20 ms·

Why Apple Is Right to Challenge an Order to Help the F.B.I

418 points by doe88 11y ago

zaroth 11y ago
The problem is not ability to search the device after it has been cracked, the problem is specifically does the government have the power to force companies to develop backdoors for their own devices? In this case the cracking capability is for a locked phone in FBI possession. Let's assume the same technique isn't possible on newer phones. So what about the next case where the FBI wants remote access over LTE while the phone is unlocked / in use by the suspect? If you can use All Writs Act to compel Apple to develop the first backdoor, then surely the same is true for the second.
deleted 11y ago
[deleted]
GnarfGnarf 11y ago
Why doesn't the FBI copy the contents of the terrorist Farook's iPhone to a second iPhone (after all, it's only a hard drive). Make ten attempts on the second iPhone, brick it, then copy the contents again, try the next ten digits, and so on until they hit the combination?
- deleted 11y ago
  [deleted]
- iolothebard 11y ago
  Part of the key for decryption is hard coded into the hardware of the phone from what I understand, so it wouldn't work.
- ozcorp 11y ago
  As I understand it, half of the key that decrypts the phone is stored on the chip itself and cannot be read. When you enter in a correct password on the lock screen, it is added to this hardware key and the combined key is then able to decrypt the phone. If you move the contents of the hard drive to another iPhone, the key on that phone will be different and thus can't decrypt the drive. Its like 2 phase authentication on your Gmail account and you are being sent the wrong codes. Check out this article for more information. It also explains how the fact that the phone is a 5C is significant to the encryption scheme. [0] http://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-court-order/ http://blog.trailofbits.com/2016/02/17/apple-can-comply-with...
  - GnarfGnarf 11y ago
    OK, good explanation. What about removing the original hard drive from the iPhone, and installing the copy? You could just keep plugging in copies until you crack the code? Could the chip also not be cloned?
Tepix 11y ago
Has there been any precedent of (the|a) government forcing someone to sign a piece of code against their will?
j_m_b 11y ago
Glad to see this from the editorial board of the NYTimes
bsder 11y ago
The best way to put this for the other side is: "How about we start with FBI mandated remote control gun disablers given that it's guns that killed these people? Oh, you're concerned that someone will figure out how to bypass it, and it won't just be the FBI disabling your gun? Congratulations. You now understand my position."
- knd775 11y ago
  Given the original motivation for the Second Amendment, I think that the even just the FBI being able to remotely disable guns would be pretty concerning to some.
  - bsder 11y ago
    Um, exactly?
  - api 11y ago
    I think a case should be made for a right to strong encryption based on the second amendment. If anything, encryption is far more relevant today to personal defense than gun ownership and does far more to protect your individual rights against both government excess and private attacks. A gun won't stop a government from watching your every move by converting every device in your house into a surveillance device and then using "parallel construction" to persecute you if some political apparatchik doesn't like your views or opinions. A gun also won't stop a criminal from emptying your bank account or stealing your identity, attacks that can today steal far more from you than a home invasion. A gun won't stop a stalker from hacking your home devices to secretly record your kids playing, or hacking your e-mail account to spy on you, etc. Encryption on the other hand can stop all these things. Cyber-attacks today are potentially even more damaging than non-violent physical invasion (burglary, etc.). Not only that, but we are very close (if not already there) to a world where you can kill someone by hacking a device. Self-driving cars, Internet connected buildings, etc., could all be used to conduct a homicide remotely. If, for example, the signing key to a car's firmware were to be leaked, then hackers could remotely flash a person's car to murder them on the highway and make it look like a hardware failure or a freak accident. A government could even do this and have almost no chance of detection. The opportunity for corruption both public and private is fairly large given how clandestinely these kinds of attacks could be conducted. Crypto is the new "well armed militia" and the new right to personal self-defense.
botw 11y ago
I wonder why the head of FBI didn't ask Tim Cook first in private. or I missed something?
cptskippy 11y ago
What bothers me most about this article is the following statement which is accepted without contest. "Law enforcement agencies have a legitimate need for evidence, which is all the more pressing in terrorism cases." What makes a terrorism case more pressing? How many domestic terrorist attacks have had related followup attacks? How many domestic terrorist cases have been linked to other domestic terrorist attacks? How many domestic terrorist attacks have been carried out by the same set of individuals or groups? The reality is that domestic terrorist attacks are not common or frequent, there is no urgency in investigating them because they do not lead to followup attacks. They're coordinated events, not a series of related events so there's no pressing urgency?
- TearsInTheRain 11y ago
  what? Sure terrorist attacks are not common or frequent but they generally involve murder on a larger scale than your average criminal. There is of course a lot of urgency in investigating them as they could easily lead to follow up attacks. Look at San Bernidino and the Boston bombings. both pairs of terrorists clearly had plans for follow up attacks
  - JoeAltmaier 11y ago
    What terrorists plan, and what happens, are very different. Terrorists often die in their attacks, so followup plans are often moot.
  - cptskippy 11y ago
    In those cases, had the terrorists escaped custody and carried out their subsequent attacks would law enforcement having the ability to instantly access their phones have made any difference?
EGreg 11y ago
All they need to do is compel companies (by hook or by crook) to install backdoors in their algorithms or hardware. https://www.eff.org/deeplinks/2014/01/after-nsa-backdoors-security-experts-leave-rsa-conference-they-can-trust https://www.eff.org/deeplinks/2014/01/after-nsa-backdoors-se... https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG http://www.cnet.com/news/spy-fears-lead-nuke-lab-to-dump-gear-from-hp-unit-not-huawei/ http://www.cnet.com/news/spy-fears-lead-nuke-lab-to-dump-gea... Who is to say that other state actors haven't done the same to chips produced by their companies? The truth is, the genie is out of the bottle. A year and a half ago, I wrote a serious article on this: http://magarshak.com/blog/?p=169 http://magarshak.com/blog/?p=169
ikeboy 11y ago
> It is also theoretically possible that hackers could steal the software from the company’s servers. It's also theoretically possible for hackers to steal Apple's private key from their servers, in the exact same way. As far as I see, there's no change to the threat model by Apple making a new software version, and signing it using the same process they use to sign other versions of iOS. It's useless if not signed, so the real worry is someone having the ability to sign it, and that applies exactly the same if Apple signs iOS or FBiOS. This suggests the authors don't understand the technology well enough to know this. edit: this is assuming the software is locked to a specific device. So the signing doesn't matter to any other device. If the software worked on all devices, then a leak of a signed version would be problematic. Although even if they couldn't lock it to device, they could make it only work for a short time, say a week, so if that signed version leaks later it would have no effects (I'm not sure if you can change the clock on a phone without unlocking it though).
- danielsju6 11y ago
  Once the software exists, due to Apple's specialized knowledge, what's to stop them from issuing a NSL for Apple's signing keys + access to the remote update mechanism... then the FISC rubber stamps warrants en masse and Apple devices are used to spy on tens of millions of Americans. It sets a horrible precedent that the government can redirect the development resources of a private company. How many millions of dollars in engineering salaries will this take? Project management? They're demanding an entire blackhat division of Apple be spun up, with the goal of circumventing other teams security effort.
  - ikeboy 11y ago
