11 ms·

Justice Department Wants Data from About 12 Other iPhones

168 points by rosser 11y ago

nefitty 11y ago
I think the fear is that those 12 will lead to the other 700 million iPhones.
- marcoperaza 11y ago
  That's not a justified fear. Requiring Apple to backdoor all phones is not similar at all to requiring Apple to help hack particular phones, that they have the capability to hack, in response to court orders.
  - morcheeba 11y ago
    You haven't been paying attention. Please explain how a security hole can only be exploited by Apple+FBI and no one else.
  - nefitty 11y ago
    You're telling me you would trust that software to remain in the hands of trusted actors? In 2015, alone, the IRS was breached, LastPass, the director of the CIA, Hacking Team, even Kaspersky Labs was breached! There can be no absolute guarantee that this backdoor would remain safe indefinitely. That is just the most blatant problem, not to mention the overt displays of cynicism and misuse of authority by the NSA as revealed by the Snowden leaks. Consider the political climate in the US at the moment. Now imagine a truly evil actor came into power, being handed over control of organizations with unheard-of amounts of surveillance power. I don't mean to seem paranoid, but in this case the feeling is completely warranted.
    - marcoperaza 11y ago
      So would it be okay for the FBI to have to bring the phone to Apple?
      - lazaroclapp 11y ago
        Only if you think Apple should be an unhackable "trusted actor". Let's face it, the fact that Apple can be compeled to create this bypass is a civil rights issue, but the fact that it can create it at all is already a security bug. One that, in their defense, they seem to be trying to patch a step at a time in newer versions of their devices.
      - nefitty 11y ago
        The main point here is that neither the government nor Apple could guarantee that this backdoor software would remain safe. If the FBI brought the phone to Apple to update the custom OS, the software would then exist, which is inherently a dangerous situation. Furthermore, suddenly a precedent is set wherein Apple is obliged to continue unlocking phones for the government with custom created software. I sincerely doubt any organizations involved would tolerate the continual creation and destruction(can data be truly destroyed?) of customized OS's each time the government needed access to a phone. That means, the incentive is to create and maintain this backdoored version of the OS, setting up the exact vulnerability Apple is trying to fend off. Basically, this project, from whatever angle it is approached, has a non-zero chance of backfiring dramatically thus risking the security and privacy of millions of iPhone users throughout the world.
        spin 11y ago
        I'm under the impression that this "backdoor" is the fact that these phones can download updates to the OS. The phone checks that the update is signed by Apple. If Apple can be trusted to keep their code-signing keys secret, then surely they can be trusted to keep a special version of the OS secret. I'm still opposed to this, though... The FBI wants to be able to dictate to a private company what features to build (because of the All Writs Act).
      - danieldk 11y ago
    - deleted 11y ago
      [deleted]
    - deleted 11y ago
      [deleted]
    - deleted 11y ago
      [deleted]
    - ordbajsare 11y ago
      >truly evil actor came into power Obama is already in power..
    - csandreasen 11y ago
      A gaping "backdoor" already exists in the form of the software update mechanism. By the same logic you're using, Apple can't keep their source code and signing key secure forever, which would be a much worse leak than them losing control of a modified iOS that would let someone brute force a PIN for a phone in their physical possession without the phone being wiped.
  - kabdib 11y ago
    Why? It's a crystal clear agenda. The FBI has called for an end to effective crypto in the hands of US citizens.
    - draugadrotten 11y ago
      > The FBI has called for an end to effective crypto in the hands of US citizens. This is where it will end, and perhaps rightly so. There is no physical space in the US where US citizens can hide from the FBI and other authorities. Why should there be a virtual space where US citizens can hide. US citizens are not free to hide from the authorities and the law.
      - ropiku 11y ago
        But it wouldn't be just the US. It would be any other country, and not just the country's citizens. "Why should there be a virtual space where people can hide from US/China/Russia/Saudi Arabia/etc."
      - kabdib 11y ago
        > perhaps rightly so I see no 'rightly' in this, at all. The end-game is an abject panopticon that makes the Stasi look like amateurs. (Regardless of what Google, etc. may collect, corporations do not have guns or the ability to put you in jail. Not yet, anyway).
- deleted 11y ago
  [deleted]
headgasket 11y ago
there's quite a few more than are involved in probably about 9 innocent deaths PER DAY. http://www.huffingtonpost.com/2015/06/08/dangers-of-texting-and-driving-statistics_n_7537710.html http://www.huffingtonpost.com/2015/06/08/dangers-of-texting-... Does the justice dept want those unlocked too?
- rhizome 11y ago
  Comey said the FBI wants the ability to do this even for car accidents, so a qualified "yes."
avn2109 11y ago
Question for HN in general: Is it possible in principle (for Apple or someone else) to construct a smartphone that can accept software/firmware updates, but that Apple cannot push malware to at some later time? E.g. can we implement all security functionality in hardware/burn it into the silicon? Or accomplish the same ends by some other means? Intuition says "no," because "security functionality" is sort of nebulous. But it would be great if a device could be constructed in such a way that all such future demands for collusion by hostile actors such as governments could be rendered preemptively impossible.
- nefitty 11y ago
  This could be possible if at setup time the user was asked to create their own key, which any update would have to be signed with. This would then unburden Apple of having the "master key" needed to sign software updates, but would create an extra hoop for users to jump through to update their phone. I'm sure we've all experienced putting off a necessary update to software because of the inconvenience it would cause. Imagine millions of iPhones becoming vulnerable overnight because of mass user laziness.
