9 ms·

A thought experiment: Let's say the government makes hardware encryption standards in the style of FedRAMP that sets standards for preventing tampering by forei

A thought experiment: Let's say the government makes hardware encryption standards in the style of FedRAMP that sets standards for preventing tampering by foreign governments. Then, imagine that a consumer electronics company voluntarily makes all devices comply with this standard. Could a court attempt to compel the company to defeat the standards which the government set as tamper-proof against governments? A second: What happens if Apple states that it will take a 50-person team with an average annual labor cost of $200K/person approximately 5 weeks to fix the problem with a 50% chance of success. Can Apple bill the court a million dollars to try to fix the issue? A third: Apple open-sources their encryption modules and firmware. They no longer have proprietary information for how to unlock the phone. Are they legally required to be the ones who defeat a system to which they hold no proprietary information? A fourth: The small team that built the system no longer works for Apple. Perhaps their visa was revoked and they left the country, perhaps they were poached by a competitor, or perhaps they retired in the years since this module was published. Who is responsible for complying with the order? A fifth: The data is actually corrupted. Apple presents this conclusion under penalty of perjury after a thousand hours spent on the project, which it requests are compensated. A sixth: Apple requests that trading of its stock is frozen for one month while it expends considerable resources on complying with an unexpected court order relevant to national security.

Spooky23 11y ago
Ironically, many .gov organizations are rolling out iPhones by the thousand because of the strong security controls available on the platform.
- bcook 11y ago
  Cite your source(s), please.
  - seibelj 11y ago
    I worked in government mobile security for many years, until last November. Many agencies are indeed rolling out iPhones and scaling back on blackberries finally
  - hguant 11y ago
    Blackberry's collapsing business model.
    - chenster 11y ago
      Why is that?
      - bardworx 11y ago
        Poor sales, major benefit of blackberry overshadowed by other services (BBM), late to adjust to the times, etc. I doubt you were suggesting that BB's downfall is rooted in their encryption, however. In the slim case that it did, they didn't speak up about backdoors and letting .gov into their devices until 2015, way after their market share has shrunk.
        Fundlab 11y ago
        While I havent seen heavy market in that aspect there appears to be some level of improvisation with Blackberry's messenger http://www.bbm.com/bbm/en.html http://www.bbm.com/bbm/en.html
      - Spooky23 11y ago
        BlackBerry failed to keep the positive aspects of it's legacy platform fucntioning when modernizing the platform. I used to run an environment with something like 25k devices... Provisioning and management was braindead simple with legacy BlackBerry, and it's integration model for mail & calendar was robust and reliable. Most users considered BB more reliable than any other mail access methodology. PIN messaging was device-centric vs. identity centric, which made it attractive or many use cases. That also went away, along with the perceived and real security benefits. That benefit became a liability -- BlackBerry was very "enterprise telecom" and mail-centric. So the people who were responsible for BlackBerry were very much affected by tunnel vision. That's why BlackBerry was surprised by the market shifts -- their customers were very happy, but were ultimately people with an overly narrow focus who were disconnected from the business. When BlackBerry switched to the ActiveSync model, they became just another ActiveSync device, with the added "benefit" that the rest of the platform was a mess. They are now trying to leverage their past reputation for good management to become an MDM vendor for some reason. iPhone slaughtered Blackberry by attacking their strengths... BBM/PIN messaging with iMessage (with the added feature that you cannot intercept the messages if the feature is enabled), the obvious improvements of iOS vs. Blackberry OS and an easy institutional management model.