    None of that has to do with Apple creating the software, but rather with their handing over the signing keys etc. The FBI or NSA could probably create their own software if they had the keys and source code. I doubt the cost to Apple is over 100 man hours. But if it's too difficult, they can argue that and simply hand over the source code.
    - danielsju6 11y ago
jy2947 11y ago
I may be wrong - but I have a feeling that, technology companies like apple and google are developing software on device to make user data so protected that they will say "I can not technically to crack my software" even ordered by a Judge (presumably for legit reason), thus the DOJ is using this case trying to prevent it from happening. And, if this is the case, then personally I am at the DOJ side, because I recognize this is a less ideal world (actually I think it is even worse), and this country is technically in a war.
geggam 11y ago
When two nuts with rifles trigger a "National Security" problem I think the problem is with the Nation not the people. What happens when an entire nation threatens us ?
stillsut 11y ago
Couple of thoughts: - Doesn't an iPhone become completely secure if you prevent if from passively polling for OS updates. If the iPhone would only poll and install updates after user un-locks and allows, then there would be no way change the necessary software configuration without breaking the encryption. And the encryption can't be broken, thus if you could chose OS -level default "don't accept or even check for any updates without user permnission" you really would have an unbreakable device. But if they ever did implement this, it would be terrible for Apple's forced upgrades and their platform would fragment into many incompatible versions. I think everyone knows which option Apple will chose between: CompletelySecurePhoneOS or AbilityToForceUpgradesAndPatches. - Correct me if I'm wrong but didn't Tim Cook initially state cracking this phone was impossible according to Apple's experts? And now it seems it's a quite reasonable issue of Apple signing an OS-update specific to this device's unique ID; so quite feasible. So was that a lie?
marincounty 11y ago
Does anyone feel this whole incident is a carefully staged by the FBI and Apple? I'm not into conspiracy theories, but I'm wondering on this one. Why would the FBI, or Apple make this so public? The Apple letter seemed staged? The federal government always seems to get what it wants in the end, especially if one has a lot to lose? I imagine the conversation starts off with an indignant, appalled CEO. "Hell No--I'm not giving you access to my customers data!" Federal government counters with, "Do you want us to scrutinize your past, and present life?" "Do you want us to look at every stock trade you ever made?" "Do you want us to publicize the personal information we have on you already? "You know we can make your life misserable? You know we can make your companies life misserable?" No this isn't Russia, but our law enforcement branch of the federal government scares me, and I'm a nobody. There's been some deaths, especially in tech, that seem suspicious. The drug overdoses--guy in San Francisco that was about to give a talk on ATM hacking comes to mind. That tech guy who died in that fiery car crash on Los Angeles. (I don't want to argue with anyone. I have no evidence. Just a weird feeling. And yes, Tim Cook seems like a choir boy. He comes across as someone who doesn't even jay walk.)
clumsysmurf 11y ago
One thing I hope can be clarified: Is the FBI asking Apple to patch iOS on this one device, one time only (in a way that can not be reused) ... or are they asking Apple to provide a "reusable" patch / modification that allows future devices to be accessed?
- Zigurd 11y ago
  That's all window dressing. Once you compel the creation of software through a novel use of the all writs act, that opens the door to even more burdensome demands. Can decrypt an i-device with Secure Enclave? Build a new chip for us!
- gkoberger 11y ago
  I don't see the difference.
- chrisdbaldwin 11y ago
  Ever heard of a precedent?
  - suneilp 11y ago
    Precedents are a cop out for critical thinking. Sure, they seem to have their uses, like when it guarantees victory for the righteous. However, it seems more likely it's being used as a 'they did it, so can we!' excuse. It's one thing if you use it as a starting point for discourse, it's another when you use it to beat down the opposition with what amounts to childish antics dressed up in a suit and tie.
    - throwaway2048 11y ago
      Precedent is an actual legal term of art, where a case decision can lead to binding (in the hard sense) judgements in proceeding cases.
- hammock 11y ago
  Part of Tim Cook's argument was once they release the patch into the wild, it could be reused in other cases
lbstr_ftw 11y ago
Apple is not obligated to write malware for you.
redindian75 11y ago
Wonder why can FBI just hand the phone to Apple keep the phone just get the data we don't needed specifics.
- api 11y ago
  Because once it is shown how it's done they will push to mandate the capability and force inferior security.
- rplst8 11y ago
  Do you really want that to be the model for American justice? Law enforcement hands your digital electronic records over to a private company who has the power to put anything on that phone? Do you want to entrust your personal legal future to a private entity? I think I'd want a solid chain of custody on anything that may prove my innocence.
  - tosseraccount 11y ago
    The phone was the property of San Bernardino County. The county has longstanding email and Internet use policies that state, “NO USER SHOULD HAVE AN EXPECTATION OF PRIVACY” - http://ktla.com/2016/02/18/why-didnt-san-bernardino-county-officials-have-access-to-the-terrorist-iphone/ http://ktla.com/2016/02/18/why-didnt-san-bernardino-county-o...
    - dclowd9901 11y ago
      I bet even I, not a lawyer, could reasonably defend that, no matter who "owns it", a device as personal and as much an extension of the brain as a smartphone could be considered private.
  - buzzdenver 11y ago
    That's a very weak argument. Individuals and companies testify in court all the time. They could lie and plant evidence, but in most cases I'd still trust them more than the police who kind of has an incentive to find somebody guilty.
- 11y ago
chrischen 11y ago
This is also a great product move by Apple, as if they win it shows even the FBI can't access your locked phone.
- tosseraccount 11y ago
  Sure they can't mill down the chip and probe it with some advanced microscope?
  - andromeduck 11y ago
    It'd be difficult and expensive. There's also a good chance you'd meaa up and destroy the data.
    - salgernon 11y ago
      What about asserting write lock on the flash? By piggybacking a copied (but encrypted), identical flash part, or an ICE that allows reads from the original flash and writes to another part, the os wouldn't necessarily know there was anything nefarious going on. Besides, if this particular information is that valuable, they would have no problem paying for it. Which brings us back to: it isn't the device they want cracked, but governmental oversight of (civilian) encryption.
      - interpol_p 11y ago
        I'm not sure but I think the problem is that the data isn't just encrypted with the user's passcode, it's encrypted with the passcode entangled with the private key of the secure enclave chip (which, presumably, is unknown to anyone). So they can't just attempt to brute force the encrypted data, as the encryption key would be 256 bits or more rather than just a 4 or 6-digit numeric passcode. That's why they want Apple to open the OS up to brute force passcode attempts. Edit: there's no secure enclave chip on the phone in question, but it seems that iOS 8 and later encrypt the user data with a separate private key combined with the user passcode.
  - hueving 11y ago
grecy 11y ago
I've been explaining this case to others and I've come up with a good way to make them understand. "Instead of the FBI making this request, how would you feel if the Government of China were asking? or Russia, or Syria? Do you want them to have the ability to read your encrypted data off your iPhone?"
- harryh 11y ago
  Aren't there lots and lots of things that you would feel comfortable with the US doing but not those other governments? What makes this particular issue different from all of those other things?
- mc32 11y ago
  There is no reason why a China, Russia or India cannot not make this request from Apple in order to allow them to legally sell their product in those markets. And as sovereign nations they have a right to demand such, provided that's their law and in turn violates no international law they've subscribed to. Countries in the ME and India[1] demanded such from RIM/BBM. [1]http://www.wired.co.uk/news/archive/2013-07/11/blackberry-india http://www.wired.co.uk/news/archive/2013-07/11/blackberry-in...