  - abecedarius 11y ago
    Presumably you could set up to automatically sign anything signed by Apple, if that tradeoff suits you.
    - nefitty 11y ago
      The security issue of Apple being vulnerable to being compelled to create signed backdoors would still remain, in that case.
      - abecedarius 11y ago
        Yes, for the people who chose to be, when they chose. This choice would be decoupled from the OS choice.
  - 11y ago
werdum 11y ago
I for one am happy for this issue to be at the forefront of discussion. The worst thing that could happen is all of these requests going unspoken, buried beneath less important topics.
rebootthesystem 11y ago
I had a really bad experience with an iPhone update and a password storage app. I had been running my iPhone on iOS 8.x. No need to update to 9.x. The day finally came when I was forced to allow the update. Now, without my knowledge the update also enabled automatic updates of apps. All apps were thus updated to their latest versions without my explicit consent. I chose the app I am using to keep hundreds of account passwords specifically because they DID NOT transmit anything over the internet at the time I got it. I could do what they called "wifi sync" to synchronize and backup my database to the desktop version of the same software running on my PC within the same network. Well, with the forced update "wifi sync" went away and now the only option is "internet sync". I did not realize this whe the app ran through and synchronized to my PC. So now the dilema. This fucking company is doing this because they want to sell cloud storage for your data and force you into an annual subscription in order to be able to "internet sync". And, of course, the huge violation of the security of my data which, up until the unauthorized automatic update, had been kept private and never left my network. Not only do I have to find a new password and data vault that will not try to take ownership of my data and pull a bait-and-switch after, I also need to change every simgle password I have due to my database now being in their cloud. Unbelievable.
- Sephr 11y ago
  Instead of relying on proprietary software that is out of your control for storing your passwords (and getting burned like you have described), why not use something open source like KeePass? I don't have an iPhone, but on Android there is KeePass2Android, which is open source and (if you choose to use it as such) offline-only.
  - rebootthesystem 11y ago
    That's the migration plan when I get the time to move the data over.
timr 11y ago
...and it's an entirely reasonable position to say that they should get it, if they have a warrant. Especially if the case as cut-and-dried as the San Bernardino one. The public debate on this has reached truly sad, nigh-Trumpian levels of hysteria and uninformed commentary. There is no "back-door" here. Encryption is not being compromised. This has very little to do with encryption at all, really: if the criminals in question were to use a strong password instead of a four-digit PIN, Apple could just shrug, say "not possible in our lifetimes", and that would be the end of it. But these criminals have easily brute-forceable PIN codes, and the investigators want to brute force them. This situation is about a legal fight of very narrow parameters: should it be possible for the government to compel a company to help extract its customers' "secure" data, via this specific, very old law. Reasonable people can disagree on this point. Unfortunately, the public debate has gone completely round the bend, with famous people grandstanding on totally irrelevant things (like "encryption back doors"), which have no bearing on anything at all. Moreover, as it turns out, Apple has been doing this for years for police investigations, and the empire has not yet fallen. If you're worried about the slippery slope, well...we're already well downhill, and our bottoms are wet. Perspective. I realize that it's not popular amongst the tinfoil-hat set that has set up residence here, but I think that there are times when we want our government to be able to do things like break into a suspect's phone. There should be safeguards (like warrants), of course, but it's a perfectly reasonable position to say that privacy is not absolute.
- erkkie 11y ago
  Fully agree with your comment about the discussion going full on hyperbole but at the same time agree that it's not Apple's job to intentionally weaken the security parameters of their firmware. Asking for encryption back doors is just another step from this, are you confident enough that it's not a risk worthy of consideration?
- threatofrain 11y ago
  I agree with you that people capitalize on events to fit into their political narratives, and I also agree that privacy is not an absolute value, and that tensions between values calls for tradeoffs to be made. But I do believe that calling this a backdoor is proper framing. Apple provided a weak password knowing that convenience often beats security, but Apple also provided a mechanism by which one can have weak passwords and still have strong security via a max-attempt mechanism. It is a circumvention of security features, and "backdoors" are about security, not encryption (which is merely a subset of security). I also think the legal fight is not circumscribed around narrow parameters with predictably narrow legal outcomes. The FBI cites a law from 1789 that says that the court may issue "...all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law". It does not sound easy to predict what case law shall determine to be "necessary or appropriate" 5-10 years from now.
froo 11y ago
"the FBI said they are not seeking to set a precedent in the case, but to get the company to help them open a single phone that may hold crucial evidence to help explain the most deadly terrorist attack on U.S. soil since Sept. 11, 2001." What qualifies this as being a terrorist attack? Is it because the colour of the perpetrator's skin wasn't white? Sandy Hook had double the number of resulting deaths and so is technically more deadly. Virgina Tech was done by a South Korean born man with even more deaths than Sandy Hook. Poor reporting WSJ
