genuine emergency. And the loss of confidential data through theft gives rise to serious risks to vital data, for which compensation from the government, assuming that it were available, could never repair the damage or restore the confidence that people have within the system.
It should not be supposed however, that the proposals that were bandied about in 1998 reflect the state of play on the ground today. The first myth to dispel is that the current case has anything to do with data privacy at all. On the day the order was issued, Apple CEO Tim Cook posted a strong message to his customers denouncing the government. Unfortunately, Cook gave away the privacy game when he noted that Apple had cooperated with the government by turning over all data pursuant to a valid search warrant. The difficulty here is that the information that was sought from Farook’s iPhone had not been backed up, so that the government could not conduct a simple search on its own to get it. Instead, it had to attack the encryption systems built into the phone itself.
In dealing with that issue, it is important to note that Farook did not own the phone; his employer did, and it gave consent to the search. This knocked out any Fourth Amendment claim that the government intended to perform some unreasonable search and seizure. The point is true, but also inconsequential, that the legal situation would not materially change if Farook had used his personal password on his very own phone. The Fourth Amendment states, “no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.” Clearly, these requirements were satisfied when the government identified the iPhone to be searched, knowing that its possessor had committed mass murder. One of the tragic gaps in Cook’s letter is that he ignores the strength of the government’s Fourth Amendment case. He also fails to explain why granting the government’s request necessarily involves the compromise of the privacy of millions when only one iPhone is at stake.
Cook skirted the Fourth Amendment issue. Instead, the gist of his claim is contained in the following misguided sentence: “Rather than asking for legislative action through Congress, the FBI is proposing an unprecedented use of the All Writs Act of 1789 to justify an expansion of its authority.” Every part of this sentence is misguided. First, there are thousands of government applications each year under the All Writs Act; there is no reason whatsoever why the government has to seek to pass new legislation to cover a situation that is amply covered by current laws.
Nor is Cook correct in insisting that the All Writs Act does not cover this particular case. The relevant portion of that short statute reads: “all courts established by Act of Congress may issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.” Terms like “necessary,” “appropriate,” “usages,” and “principles” were chosen precisely because Congress did not want to pin judicial discretion to particular technologies known in 1789 or any subsequent date. That language is no more problematic than the text of the Fifth Amendment, which holds that the United States shall not deprive any person “of life, liberty or property, without due process of law.”
No one doubts that these terms can give rise to difficult cases at the margins. But it hardly follows that Apple’s case is one just because it hogs the headlines. Cook attempts in his letter to stake out a per se rule that it is somehow outside the scope of the All Writs Act to require any company to work with the government in overcoming technological barriers. The case law on this question is well settled, and the government brief has assembled an impressive list of precedents in which private parties have been required to assist the government in its legitimate enforcement efforts. These include “ordering a phone company to assist with a trap and trace device” or having a company “assist in accessing a cell phone’s files so that a warrant may be executed as originally contemplated.” It is also the case that Apple had assisted the government without complaint in over other 70 cases.
To be sure, the order here is more complex than those imposed in other cases, but the legitimate government interest in the document is more compelling than those other cases, so that perhaps it is more accurate to say that what is truly unprecedented is that any company would seek to defy the government when the stakes are so high. Right now, Apple is worried that assisting the government will tarnish its brand. Cook may well be wrong. The better strategy might be to insist on the narrowness of the order, thereby avoiding the current soap opera. But Cook seems intent on turning the case into a heroic struggle, by making some dubious leaps of logic:
If the government can use the All Writs Act to make it easier to unlock your iPhone, it would have the power to reach into anyone’s device to capture their data. The government could extend this breach of privacy and demand that Apple build surveillance software to intercept your messages, access your health records or financial data, track your location, or even access your phone’s microphone or camera without your knowledge.
This parade of horribles is unworthy of Apple. Judge Pym knows full well that a balancing test is implicit in any application of the All Writs Act. She therefore made it clear that Apple’s efforts are narrowly limited to the task of uncovering this requested information from this device, and no other; that Apple may limit the government to the remote access needed to unlock the passcode by brute force; and that Apple could protest the order within five days if it believed compliance with its terms would be “unreasonably burdensome.” Her order does not pave the way for the government to unilaterally insist in the next case that Apple must disclose the private information of millions of people.
Remember the central motif of the All Writs Act is one of balance and proportion. Allowing the government to win in one case under dramatic circumstances does not give it carte blanche to do whatever it wants in other cases. I strongly opposed the push for a mandatory built-in back door in 1998, and I would oppose one today. But, again, it is irresponsible hyperbole for Cook to write that “it would be wrong for the government to force us to build a backdoor into our products.” That broad request is not found in the government’s plea for a specific fix under which it need not be told anything about the technology that Apple will use in order to overcome the data protection feature on its iPhone.
Other defenses of Apple’s legal position are no better. Writing in The New Yorker, Amy Davidson also resorts to improbable scenarios to find the government’s request dangerous. She writes: “If it can tell Apple, which has been accused of no wrongdoing, to sit down and write a custom operating system for it, what else could it do?”