  - grecy 11y ago
    And knowing that once they have that ability, there would be nothing stopping them using it on any iPhone in the entire world? Including yours? You're OK with that? After what Snowden has told us, we know with certainty the FBI/NSA/CIA will use this ability on the phones of citizens of other countries, so I think it's safe to assume other countries would do the same.
    - ikeboy 11y ago
      They're willing to hand the phone over to Apple and have the entire process take place on Apple's premises, locked to this specific phone. That's what the court order says.
    - vectorjohn 11y ago
buzzdenver 11y ago
Doesn't the fact that Apple is capable of unlocking the phone mean that a backdoor already exists ? Then it's just a question of a lone wolf telling the FBI how to do it, maybe along with using some secret keys that could be stolen if Apple is hacked like Sony was. I would like a phone that is unhackable even by its creator. Anything else is just a question of time to get broken into.
- function_seven 11y ago
  It all depends on how you define a backdoor. The 5c doesn't have the secure enclave†, so all of it's encryption routines are done in the CPU, as software/firmware. That software doesn't contain a backdoor, but the fact that a new software load could be created and installed could be viewed as the backdoor itself. But if that software doesn't currently exist, is the mere potential of it a backdoor? Somewhat of a philosophical question. If Apple prevails and doesn't write the software the FBI is demanding, then the backdoor is not there. The later iPhones with the Secure Enclave may truly be unbreakable if they protect their secrets with hardware in the chip. But my understanding of it is that Apple is NOT capable of unlocking the phone right now. The FBI is demanding that they develop that capability. So I guess they're capable of being capable... † At the risk of being an armchair SE expert...
  - kalms 11y ago
    A Schrödingers Backdoor? lol.. Err, anyway. Carry on.
  - unfamiliar 11y ago
    How would a backdoor look? Some secret additional encryption key capable of unlocking the encrypted data? Such a key exists, and it is whatever key Apple uses to sign the iOS updates. Only Apple can sign a new iOS release, so only Apple can update the code to remove all security features. This looks a lot like a backdoor to me, just that the implementation hasn't been written. But all you really would need, in theory, is the signing key.
    - 11y ago
tosseraccount 11y ago
Apple indeed may have a right to refuse the administration. Does the administration have the right to remove Apple Computer from the GSA government purchasing schedule?
- deleted 11y ago
  [deleted]
- valleyer 11y ago
  Yeah, I'm sure they'd shed a tear over that.
msravi 11y ago
From here (4th para from the end): http://www.nytimes.com/2016/02/19/technology/how-tim-cook-became-a-bulwark-for-digital-privacy.html http://www.nytimes.com/2016/02/19/technology/how-tim-cook-be... "Apple had asked the F.B.I. to issue its application for the tool under seal. But the government made it public, prompting Mr. Cook to go into bunker mode to draft a response, according to people privy to the discussions, who spoke on condition of anonymity." If this is true, it sort-of implies that Apple would have done it, but secretly, and they were forced to take their very public stance because of the FBI's posturing.
- Arnt 11y ago
  Are you suggesting that Apple would've done this particular hack provided it wouldn't set any precedent? If so that sounds quite sensible to my ears.
- skywhopper 11y ago
  I don't think so. Apple would prefer not to fight this particular battle over this particular case in the public sphere, but the FBI would. The general principle Apple is fighting for here is very important, but the FBI knows this is the weakest point in that principle: the locked phone of a dead terrorist who killed several people. Politically and possibly legally, this is a winner for the FBI. Technically it's a loser if you believe strong encryption is important at all. Apple wants to win the political argument, so it would not want this request to be made public. Anyway, why should it be, when next to no other such requests are made public? Anyway, in a legal battle, you contest every relevant point. The fact that they contested it doesn't mean they would have behaved differently after, except that they wouldn't have had to make a public statement under less than ideal circumstances.
  - themartorana 11y ago
    Are you suggesting the court would take public opinion under consideration as being at all relevant to the law? That's very worrying to me, considering how important it's been in the past for the court to ignore public opinion in favor of justice.
buzzdenver 11y ago
I wouldn't be surprised at all if Apple already gave a version of the OS to the FBI that enabled them to brute force the password for that one phone with the condition that they publicly put up this show as if they were not cooperating.
- brians 11y ago
  That would involve lying to a court. Intelligence folks might do that. Law enforcement? Not a chance; it would be career-ending even to discuss it.
  - logfromblammo 11y ago
    If you truly believe that, I think perhaps you place too much trust in the wrong sort of people. The reason why I consider the hypothesis unlikely is not because those involved are unwilling to deceive, but because they are unlikely to have sufficient skill to make the attempt and avoid detection. I believe that, considering the number of people that would be necessary, at least one Apple insider with ethical concerns would leak evidence that would expose the true story.
    - buzzdenver 11y ago
      I believe that much more than "law enforcement never lies", but IMO it's hard to leak evidence in this case. A whistle-blower could say that he worked on this project, but there isn't the hard evidence of documents that for example Snowden could leak. The FBI or Apple could just deny it or say no comment.
rrggrr 11y ago
Let iPhone users opt-in and you'll find far fewer proponents of backdoor encryption than will be reflected in Congress. I wouldn't be surprised if most in the LE and Intel communities didn't opt-in. Why? Perhaps because the USGOV has yet to prove they can keep their own data secure. The Office of Personnel Management hack, Clinton official emails on a private server, and many more instances have shaken the faith in USGOVs ability to be an effective steward. I'm in favor of master keys for the FBI after they prove to the public, in a transparent and accountable manner, that those keys can be kept unassailably secure from misappropriation or abuse.
cmurf 11y ago
What if Apple's coerced firmware update bricks the phone? That's destruction of evidence they'd need immunity from. What trust and conflicts arise when a company has blanket immunity from such evidence being destroyed? So many slippery slopes.
TheAppGuy 11y ago
I've got a feeling we're being manipulated by someone with an agenda at play.
- Crito 11y ago
  Are we ever not? It's a political topic, so manipulation goes with the territory.
marcoperaza 11y ago
TLDR for what follows: Mandated backdoors must be a red line, but this is not a request for a backdoor and actually seems pretty reasonable. Trying to argue that the tech industry shouldn't help, even in this case, is not only the wrong position in my book, but a sure way to lose the bigger debate. My views on the general encryption controversy are: 1. Everyone must be free to make their technology as secure as they possibly can. There can be no mandated weakening of security, back-doors, or other requirements to make the information more easily accessible by law enforcement. On newer iPhones, Apple has patched up the flaw that the FBI wants their help with exploiting. They must continue to be allowed to do that. 2. The government must be able to demand, with a court order predicated on probable cause, that companies provide any and all information that they have that could be useful in circumventing their security features. This can be everything from technical specifications and threat-model analyses, to lists of unpatched vulnerabilities and code-signing keys. 3. It seems to me that American companies have a moral obligation that goes beyond the legal obligations in point #2. They should be actively assisting the government in recovering information, especially when concerning issues of national security. In extreme circumstances, like total war, this should definitely be legally mandated. I'm undecided as to what the policy should be generally. On a practical level, it's probably not feasible for the government to, e.g. start hacking around the iOS codebase themselves, so just information might not be enough. I'm not too troubled by this court order, especially