- MacsHeadroom 11y ago
  WSJ is simply reporting what the FBI said in reference to Sandy Hook. The FBI is at fault here, not WSJ.
  - toyg 11y ago
    He-said/she-said is poor reporting.
    - croon 11y ago
      "He-said/she-said" is referring to reporting rumours. This is reporting of a public statement of a government agency.
      - toyg 11y ago
        It's also about reporting statements verbatim without trying to discern what the truth is. Writing down a public statement is basically just relaying a message; at that point you are writing a press release for them, not doing journalism. And then you wonder why they replace you with a Reuters feed...
        dragonwriter 11y ago
        > at that point you are writing a press release for them Or, as is often the case, cut-and-pasting from a press release they provided you.
abpavel 11y ago
Sadly this is a tough sell, given that the general public perceives "encryption" as "password", unaware of the underlying technology and implications. It's doubly sadly that it was a government employee, in a government-controlled environment, using a government-managed device, and even when government had access they went and changed the password, locking themselves out. Critical thinking would lead one to question the need of any data at all, given the thoroughly demonstrated incompetence. Yet public filter stops on perception that that Apple once cooperated, but now chooses not to do so.
tomberek 11y ago
What about a different approach? A society does want to allow access to information for investigative purposes while protecting security. Then what about allowing court orders for companies to bypass security in their products with the caveat that the access method is made publicly reproducible. This forces the company to fix the vulnerability and forces the government to carefully consider which cases are important enough. Just brainstorming..... not a solid proposal. Shoot some holes in it please.
rurban 11y ago
On a side note: The FBI didn't/couldn't even properly investigate 9/11 so why do they still dare to use this wording? ("to help them open a single phone that may hold crucial evidence to help explain the most deadly terrorist attack on U.S. soil since Sept. 11, 2001") What came out of PENTTBOM? One single court case against Moussaoui, who was not directly involved in 9/11 at all, but that's it. Hundreds of arrests which led to nothing but illegitime long-term hold ups under military law, but no due law. If Apple can help them to extract data from those phones, fine. But Apple apparently built secure phones without bypass, so they are out of luck and it makes no sense to come up with fantasy warrants without any technical solution.
jbverschoor 11y ago
What happened to "just one phone"
coldnebo 11y ago
I'm not sure I understand this. Apple seems to be limiting all discussion to in-situ mechanisms of cracking, but no one is talking about external means. For example ICE-level debuggers require sophisticated hardware that is not easily available to everyone. Likewise, the XBOX encryption was very difficult to crack without Ghz hardware. Just put the critical path in the prom and then bypass the prom with your own hardware-level circuit. The device itself can be keyed so that only Apple hardware bypass is allowed to connect in this way. Now you have a physical bypass that is difficult if not impossible to get around, but enables warranted access by agencies that own the limited hardware. This also has the advantage of human cost. You can't easily apply this method to millions of phones without a huge cost in time and effort. Even if the device is stolen, it limits exposure to phones in the physical possession of the hardware bypass which is surely better than compromising millions of phones. And so what that the critical path patch exists out in the open? Knock yourself out and make an emulator that will unlock hw emulated phones (which is a difficult task, not even the IOS emulator is a true hw emulator), but it won't work on the actual hardware unless the prom is swapped which is hardly trivial. The key signing argument has little weight by the way. DVD manufacturers had the same stance and the root key was leaked to the public. How can Apple guarantee the same won't happen with their keys? It seems both Apple and the FBI are withholding something, but on face value the technical requirements should allow warranted access. The fact that they don't is a flaw in the technology design. Case law surely has precedents in this area? Can safe manufacturers be required to make bypass mechanisms for bank vaults? What about non-criminal property law? Say a family member dies and the legal estate needs access?
joekrill 11y ago
> the encryption of personal devices has become a serious problem for criminal investigators in a variety of cases and setting And so has the second amendment -- but that doesn't mean we should get rid of it. Yes, their job is hard. That's the nature of the job. Just because something makes a job more difficult doesn't mean it's a bad thing. I don't get why they insist on making this argument.
- sieveoferos 11y ago
  I agree with the general sentiment of "don't get rid of things only because they make certain jobs more difficult" - but I don't think the FBI is arguing for getting rid of encryption. I think they want to be able to break security surrounding encryption sometimes and under certain circumstances.
  - tobylane 11y ago
    They amount to the same thing, depending on how its done and who gets it. If any law enforcement who tries hard (FBI, MI5, China) to fight what they want to fight gets hold of Apple's tool then that encryption is not so much outlawed as pointless to use. It's because of the feverant fight on something (communism, black civil rights protesters, anti capitalists, future civil rights upholders) leads to questionable use of any tool that we can't give them too many tools. In the UK the mayor of London bought 3 water cannon trucks but has been forbidden to use them - where will they be in ten years time?
malandrew 11y ago
This may be a totally absurd question, but is there a way to comply such that the government explicitly acknowledges that a case cannot be used as precedence? i.e. comply with the order, but this case legally can't be referred to ever again as justification of precedence in any other case.