Once again, this reasoning is flawed. Of course, the All Writs Act applies to persons who are accused of no wrong. Persons who have been accused of no wrong still have to comply with warrants or subpoenas in cases in which their noninvolvement is wholly beyond dispute. The government can and does often compel labor in these situations. The hard question again is whether the need for the evidence trumps any broad claim for privacy, which given the specificity of the request of Apple, it surely does. Nor is Apple being asked to make an operating system. The government just wants to find the password without destroying the data. And as to the last question, the burden is always on the government to explain what it needs, not for any private party to parry an infinite set of government claims.
Davidson is on even weaker ground when she muses that the government might use its power to further violate the rights of individuals: “Could an imam, for example,” she writes, “be asked not only to tell what he knows but to manufacture an informant?” In posing her hypotheticals, Davidson takes no note whatsoever of the undisputed point that the only party to whom the government could turn for this assistance is Apple itself.
It is a commonplace of the law of common carriers that anyone who has a monopoly over some public utility or common carrier can be required to offer service on reasonable and nondiscriminatory terms. The existence of the monopoly is the justification for the extra burden. The government’s case against Apple is perfectly analogous to the common carrier situation insofar as the services it demands cannot be competitively provided. But when it comes to finding informants, the government is just as able, indeed more able, to do that by itself, which is why it never makes such silly requests under the All Writs Act.
Davidson concludes her think piece with a misguided flourish. In using the All Writs Act, she argues, “the government is attempting to circumvent the constitutionally serious character about many questions about encryption and privacy.” Nonsense. There are no constitutional issues raised by this government demand, even if some such claims might arise in other circumstances. The Wall Street Journal reports that Apple has hired two “heavyweight” at the prestigious law firm Gibson Dunn, Theodore Olson and Theodore Boutrous. Both are great lawyers who will have their work cut out for them.
© 2016 by the Board of Trustees of Leland Stanford Junior University
Published in General
I’ve seen this metaphor regarding the Apple/FBI case quite a bit lately. It services the idea very well.
You said this on the podcast, too. My knowledge of public key encryption is college linear equations -or matrix algebra -I forget -but my recollection is that the things are all but impossible to break, even with a million super computers trying to factor the integers to find the right primes. Hence why the FBI wants to go after the easy part of the encryption: breaking the private key PIN.
One of my students, who is more excitable than trustworthy, is convinced that the FBI can short out the system that would wipe the phone’s memory, and then they could brute force it open -but I find that hard to believe both because if it were true, and my random student knew it, then Apple security is a joke and they should do what the FBI wants just to hide their screw-up, and also because because I do not believe that any solution that involves shorting out an electronic device is fool proof.
As I recall there was in fact a flaw discovered in Apple’s security where it would check the pass code, then decrement the count of tries remaining, and someone built a system that would input a code, then if it failed cut the power and force the system to reboot before it had time to subtract from the remaining tries, and thus get an unlimited number of guesses — though it would take a while to brute force since you had to reboot the phone after each wrong guess.
In any case, once the hack was disclosed Apple fixed it by decrementing the counter before checking the pass code, so this attack no longer works.
No, the device does not have a backdoor at this time. Apple Inc., being the company that created the IPhone is capable of creating a backdoor because it has the employees and blueprints that designed and made the product in the first place. However, they never created a backdoor because they wanted to ensure the security of the device.
If the IPhone were a house; Apple Inc. is the house owner. As the house owner, they have the resources, capabilities and rights to physically cut out a door out in the back wall of the house. However, they don’t want to because once they do so, the house is vulnerable to skilled lock-key thefts who can use that backdoor as a weak-spot of entry. The Feds are demanding that they physically create a backdoor, and working to secure a precedent where all houses must have a backdoor that the government has a key to.
While that might not take the form of a law, it will take the form of courts being able to order a backdoor be created anytime the Feds decide they want one. “Legislating from the bench” anyone?
This case is part of the FBI attempting to set a precedent where by tech companies will have to create all their devices with a backdoor for Law Enforcement. It is not a coincidence that this potentially landmark case happens to be related to a High-Profile Terrorist attack. The FBI knows the political game.
Apple doesn’t own the iPhone in question, it is the property of the county of San Bernardino.
The FBI has indeed told Congress they should pass a law to require this. Congress has so far refused. Good for Congress.
The Feds should not have a master key to all our encrypted communications. They should have to get a valid search warrant first. Like they did in the case we’re discussing.
And the county of San Bernadino is free to figure out how to hack Apple’s software, on that one phone, and get the data. The source code belongs to Apple, not San Bernardino.
So to continue this analogy, this is like the FBI going back to the guy who built your house a few years ago and ordering him to create an entrance that can be used for every house he’s ever built.
Semantic gotcha. The physical phone may be in the possession of the county but the iOS is still the intellectual property of Apple.
And there’s the rub. If Apple applies the crack, the cracked iOS remains on the phone as the Feds walk out the door with it. Then this vaunted one-time-only theory walks out the door, too.