given the particular circumstances. The right to make products as secure as you can, even from yourself and the government, is what's really important to defend. Trying to argue that the tech industry shouldn't help, even in this case, is not only the wrong position in my book, but a sure way to lose the bigger debate. Apple's definition of "backdoor" is highly suspect. A backdoor is if I ship my product with an intentional vulnerability, so that I can hack into it later. Apple's not being forced to add a backdoor, it already exists because the security features break down against an adversary that has Apple's private key, at least for the default 4-digit PIN configuration. Now the government is asking them to use their own capabilities to help hack this phone. Of course, Apple didn't create this backdoor for malicious reasons, they just didn't include themselves in the threat-model, greatly simplifying updates and other security features, and allowing the walled-gardenness of iOS. It's also central to the walled-garden. Curiously, this is in direct contradiction to their claim for some time now, that they were designing iPhones such that they themselves can't break into them. Now put yourself in a Congressman's shoes. The FBI has been telling you for years that tech companies are being purposefully antagonistic to their legitimate search and seizure authority. That the tech companies are purposefully designing features with the sole intention of shutting the government out. Now here's a case where there was no mandated backdoor, the government was able to devise an exploit method, and they got a court order from a judge to make Apple use it on a dead terrorist's phone. "Mandatory backdoors would hurt everyone's security", one of the arguments that we've been winning with, now sounds like a bullshit cover for "we are against any government surveillance". Can you smell the legislation coming yet? Disclaimer: These are obviously my own personal views and nothing else. They do not necessarily reflect the opinions, policies, or practices of anyone but myself. (Reposted from https://news.ycombinator.com/item?id=11131456 https://news.ycombinator.com/item?id=11131456 with additional)
LeicaLatte 11y ago
Curious if Apple is breaking any user agreements if they end up doing this. Sharing information on servers is one thing. Sharing a key which enables access to all future communication too is different. Does their EULA cover such scenarios? Can it open them up to possible lawsuits from its users?
- mc32 11y ago
  How, the phone owner, the state agency, granted permission, the actual users died. Who'd have the basis to sue under what claims? If you thought you had a claim I guess you could sue to block the order, but that's up to the courts to decide and that would take precedence over an eula.
InTheArena 11y ago
The guy who wrote the two most important 4th amendment case opinions over the last thirty years (both in favor of privacy rights, both by 5:4 votes), and who had the longest record of cracking down on laws that were being stretched to cover uses never imagined (which by definition, the Writs law is being abused) just died. It's not good timing....
- bratsche 11y ago
  For those of us not well-versed in these sorts of things, what were the two cases?
  - InTheArena 11y ago
    Jones and Kylo. Kylo held that the Government could not use infrared scanners to track individuals inside of their house without a warrant, while Jones held that the government could not use GPS trackers on cars, even in public, because it had to trespass to install the GPS tracker. He also dissented with the forced DNA testing of anyone charged with a crime, and from warrent-less suspecion-less traffic stops. http://reason.com/archives/2016/02/16/antonin-scalia-was-a-great-jurist-for-cr http://reason.com/archives/2016/02/16/antonin-scalia-was-a-g...
    - lern_too_spel 11y ago
      There is no explicit right to privacy in the Constitution. Some of Scalia's rulings happen to favor privacy while others do not. For example, he also said the Miranda ruling is judicial overeach, so in his view, you have rights (privacy or otherwise) only if you know about them ahead of time. Roe v. Wade established precedent for an implicit right to privacy interpretation of the 14th Amendment. Scalia has said that interpretation is wrong.
      - deleted 11y ago
        [deleted]
      - InTheArena 11y ago
mrb 11y ago
Off topic, but: "Apple is doing the right thing in challenging the federal court ruling requiring that it comply" I am not a native English speaker. Why "it comply" and not "it complies"?
- deleted 11y ago
  [deleted]
- unfamiliar 11y ago
  In this context, comply means "cooperate with the courts" or "do what the courts ask."
- chillingeffect 11y ago
  Subjunctive tense. Since it is still not known whether they will comply or not, the verb is unconjugated. Writing "it complies" would be confusing. It's highly proper grammar and not used in everyday spoken speech and not used all the time in most written speech, but since this is more formal and written, it's used. It's one thing the NYT gets right.
  - Joof 11y ago
    Native speaker here; I knew it was correct, but I couldn't answer this question. Thanks.
  - pc2g4d 11y ago
    Nitpick: subjunctive _mood_, not _tense_. From the Wikipedia article on English subjunctive: "The distinction between present and past is one of tense; the distinction between indicative and subjunctive is one of mood."
  - mrb 11y ago
    Thank you! We live to learn. https://en.m.wikipedia.org/wiki/English_subjunctive https://en.m.wikipedia.org/wiki/English_subjunctive
- IshKebab 11y ago
  I think you're probably right - it should be "... requiring it to comply" or "... requiring that it complies". The original is not very wrong though - I don't think most native English people would even notice.
mgleason_3 11y ago
Given the powers and size of the national security budget and the NSAs in particular, why do they need Apple? Shouldnt the NSA be able to crack this on their own? Kinda makes ya wonder what all that moneys spent on...
- moonshinefe 11y ago
  They can get the info they want with more sophisticated techniques from what I've read. Also, Apple already gave them the iCloud backups. The legal precedent of forcing companies to break their own security for the FBI's sake is the prize at hand here it seems.
- mirimir 11y ago
  Well, they'd arguably need the certificate that Apple uses for signing updates. That's well-protected, I trust. There's also the issue that Apple software is closed-source. But that's presumably less problematic.
moonshinefe 11y ago
The fact that Apple has made this issue very public (with http://www.apple.com/customer-letter/ http://www.apple.com/customer-letter/) is unprecedented almost (Lavabit and SOPA had some similarities). I applaud them for taking a stand and not just giving in. If this legal precedent gets set that the FBI can force US tech companies to break into their own customers' encrypted data, you can bet the industry will lose millions if not billions of dollars worldwide in tainted reputation. Who's going to buy US companies' devices that claim privacy via encryption if they're easily backdoored at the FBI's request?
- rayiner 11y ago
  Is that true? Armed with a court order, the FBI can search a U.S. house, compel banks to turn over financial information, compel accountants to turn over records, etc. Yet people worldwide extensively use those American services.
  - adventured 11y ago
    That's not a similar example to what's going on here. Your example would have to include a situation in which the FBI makes copies of the keys to the house, copies of the hard-drives, etc. Then inevitably makes it embarrassingly easy for other parties to get access to those as well, permanently reducing your net security to almost zilch regardless of the outcome of the context and warrant. And worse, in the process of gaining access to that one house and hard-drive, they simultaneously gain the potential to access millions of homes and hard-drives that have nothing to do with the warrant, and then those millions of houses and hard-drives see their net security reduced to essentially nothing.
    - rayiner 11y ago
      They're offering to let Apple do the unlock themselves and just hand over the data.
      - criddell 11y ago
Shivetya 11y ago
So here is a simple question. How will we know if the US becomes successful in having manufactures put in a backdoor? Can it be done to the current 6 models through a software update?
deleted 11y ago
[deleted]
DrNuke 11y ago
I am not an Appleland citizen and therefore they (all of them) should comply. If this impacts their business, their problem. EDIT: you can downvote as you want, even the mafia and the terrorists worldwide instruct some sort of welfare state other than funnelling cash out of their country to fiscal havens.