168 points by rosser 11y ago

nefitty 11y ago

I think the fear is that those 12 will lead to the other 700 million iPhones.

marcoperaza 11y ago
That's not a justified fear. Requiring Apple to backdoor all phones is not similar at all to requiring Apple to help hack particular phones, that they have the capability to hack, in response to court orders.
- morcheeba 11y ago
  You haven't been paying attention. Please explain how a security hole can only be exploited by Apple+FBI and no one else.
- nefitty 11y ago
  You're telling me you would trust that software to remain in the hands of trusted actors? In 2015, alone, the IRS was breached, LastPass, the director of the CIA, Hacking Team, even Kaspersky Labs was breached! There can be no absolute guarantee that this backdoor would remain safe indefinitely. That is just the most blatant problem, not to mention the overt displays of cynicism and misuse of authority by the NSA as revealed by the Snowden leaks. Consider the political climate in the US at the moment. Now imagine a truly evil actor came into power, being handed over control of organizations with unheard-of amounts of surveillance power. I don't mean to seem paranoid, but in this case the feeling is completely warranted.
  - marcoperaza 11y ago
    So would it be okay for the FBI to have to bring the phone to Apple?
    - lazaroclapp 11y ago
      Only if you think Apple should be an unhackable "trusted actor". Let's face it, the fact that Apple can be compeled to create this bypass is a civil rights issue, but the fact that it can create it at all is already a security bug. One that, in their defense, they seem to be trying to patch a step at a time in newer versions of their devices.
    - nefitty 11y ago
      The main point here is that neither the government nor Apple could guarantee that this backdoor software would remain safe. If the FBI brought the phone to Apple to update the custom OS, the software would then exist, which is inherently a dangerous situation. Furthermore, suddenly a precedent is set wherein Apple is obliged to continue unlocking phones for the government with custom created software. I sincerely doubt any organizations involved would tolerate the continual creation and destruction(can data be truly destroyed?) of customized OS's each time the government needed access to a phone. That means, the incentive is to create and maintain this backdoored version of the OS, setting up the exact vulnerability Apple is trying to fend off. Basically, this project, from whatever angle it is approached, has a non-zero chance of backfiring dramatically thus risking the security and privacy of millions of iPhone users throughout the world.
      - spin 11y ago
        I'm under the impression that this "backdoor" is the fact that these phones can download updates to the OS. The phone checks that the update is signed by Apple. If Apple can be trusted to keep their code-signing keys secret, then surely they can be trusted to keep a special version of the OS secret. I'm still opposed to this, though... The FBI wants to be able to dictate to a private company what features to build (because of the All Writs Act).
    - danieldk 11y ago
  - deleted 11y ago
    [deleted]
  - deleted 11y ago
    [deleted]
  - deleted 11y ago
    [deleted]
  - ordbajsare 11y ago
    >truly evil actor came into power Obama is already in power..
  - csandreasen 11y ago
    A gaping "backdoor" already exists in the form of the software update mechanism. By the same logic you're using, Apple can't keep their source code and signing key secure forever, which would be a much worse leak than them losing control of a modified iOS that would let someone brute force a PIN for a phone in their physical possession without the phone being wiped.
- kabdib 11y ago
  Why? It's a crystal clear agenda. The FBI has called for an end to effective crypto in the hands of US citizens.
  - draugadrotten 11y ago
    > The FBI has called for an end to effective crypto in the hands of US citizens. This is where it will end, and perhaps rightly so. There is no physical space in the US where US citizens can hide from the FBI and other authorities. Why should there be a virtual space where US citizens can hide. US citizens are not free to hide from the authorities and the law.
    - ropiku 11y ago
      But it wouldn't be just the US. It would be any other country, and not just the country's citizens. "Why should there be a virtual space where people can hide from US/China/Russia/Saudi Arabia/etc."
    - kabdib 11y ago
      > perhaps rightly so I see no 'rightly' in this, at all. The end-game is an abject panopticon that makes the Stasi look like amateurs. (Regardless of what Google, etc. may collect, corporations do not have guns or the ability to put you in jail. Not yet, anyway).
deleted 11y ago
[deleted]