The problem with judges is that they don’t ever stop and think about the damage their orders can do. Judge Pym needs to think this out further. She should supervise the whole process. Allow Apple to physically download the contents of the phone and the document the destruction of the phone and the rogue software. That way the FBI gets the contents and Apple preserves the sanctity of its property as well.
But Apple owns the software. Software is always under license. It is not “owned” by the user.
Joseph Bonneau has a piece at eff.org which discusses the problems from a technical perspective, and disagrees with Professor Epstein:
Also, in the article linked in #41, this assertion is refuted. Professor Epstein is wrong on the facts.
The “70 times before” meme has wide currency. It’s being used so aggressively that I’m beginning to wonder whether it originated as disinformation rather than from laziness.
It is not just the software. It is the private key that Apple has that is needed. In the next generation Iphone Apple could etch the 10 tries and the pbone is erased into the processor in a way that no firmware could update. It is unwise to not comply with with a reasonable request under court order and with the permission of the phone order.
Apple will spend more on lawyers than compliance. I know it is not as simple as change a variable from 10 to a very large number, but it is not that much more difficult, especially for a one-of piece of software that only has to operate on one phone. Please note that the encryption is not being broken or compromised for other phones. The software fix is just allowing this particular phone, in the possession of the FBI with a court-order and permission of the owner, to be brute forced. Afterwards, Apple could delete its new software and insure that in future manufactured phones that the 10 tries and your out is hard-wired in the phone in a way that cannot be changed by firmware. Even with the software, without Apple’s private key, nothing can be done other phones.
I don’t like the idea of constructing the nation’s data infrastructure so that everything is easily accessible to Law Enforcement with a warrant.
Not only is arranging our lives in preparedness for the Search Warrants costly to our privacy, it presumes guilt without due process.
And the Feds are free to execute it. They’re not free to force a separate, private entity to execute it for them or to help them do so. The pen register case was a matter of tracking a single phone. This is a matter of generating a means for government to force entry into all phones, at government’s behest.
The Apple case is a clear demonstration of the Court’s error in leaving room for a too-broad interpretation left possible by the pen register case.
Hopefully the Court will side with Apple and tighten if not correct their error.
Eric Hines
Don’t get hung up on ownership in this case. That’s important regarding who gets served with what warrant, but the critical item here is the cracking itself. What the FBI is demanding be done, even if they truly do only want entry into this particular phone (arguendo–for anyone who actually believes that, I might know of some beachfront property north of Santa Fe that might interest you), is a generic entry process that will work on any phone that uses the entry algorithm that the FBI wants to bypass.
Which puts the brand-spanking new software, written specifically to bypass the entry process, in the government’s hands. Either the judge or the FBI will need to have their IT forensic specialists present to watch the whole thing so as to ensure the evidence is being downloaded fully and without tampering. These specialists will be watching and recording most carefully.
By the way: pursuant to another thread on the Member Feed, it’d be nice if Mr Epstein were to offer his thoughts on this discussion.
Eric Hines
Sure. The current request under court order is entirely unreasonable, though.
Eric Hines
Yep. So simple, even an FBI IT specialist can do it. No need for Apple’s dragooned involvement.
Please note that the entry lock bypass algorithm is being broken and compromised for all other phones that use that entry lock algorithm. This is why the FBI is demanding, though a court precedent, that Apple do it, rather than doing for themselves what you’ve asserted to be a simple thing to do.
The FBI wants the precedent.
Eric Hines
They need the signature from Apple.
They need the signature, which will be attached to the UID for the phone. If the FBI even got the firmware update -which the court order says Apple can keep as proprietary -it would be useless to other phones because the UID is difference and they need the signature.
What precedent? That they can get third parties to help serve warrants? We’ve had that precedent for 200 years.
Richard & all,
The deeper you delve into information technology the more variables you now know exist and thus you are reticent to make blanket statements.
In this situation, I will give what I think is a proper analogy. Let us say that there is a Hotel. At the Hotel there is a party staying in a room that the FBI has very specific knowledge is an immediate threat. The FBI gains a proper warrant to search the room. The Hotel has a passkey that opens all of the rooms but doesn’t want to let the FBI into the room.
The Hotel should be forced to help the FBI enter the one room. The Hotel must not be forced to give the passkey (or allow it to be copied) by the FBI. This protects others at the Hotel presently or in the future from an unlawful search.
Regards,
Jim
Here we go:
“Apple Accused of ‘Providing Aid to Kidnappers, Robbers’ By NYPD Counterterrorism Chief”
We must all run our lives for the convenience of our LEOs.
And once they have a copy of the unlock tool, they’ll modify it not to check the UID. Then all iPhones will be vulnerable.
The precedent that if a company produces a security system that is difficult to break, the company can be forced to break it for them.
Point of fact: Altering the UUID check would not be possible without changing the hash value of the software, which would render the signature (and the software) useless.
If the FBI could fake Apple’s root certificate, they could sign any software they wanted to in order to make it compatible with the iPhone. Of course, if they could do that, they wouldn’t need Apple’s help in the first place.
This is indeed what they want to set as precedent.