418 points by doe88 11y ago

The problem is not ability to search the device after it has been cracked, the problem is specifically does the government have the power to force companies to develop backdoors for their own devices? In this case the cracking capability is for a locked phone in FBI possession. Let's assume the same technique isn't possible on newer phones. So what about the next case where the FBI wants remote access over LTE while the phone is unlocked / in use by the suspect? If you can use All Writs Act to compel Apple to develop the first backdoor, then surely the same is true for the second.

deleted 11y ago

[deleted]

GnarfGnarf 11y ago

Why doesn't the FBI copy the contents of the terrorist Farook's iPhone to a second iPhone (after all, it's only a hard drive). Make ten attempts on the second iPhone, brick it, then copy the contents again, try the next ten digits, and so on until they hit the combination?

deleted 11y ago
[deleted]
iolothebard 11y ago
Part of the key for decryption is hard coded into the hardware of the phone from what I understand, so it wouldn't work.
ozcorp 11y ago
As I understand it, half of the key that decrypts the phone is stored on the chip itself and cannot be read. When you enter in a correct password on the lock screen, it is added to this hardware key and the combined key is then able to decrypt the phone. If you move the contents of the hard drive to another iPhone, the key on that phone will be different and thus can't decrypt the drive. Its like 2 phase authentication on your Gmail account and you are being sent the wrong codes. Check out this article for more information. It also explains how the fact that the phone is a 5C is significant to the encryption scheme. [0] http://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-court-order/ http://blog.trailofbits.com/2016/02/17/apple-can-comply-with...
- GnarfGnarf 11y ago
  OK, good explanation. What about removing the original hard drive from the iPhone, and installing the copy? You could just keep plugging in copies until you crack the code? Could the chip also not be cloned?

Tepix 11y ago

Has there been any precedent of (the|a) government forcing someone to sign a piece of code against their will?

j_m_b 11y ago

Glad to see this from the editorial board of the NYTimes

bsder 11y ago

The best way to put this for the other side is: "How about we start with FBI mandated remote control gun disablers given that it's guns that killed these people? Oh, you're concerned that someone will figure out how to bypass it, and it won't just be the FBI disabling your gun? Congratulations. You now understand my position."

knd775 11y ago
Given the original motivation for the Second Amendment, I think that the even just the FBI being able to remotely disable guns would be pretty concerning to some.
- bsder 11y ago
  Um, exactly?
- api 11y ago
  I think a case should be made for a right to strong encryption based on the second amendment. If anything, encryption is far more relevant today to personal defense than gun ownership and does far more to protect your individual rights against both government excess and private attacks. A gun won't stop a government from watching your every move by converting every device in your house into a surveillance device and then using "parallel construction" to persecute you if some political apparatchik doesn't like your views or opinions. A gun also won't stop a criminal from emptying your bank account or stealing your identity, attacks that can today steal far more from you than a home invasion. A gun won't stop a stalker from hacking your home devices to secretly record your kids playing, or hacking your e-mail account to spy on you, etc. Encryption on the other hand can stop all these things. Cyber-attacks today are potentially even more damaging than non-violent physical invasion (burglary, etc.). Not only that, but we are very close (if not already there) to a world where you can kill someone by hacking a device. Self-driving cars, Internet connected buildings, etc., could all be used to conduct a homicide remotely. If, for example, the signing key to a car's firmware were to be leaked, then hackers could remotely flash a person's car to murder them on the highway and make it look like a hardware failure or a freak accident. A government could even do this and have almost no chance of detection. The opportunity for corruption both public and private is fairly large given how clandestinely these kinds of attacks could be conducted. Crypto is the new "well armed militia" and the new right to personal self-defense.

botw 11y ago

I wonder why the head of FBI didn't ask Tim Cook first in private. or I missed something?

cptskippy 11y ago

What bothers me most about this article is the following statement which is accepted without contest. "Law enforcement agencies have a legitimate need for evidence, which is all the more pressing in terrorism cases." What makes a terrorism case more pressing? How many domestic terrorist attacks have had related followup attacks? How many domestic terrorist cases have been linked to other domestic terrorist attacks? How many domestic terrorist attacks have been carried out by the same set of individuals or groups? The reality is that domestic terrorist attacks are not common or frequent, there is no urgency in investigating them because they do not lead to followup attacks. They're coordinated events, not a series of related events so there's no pressing urgency?

TearsInTheRain 11y ago
what? Sure terrorist attacks are not common or frequent but they generally involve murder on a larger scale than your average criminal. There is of course a lot of urgency in investigating them as they could easily lead to follow up attacks. Look at San Bernidino and the Boston bombings. both pairs of terrorists clearly had plans for follow up attacks
- JoeAltmaier 11y ago
  What terrorists plan, and what happens, are very different. Terrorists often die in their attacks, so followup plans are often moot.
- cptskippy 11y ago
  In those cases, had the terrorists escaped custody and carried out their subsequent attacks would law enforcement having the ability to instantly access their phones have made any difference?

EGreg 11y ago

All they need to do is compel companies (by hook or by crook) to install backdoors in their algorithms or hardware. https://www.eff.org/deeplinks/2014/01/after-nsa-backdoors-security-experts-leave-rsa-conference-they-can-trust https://www.eff.org/deeplinks/2014/01/after-nsa-backdoors-se... https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG http://www.cnet.com/news/spy-fears-lead-nuke-lab-to-dump-gear-from-hp-unit-not-huawei/ http://www.cnet.com/news/spy-fears-lead-nuke-lab-to-dump-gea... Who is to say that other state actors haven't done the same to chips produced by their companies? The truth is, the genie is out of the bottle. A year and a half ago, I wrote a serious article on this: http://magarshak.com/blog/?p=169 http://magarshak.com/blog/?p=169

ikeboy 11y ago

> It is also theoretically possible that hackers could steal the software from the company’s servers. It's also theoretically possible for hackers to steal Apple's private key from their servers, in the exact same way. As far as I see, there's no change to the threat model by Apple making a new software version, and signing it using the same process they use to sign other versions of iOS. It's useless if not signed, so the real worry is someone having the ability to sign it, and that applies exactly the same if Apple signs iOS or FBiOS. This suggests the authors don't understand the technology well enough to know this. edit: this is assuming the software is locked to a specific device. So the signing doesn't matter to any other device. If the software worked on all devices, then a leak of a signed version would be problematic. Although even if they couldn't lock it to device, they could make it only work for a short time, say a week, so if that signed version leaks later it would have no effects (I'm not sure if you can change the clock on a phone without unlocking it though).

danielsju6 11y ago
Once the software exists, due to Apple's specialized knowledge, what's to stop them from issuing a NSL for Apple's signing keys + access to the remote update mechanism... then the FISC rubber stamps warrants en masse and Apple devices are used to spy on tens of millions of Americans. It sets a horrible precedent that the government can redirect the development resources of a private company. How many millions of dollars in engineering salaries will this take? Project management? They're demanding an entire blackhat division of Apple be spun up, with the goal of circumventing other teams security effort.
- ikeboy 11y ago
  None of that has to do with Apple creating the software, but rather with their handing over the signing keys etc. The FBI or NSA could probably create their own software if they had the keys and source code. I doubt the cost to Apple is over 100 man hours. But if it's too difficult, they can argue that and simply hand over the source code.
  - danielsju6 11y ago

jy2947 11y ago

I may be wrong - but I have a feeling that, technology companies like apple and google are developing software on device to make user data so protected that they will say "I can not technically to crack my software" even ordered by a Judge (presumably for legit reason), thus the DOJ is using this case trying to prevent it from happening. And, if this is the case, then personally I am at the DOJ side, because I recognize this is a less ideal world (actually I think it is even worse), and this country is technically in a war.