  - Spooky23 11y ago
    I'm not at liberty to say. :) That said, Apple's enterprise business grew 40% in 2015 to $25B. (http://appleinsider.com/articles/15/10/27/apples-enterprise-business-reached-25b-in-fiscal-2015 http://appleinsider.com/articles/15/10/27/apples-enterprise-...). .gov is a big part of that. When you attend Apple enterprise-focused events, the attendance has grown beyond the old media/field service crowd to include finance,police and .gov attendees. If you need to comply with various federally mandated compliance regimes, (ie. FIPS 140-2, CJIS, IRS Pub 1075, etc) iOS is very clearly the easiest and most straightforward platform to achieve that compliance on. It's not as trivial as it was with legacy BlackBerry, but it's pretty close. With Android, the carrier and manufacturer variance makes it more difficult to achieve, demonstrate and maintain compliance. That said, Android offers a number of advantages from an application perspective, but when in production, you'll commonly see licensed third party software in place to perform typical mail and other functions.
- Lawtonfogle 11y ago
  While I only have anecdotes, when I've encountered governments rolling out Apple devices it is far more about being able to have an Apple device than any technical ability it provides. This comes from talking with those in charge of the roll out who admit such. Granted, this is only 3 very much non-random anecdotes.
akshatpradhan 11y ago
A seventh: What if there's influence from super-secret organizations to make those FEDRAMP-style standards less "tamper-proof"? Then a court wouldn't even need to be involved: https://www.eff.org/deeplinks/2014/11/eff-joins-call-nist-we-can-trust https://www.eff.org/deeplinks/2014/11/eff-joins-call-nist-we...
ars 11y ago
1: Yes. 2: Yes. 3: No, but they will probably be the ones asked anyway, and then yes, they would be legally required. 4: Apple. 5: What's the question? Is the question will they be compensated? Then yes. 6: They can't. They don't own their stock. Bad PR is not a good enough reason. You are treating the court like a mathematical proof and finding edge cases. I used to as well. But courts don't work that way at all - they don't care in the slightest about your proof. They analyze things on a human level, not a mathematical level.
- philip1209 11y ago
  Specifically regarding question 5 - how does the burden of proof work? How do statues of limitations apply?
  - ars 11y ago
    There is no burden of proof. Apple says it's corrupted that's about it. I'm sure the other party will ask for details. If they don't believe Apple they'll explain that to the Judge and he'll go from there, but otherwise no one will demand proof of anything. I don't see how statues of limitations is connected to the question.
    - philip1209 11y ago
      re: statue of limitations - if we are talking exponential levels of difficulty to crack vs. exponential increases in computing power (Moore's law) I wonder whether "we won't have the computing power to crack this for X years, so a statute of limitations of (X-1) years to solve this means that we are functionally unable to answer the question within the allotted time" becomes defensible as a reason to call something "impossible", i.e. it's improbable to solve during the statue of limitations
      - alcari 11y ago
        A statute of limitations prevents you from charging someone with a crime once some period of time elapses. It says nothing about how long you have to prove your case in court. That's more likely to run afoul of the right to a speedy trial.
rayiner 11y ago
Courts already have ways to balance requests for information (by the government or another litigant), with the burden on third parties who might have to undertake expenses to get that information.
rayiner 11y ago
Courts already have ways to balance requests for information (by the government or another litigant), with the burden on third parties who might have to undertake expenses to get that information. Generally, third parties are required to take reasonable measures to help.