geggam 11y ago

When two nuts with rifles trigger a "National Security" problem I think the problem is with the Nation not the people. What happens when an entire nation threatens us ?

stillsut 11y ago

Couple of thoughts: - Doesn't an iPhone become completely secure if you prevent if from passively polling for OS updates. If the iPhone would only poll and install updates after user un-locks and allows, then there would be no way change the necessary software configuration without breaking the encryption. And the encryption can't be broken, thus if you could chose OS -level default "don't accept or even check for any updates without user permnission" you really would have an unbreakable device. But if they ever did implement this, it would be terrible for Apple's forced upgrades and their platform would fragment into many incompatible versions. I think everyone knows which option Apple will chose between: CompletelySecurePhoneOS or AbilityToForceUpgradesAndPatches. - Correct me if I'm wrong but didn't Tim Cook initially state cracking this phone was impossible according to Apple's experts? And now it seems it's a quite reasonable issue of Apple signing an OS-update specific to this device's unique ID; so quite feasible. So was that a lie?

marincounty 11y ago

Does anyone feel this whole incident is a carefully staged by the FBI and Apple? I'm not into conspiracy theories, but I'm wondering on this one. Why would the FBI, or Apple make this so public? The Apple letter seemed staged? The federal government always seems to get what it wants in the end, especially if one has a lot to lose? I imagine the conversation starts off with an indignant, appalled CEO. "Hell No--I'm not giving you access to my customers data!" Federal government counters with, "Do you want us to scrutinize your past, and present life?" "Do you want us to look at every stock trade you ever made?" "Do you want us to publicize the personal information we have on you already? "You know we can make your life misserable? You know we can make your companies life misserable?" No this isn't Russia, but our law enforcement branch of the federal government scares me, and I'm a nobody. There's been some deaths, especially in tech, that seem suspicious. The drug overdoses--guy in San Francisco that was about to give a talk on ATM hacking comes to mind. That tech guy who died in that fiery car crash on Los Angeles. (I don't want to argue with anyone. I have no evidence. Just a weird feeling. And yes, Tim Cook seems like a choir boy. He comes across as someone who doesn't even jay walk.)

clumsysmurf 11y ago

One thing I hope can be clarified: Is the FBI asking Apple to patch iOS on this one device, one time only (in a way that can not be reused) ... or are they asking Apple to provide a "reusable" patch / modification that allows future devices to be accessed?

Zigurd 11y ago
That's all window dressing. Once you compel the creation of software through a novel use of the all writs act, that opens the door to even more burdensome demands. Can decrypt an i-device with Secure Enclave? Build a new chip for us!
gkoberger 11y ago
I don't see the difference.
chrisdbaldwin 11y ago
Ever heard of a precedent?
- suneilp 11y ago
  Precedents are a cop out for critical thinking. Sure, they seem to have their uses, like when it guarantees victory for the righteous. However, it seems more likely it's being used as a 'they did it, so can we!' excuse. It's one thing if you use it as a starting point for discourse, it's another when you use it to beat down the opposition with what amounts to childish antics dressed up in a suit and tie.
  - throwaway2048 11y ago
    Precedent is an actual legal term of art, where a case decision can lead to binding (in the hard sense) judgements in proceeding cases.
hammock 11y ago
Part of Tim Cook's argument was once they release the patch into the wild, it could be reused in other cases

lbstr_ftw 11y ago

Apple is not obligated to write malware for you.

redindian75 11y ago

Wonder why can FBI just hand the phone to Apple keep the phone just get the data we don't needed specifics.

api 11y ago
Because once it is shown how it's done they will push to mandate the capability and force inferior security.
rplst8 11y ago
Do you really want that to be the model for American justice? Law enforcement hands your digital electronic records over to a private company who has the power to put anything on that phone? Do you want to entrust your personal legal future to a private entity? I think I'd want a solid chain of custody on anything that may prove my innocence.
- tosseraccount 11y ago
  The phone was the property of San Bernardino County. The county has longstanding email and Internet use policies that state, “NO USER SHOULD HAVE AN EXPECTATION OF PRIVACY” - http://ktla.com/2016/02/18/why-didnt-san-bernardino-county-officials-have-access-to-the-terrorist-iphone/ http://ktla.com/2016/02/18/why-didnt-san-bernardino-county-o...
  - dclowd9901 11y ago
    I bet even I, not a lawyer, could reasonably defend that, no matter who "owns it", a device as personal and as much an extension of the brain as a smartphone could be considered private.
- buzzdenver 11y ago
  That's a very weak argument. Individuals and companies testify in court all the time. They could lie and plant evidence, but in most cases I'd still trust them more than the police who kind of has an incentive to find somebody guilty.
11y ago

chrischen 11y ago

This is also a great product move by Apple, as if they win it shows even the FBI can't access your locked phone.

tosseraccount 11y ago
Sure they can't mill down the chip and probe it with some advanced microscope?
- andromeduck 11y ago
  It'd be difficult and expensive. There's also a good chance you'd meaa up and destroy the data.
  - salgernon 11y ago
    What about asserting write lock on the flash? By piggybacking a copied (but encrypted), identical flash part, or an ICE that allows reads from the original flash and writes to another part, the os wouldn't necessarily know there was anything nefarious going on. Besides, if this particular information is that valuable, they would have no problem paying for it. Which brings us back to: it isn't the device they want cracked, but governmental oversight of (civilian) encryption.
    - interpol_p 11y ago
      I'm not sure but I think the problem is that the data isn't just encrypted with the user's passcode, it's encrypted with the passcode entangled with the private key of the secure enclave chip (which, presumably, is unknown to anyone). So they can't just attempt to brute force the encrypted data, as the encryption key would be 256 bits or more rather than just a 4 or 6-digit numeric passcode. That's why they want Apple to open the OS up to brute force passcode attempts. Edit: there's no secure enclave chip on the phone in question, but it seems that iOS 8 and later encrypt the user data with a separate private key combined with the user passcode.
- hueving 11y ago

grecy 11y ago

I've been explaining this case to others and I've come up with a good way to make them understand. "Instead of the FBI making this request, how would you feel if the Government of China were asking? or Russia, or Syria? Do you want them to have the ability to read your encrypted data off your iPhone?"

harryh 11y ago
Aren't there lots and lots of things that you would feel comfortable with the US doing but not those other governments? What makes this particular issue different from all of those other things?
mc32 11y ago
There is no reason why a China, Russia or India cannot not make this request from Apple in order to allow them to legally sell their product in those markets. And as sovereign nations they have a right to demand such, provided that's their law and in turn violates no international law they've subscribed to. Countries in the ME and India[1] demanded such from RIM/BBM. [1]http://www.wired.co.uk/news/archive/2013-07/11/blackberry-india http://www.wired.co.uk/news/archive/2013-07/11/blackberry-in...
- grecy 11y ago
  And knowing that once they have that ability, there would be nothing stopping them using it on any iPhone in the entire world? Including yours? You're OK with that? After what Snowden has told us, we know with certainty the FBI/NSA/CIA will use this ability on the phones of citizens of other countries, so I think it's safe to assume other countries would do the same.
  - ikeboy 11y ago
    They're willing to hand the phone over to Apple and have the entire process take place on Apple's premises, locked to this specific phone. That's what the court order says.
  - vectorjohn 11y ago

buzzdenver 11y ago

Doesn't the fact that Apple is capable of unlocking the phone mean that a backdoor already exists ? Then it's just a question of a lone wolf telling the FBI how to do it, maybe along with using some secret keys that could be stolen if Apple is hacked like Sony was. I would like a phone that is unhackable even by its creator. Anything else is just a question of time to get broken into.

function_seven 11y ago
It all depends on how you define a backdoor. The 5c doesn't have the secure enclave†, so all of it's encryption routines are done in the CPU, as software/firmware. That software doesn't contain a backdoor, but the fact that a new software load could be created and installed could be viewed as the backdoor itself. But if that software doesn't currently exist, is the mere potential of it a backdoor? Somewhat of a philosophical question. If Apple prevails and doesn't write the software the FBI is demanding, then the backdoor is not there. The later iPhones with the Secure Enclave may truly be unbreakable if they protect their secrets with hardware in the chip. But my understanding of it is that Apple is NOT capable of unlocking the phone right now. The FBI is demanding that they develop that capability. So I guess they're capable of being capable... † At the risk of being an armchair SE expert...
- kalms 11y ago
  A Schrödingers Backdoor? lol.. Err, anyway. Carry on.
- unfamiliar 11y ago
  How would a backdoor look? Some secret additional encryption key capable of unlocking the encrypted data? Such a key exists, and it is whatever key Apple uses to sign the iOS updates. Only Apple can sign a new iOS release, so only Apple can update the code to remove all security features. This looks a lot like a backdoor to me, just that the implementation hasn't been written. But all you really would need, in theory, is the signing key.
  - 11y ago

tosseraccount 11y ago

Apple indeed may have a right to refuse the administration. Does the administration have the right to remove Apple Computer from the GSA government purchasing schedule?

deleted 11y ago
[deleted]
valleyer 11y ago
Yeah, I'm sure they'd shed a tear over that.

msravi 11y ago

From here (4th para from the end): http://www.nytimes.com/2016/02/19/technology/how-tim-cook-became-a-bulwark-for-digital-privacy.html http://www.nytimes.com/2016/02/19/technology/how-tim-cook-be... "Apple had asked the F.B.I. to issue its application for the tool under seal. But the government made it public, prompting Mr. Cook to go into bunker mode to draft a response, according to people privy to the discussions, who spoke on condition of anonymity." If this is true, it sort-of implies that Apple would have done it, but secretly, and they were forced to take their very public stance because of the FBI's posturing.

Arnt 11y ago
Are you suggesting that Apple would've done this particular hack provided it wouldn't set any precedent? If so that sounds quite sensible to my ears.
skywhopper 11y ago
I don't think so. Apple would prefer not to fight this particular battle over this particular case in the public sphere, but the FBI would. The general principle Apple is fighting for here is very important, but the FBI knows this is the weakest point in that principle: the locked phone of a dead terrorist who killed several people. Politically and possibly legally, this is a winner for the FBI. Technically it's a loser if you believe strong encryption is important at all. Apple wants to win the political argument, so it would not want this request to be made public. Anyway, why should it be, when next to no other such requests are made public? Anyway, in a legal battle, you contest every relevant point. The fact that they contested it doesn't mean they would have behaved differently after, except that they wouldn't have had to make a public statement under less than ideal circumstances.
- themartorana 11y ago
  Are you suggesting the court would take public opinion under consideration as being at all relevant to the law? That's very worrying to me, considering how important it's been in the past for the court to ignore public opinion in favor of justice.

buzzdenver 11y ago

I wouldn't be surprised at all if Apple already gave a version of the OS to the FBI that enabled them to brute force the password for that one phone with the condition that they publicly put up this show as if they were not cooperating.

brians 11y ago
That would involve lying to a court. Intelligence folks might do that. Law enforcement? Not a chance; it would be career-ending even to discuss it.
- logfromblammo 11y ago
  If you truly believe that, I think perhaps you place too much trust in the wrong sort of people. The reason why I consider the hypothesis unlikely is not because those involved are unwilling to deceive, but because they are unlikely to have sufficient skill to make the attempt and avoid detection. I believe that, considering the number of people that would be necessary, at least one Apple insider with ethical concerns would leak evidence that would expose the true story.
  - buzzdenver 11y ago
    I believe that much more than "law enforcement never lies", but IMO it's hard to leak evidence in this case. A whistle-blower could say that he worked on this project, but there isn't the hard evidence of documents that for example Snowden could leak. The FBI or Apple could just deny it or say no comment.

rrggrr 11y ago

Let iPhone users opt-in and you'll find far fewer proponents of backdoor encryption than will be reflected in Congress. I wouldn't be surprised if most in the LE and Intel communities didn't opt-in. Why? Perhaps because the USGOV has yet to prove they can keep their own data secure. The Office of Personnel Management hack, Clinton official emails on a private server, and many more instances have shaken the faith in USGOVs ability to be an effective steward. I'm in favor of master keys for the FBI after they prove to the public, in a transparent and accountable manner, that those keys can be kept unassailably secure from misappropriation or abuse.

cmurf 11y ago

What if Apple's coerced firmware update bricks the phone? That's destruction of evidence they'd need immunity from. What trust and conflicts arise when a company has blanket immunity from such evidence being destroyed? So many slippery slopes.

TheAppGuy 11y ago

I've got a feeling we're being manipulated by someone with an agenda at play.

Crito 11y ago
Are we ever not? It's a political topic, so manipulation goes with the territory.