Spooky23 11y ago

Ironically, many .gov organizations are rolling out iPhones by the thousand because of the strong security controls available on the platform.

bcook 11y ago
Cite your source(s), please.
- seibelj 11y ago
  I worked in government mobile security for many years, until last November. Many agencies are indeed rolling out iPhones and scaling back on blackberries finally
- hguant 11y ago
  Blackberry's collapsing business model.
  - chenster 11y ago
    Why is that?
    - bardworx 11y ago
      Poor sales, major benefit of blackberry overshadowed by other services (BBM), late to adjust to the times, etc. I doubt you were suggesting that BB's downfall is rooted in their encryption, however. In the slim case that it did, they didn't speak up about backdoors and letting .gov into their devices until 2015, way after their market share has shrunk.
      - Fundlab 11y ago
        While I havent seen heavy market in that aspect there appears to be some level of improvisation with Blackberry's messenger http://www.bbm.com/bbm/en.html http://www.bbm.com/bbm/en.html
    - Spooky23 11y ago
      BlackBerry failed to keep the positive aspects of it's legacy platform fucntioning when modernizing the platform. I used to run an environment with something like 25k devices... Provisioning and management was braindead simple with legacy BlackBerry, and it's integration model for mail & calendar was robust and reliable. Most users considered BB more reliable than any other mail access methodology. PIN messaging was device-centric vs. identity centric, which made it attractive or many use cases. That also went away, along with the perceived and real security benefits. That benefit became a liability -- BlackBerry was very "enterprise telecom" and mail-centric. So the people who were responsible for BlackBerry were very much affected by tunnel vision. That's why BlackBerry was surprised by the market shifts -- their customers were very happy, but were ultimately people with an overly narrow focus who were disconnected from the business. When BlackBerry switched to the ActiveSync model, they became just another ActiveSync device, with the added "benefit" that the rest of the platform was a mess. They are now trying to leverage their past reputation for good management to become an MDM vendor for some reason. iPhone slaughtered Blackberry by attacking their strengths... BBM/PIN messaging with iMessage (with the added feature that you cannot intercept the messages if the feature is enabled), the obvious improvements of iOS vs. Blackberry OS and an easy institutional management model.
- Spooky23 11y ago
  I'm not at liberty to say. :) That said, Apple's enterprise business grew 40% in 2015 to $25B. (http://appleinsider.com/articles/15/10/27/apples-enterprise-business-reached-25b-in-fiscal-2015 http://appleinsider.com/articles/15/10/27/apples-enterprise-...). .gov is a big part of that. When you attend Apple enterprise-focused events, the attendance has grown beyond the old media/field service crowd to include finance,police and .gov attendees. If you need to comply with various federally mandated compliance regimes, (ie. FIPS 140-2, CJIS, IRS Pub 1075, etc) iOS is very clearly the easiest and most straightforward platform to achieve that compliance on. It's not as trivial as it was with legacy BlackBerry, but it's pretty close. With Android, the carrier and manufacturer variance makes it more difficult to achieve, demonstrate and maintain compliance. That said, Android offers a number of advantages from an application perspective, but when in production, you'll commonly see licensed third party software in place to perform typical mail and other functions.
Lawtonfogle 11y ago
While I only have anecdotes, when I've encountered governments rolling out Apple devices it is far more about being able to have an Apple device than any technical ability it provides. This comes from talking with those in charge of the roll out who admit such. Granted, this is only 3 very much non-random anecdotes.

akshatpradhan 11y ago

A seventh: What if there's influence from super-secret organizations to make those FEDRAMP-style standards less "tamper-proof"? Then a court wouldn't even need to be involved: https://www.eff.org/deeplinks/2014/11/eff-joins-call-nist-we-can-trust https://www.eff.org/deeplinks/2014/11/eff-joins-call-nist-we...

ars 11y ago

1: Yes. 2: Yes. 3: No, but they will probably be the ones asked anyway, and then yes, they would be legally required. 4: Apple. 5: What's the question? Is the question will they be compensated? Then yes. 6: They can't. They don't own their stock. Bad PR is not a good enough reason. You are treating the court like a mathematical proof and finding edge cases. I used to as well. But courts don't work that way at all - they don't care in the slightest about your proof. They analyze things on a human level, not a mathematical level.

philip1209 11y ago
Specifically regarding question 5 - how does the burden of proof work? How do statues of limitations apply?
- ars 11y ago
  There is no burden of proof. Apple says it's corrupted that's about it. I'm sure the other party will ask for details. If they don't believe Apple they'll explain that to the Judge and he'll go from there, but otherwise no one will demand proof of anything. I don't see how statues of limitations is connected to the question.
  - philip1209 11y ago
    re: statue of limitations - if we are talking exponential levels of difficulty to crack vs. exponential increases in computing power (Moore's law) I wonder whether "we won't have the computing power to crack this for X years, so a statute of limitations of (X-1) years to solve this means that we are functionally unable to answer the question within the allotted time" becomes defensible as a reason to call something "impossible", i.e. it's improbable to solve during the statue of limitations
    - alcari 11y ago
      A statute of limitations prevents you from charging someone with a crime once some period of time elapses. It says nothing about how long you have to prove your case in court. That's more likely to run afoul of the right to a speedy trial.

rayiner 11y ago

Courts already have ways to balance requests for information (by the government or another litigant), with the burden on third parties who might have to undertake expenses to get that information.

rayiner 11y ago

Courts already have ways to balance requests for information (by the government or another litigant), with the burden on third parties who might have to undertake expenses to get that information. Generally, third parties are required to take reasonable measures to help.