marcoperaza 11y ago

TLDR for what follows: Mandated backdoors must be a red line, but this is not a request for a backdoor and actually seems pretty reasonable. Trying to argue that the tech industry shouldn't help, even in this case, is not only the wrong position in my book, but a sure way to lose the bigger debate. My views on the general encryption controversy are: 1. Everyone must be free to make their technology as secure as they possibly can. There can be no mandated weakening of security, back-doors, or other requirements to make the information more easily accessible by law enforcement. On newer iPhones, Apple has patched up the flaw that the FBI wants their help with exploiting. They must continue to be allowed to do that. 2. The government must be able to demand, with a court order predicated on probable cause, that companies provide any and all information that they have that could be useful in circumventing their security features. This can be everything from technical specifications and threat-model analyses, to lists of unpatched vulnerabilities and code-signing keys. 3. It seems to me that American companies have a moral obligation that goes beyond the legal obligations in point #2. They should be actively assisting the government in recovering information, especially when concerning issues of national security. In extreme circumstances, like total war, this should definitely be legally mandated. I'm undecided as to what the policy should be generally. On a practical level, it's probably not feasible for the government to, e.g. start hacking around the iOS codebase themselves, so just information might not be enough. I'm not too troubled by this court order, especially given the particular circumstances. The right to make products as secure as you can, even from yourself and the government, is what's really important to defend. Trying to argue that the tech industry shouldn't help, even in this case, is not only the wrong position in my book, but a sure way to lose the bigger debate. Apple's definition of "backdoor" is highly suspect. A backdoor is if I ship my product with an intentional vulnerability, so that I can hack into it later. Apple's not being forced to add a backdoor, it already exists because the security features break down against an adversary that has Apple's private key, at least for the default 4-digit PIN configuration. Now the government is asking them to use their own capabilities to help hack this phone. Of course, Apple didn't create this backdoor for malicious reasons, they just didn't include themselves in the threat-model, greatly simplifying updates and other security features, and allowing the walled-gardenness of iOS. It's also central to the walled-garden. Curiously, this is in direct contradiction to their claim for some time now, that they were designing iPhones such that they themselves can't break into them. Now put yourself in a Congressman's shoes. The FBI has been telling you for years that tech companies are being purposefully antagonistic to their legitimate search and seizure authority. That the tech companies are purposefully designing features with the sole intention of shutting the government out. Now here's a case where there was no mandated backdoor, the government was able to devise an exploit method, and they got a court order from a judge to make Apple use it on a dead terrorist's phone. "Mandatory backdoors would hurt everyone's security", one of the arguments that we've been winning with, now sounds like a bullshit cover for "we are against any government surveillance". Can you smell the legislation coming yet? Disclaimer: These are obviously my own personal views and nothing else. They do not necessarily reflect the opinions, policies, or practices of anyone but myself. (Reposted from https://news.ycombinator.com/item?id=11131456 https://news.ycombinator.com/item?id=11131456 with additional)

LeicaLatte 11y ago

Curious if Apple is breaking any user agreements if they end up doing this. Sharing information on servers is one thing. Sharing a key which enables access to all future communication too is different. Does their EULA cover such scenarios? Can it open them up to possible lawsuits from its users?

mc32 11y ago
How, the phone owner, the state agency, granted permission, the actual users died. Who'd have the basis to sue under what claims? If you thought you had a claim I guess you could sue to block the order, but that's up to the courts to decide and that would take precedence over an eula.

InTheArena 11y ago

The guy who wrote the two most important 4th amendment case opinions over the last thirty years (both in favor of privacy rights, both by 5:4 votes), and who had the longest record of cracking down on laws that were being stretched to cover uses never imagined (which by definition, the Writs law is being abused) just died. It's not good timing....

bratsche 11y ago
For those of us not well-versed in these sorts of things, what were the two cases?
- InTheArena 11y ago
  Jones and Kylo. Kylo held that the Government could not use infrared scanners to track individuals inside of their house without a warrant, while Jones held that the government could not use GPS trackers on cars, even in public, because it had to trespass to install the GPS tracker. He also dissented with the forced DNA testing of anyone charged with a crime, and from warrent-less suspecion-less traffic stops. http://reason.com/archives/2016/02/16/antonin-scalia-was-a-great-jurist-for-cr http://reason.com/archives/2016/02/16/antonin-scalia-was-a-g...
  - lern_too_spel 11y ago
    There is no explicit right to privacy in the Constitution. Some of Scalia's rulings happen to favor privacy while others do not. For example, he also said the Miranda ruling is judicial overeach, so in his view, you have rights (privacy or otherwise) only if you know about them ahead of time. Roe v. Wade established precedent for an implicit right to privacy interpretation of the 14th Amendment. Scalia has said that interpretation is wrong.
    - deleted 11y ago
      [deleted]
    - InTheArena 11y ago

mrb 11y ago

Off topic, but: "Apple is doing the right thing in challenging the federal court ruling requiring that it comply" I am not a native English speaker. Why "it comply" and not "it complies"?

deleted 11y ago
[deleted]
unfamiliar 11y ago
In this context, comply means "cooperate with the courts" or "do what the courts ask."
chillingeffect 11y ago
Subjunctive tense. Since it is still not known whether they will comply or not, the verb is unconjugated. Writing "it complies" would be confusing. It's highly proper grammar and not used in everyday spoken speech and not used all the time in most written speech, but since this is more formal and written, it's used. It's one thing the NYT gets right.
- Joof 11y ago
  Native speaker here; I knew it was correct, but I couldn't answer this question. Thanks.
- pc2g4d 11y ago
  Nitpick: subjunctive _mood_, not _tense_. From the Wikipedia article on English subjunctive: "The distinction between present and past is one of tense; the distinction between indicative and subjunctive is one of mood."
- mrb 11y ago
  Thank you! We live to learn. https://en.m.wikipedia.org/wiki/English_subjunctive https://en.m.wikipedia.org/wiki/English_subjunctive
IshKebab 11y ago
I think you're probably right - it should be "... requiring it to comply" or "... requiring that it complies". The original is not very wrong though - I don't think most native English people would even notice.

mgleason_3 11y ago

Given the powers and size of the national security budget and the NSAs in particular, why do they need Apple? Shouldnt the NSA be able to crack this on their own? Kinda makes ya wonder what all that moneys spent on...

moonshinefe 11y ago
They can get the info they want with more sophisticated techniques from what I've read. Also, Apple already gave them the iCloud backups. The legal precedent of forcing companies to break their own security for the FBI's sake is the prize at hand here it seems.
mirimir 11y ago
Well, they'd arguably need the certificate that Apple uses for signing updates. That's well-protected, I trust. There's also the issue that Apple software is closed-source. But that's presumably less problematic.

moonshinefe 11y ago

The fact that Apple has made this issue very public (with http://www.apple.com/customer-letter/ http://www.apple.com/customer-letter/) is unprecedented almost (Lavabit and SOPA had some similarities). I applaud them for taking a stand and not just giving in. If this legal precedent gets set that the FBI can force US tech companies to break into their own customers' encrypted data, you can bet the industry will lose millions if not billions of dollars worldwide in tainted reputation. Who's going to buy US companies' devices that claim privacy via encryption if they're easily backdoored at the FBI's request?

rayiner 11y ago
Is that true? Armed with a court order, the FBI can search a U.S. house, compel banks to turn over financial information, compel accountants to turn over records, etc. Yet people worldwide extensively use those American services.
- adventured 11y ago
  That's not a similar example to what's going on here. Your example would have to include a situation in which the FBI makes copies of the keys to the house, copies of the hard-drives, etc. Then inevitably makes it embarrassingly easy for other parties to get access to those as well, permanently reducing your net security to almost zilch regardless of the outcome of the context and warrant. And worse, in the process of gaining access to that one house and hard-drive, they simultaneously gain the potential to access millions of homes and hard-drives that have nothing to do with the warrant, and then those millions of houses and hard-drives see their net security reduced to essentially nothing.
  - rayiner 11y ago
    They're offering to let Apple do the unlock themselves and just hand over the data.
    - criddell 11y ago

Shivetya 11y ago

So here is a simple question. How will we know if the US becomes successful in having manufactures put in a backdoor? Can it be done to the current 6 models through a software update?

deleted 11y ago

[deleted]

DrNuke 11y ago

I am not an Appleland citizen and therefore they (all of them) should comply. If this impacts their business, their problem. EDIT: you can downvote as you want, even the mafia and the terrorists worldwide instruct some sort of welfare state other than funnelling cash out of their country to fiscal havens.