headgasket 11y ago

there's quite a few more than are involved in probably about 9 innocent deaths PER DAY. http://www.huffingtonpost.com/2015/06/08/dangers-of-texting-and-driving-statistics_n_7537710.html http://www.huffingtonpost.com/2015/06/08/dangers-of-texting-... Does the justice dept want those unlocked too?

rhizome 11y ago
Comey said the FBI wants the ability to do this even for car accidents, so a qualified "yes."

avn2109 11y ago

Question for HN in general: Is it possible in principle (for Apple or someone else) to construct a smartphone that can accept software/firmware updates, but that Apple cannot push malware to at some later time? E.g. can we implement all security functionality in hardware/burn it into the silicon? Or accomplish the same ends by some other means? Intuition says "no," because "security functionality" is sort of nebulous. But it would be great if a device could be constructed in such a way that all such future demands for collusion by hostile actors such as governments could be rendered preemptively impossible.

nefitty 11y ago
This could be possible if at setup time the user was asked to create their own key, which any update would have to be signed with. This would then unburden Apple of having the "master key" needed to sign software updates, but would create an extra hoop for users to jump through to update their phone. I'm sure we've all experienced putting off a necessary update to software because of the inconvenience it would cause. Imagine millions of iPhones becoming vulnerable overnight because of mass user laziness.
- abecedarius 11y ago
  Presumably you could set up to automatically sign anything signed by Apple, if that tradeoff suits you.
  - nefitty 11y ago
    The security issue of Apple being vulnerable to being compelled to create signed backdoors would still remain, in that case.
    - abecedarius 11y ago
      Yes, for the people who chose to be, when they chose. This choice would be decoupled from the OS choice.
- 11y ago

werdum 11y ago

I for one am happy for this issue to be at the forefront of discussion. The worst thing that could happen is all of these requests going unspoken, buried beneath less important topics.

rebootthesystem 11y ago

I had a really bad experience with an iPhone update and a password storage app. I had been running my iPhone on iOS 8.x. No need to update to 9.x. The day finally came when I was forced to allow the update. Now, without my knowledge the update also enabled automatic updates of apps. All apps were thus updated to their latest versions without my explicit consent. I chose the app I am using to keep hundreds of account passwords specifically because they DID NOT transmit anything over the internet at the time I got it. I could do what they called "wifi sync" to synchronize and backup my database to the desktop version of the same software running on my PC within the same network. Well, with the forced update "wifi sync" went away and now the only option is "internet sync". I did not realize this whe the app ran through and synchronized to my PC. So now the dilema. This fucking company is doing this because they want to sell cloud storage for your data and force you into an annual subscription in order to be able to "internet sync". And, of course, the huge violation of the security of my data which, up until the unauthorized automatic update, had been kept private and never left my network. Not only do I have to find a new password and data vault that will not try to take ownership of my data and pull a bait-and-switch after, I also need to change every simgle password I have due to my database now being in their cloud. Unbelievable.

Sephr 11y ago
Instead of relying on proprietary software that is out of your control for storing your passwords (and getting burned like you have described), why not use something open source like KeePass? I don't have an iPhone, but on Android there is KeePass2Android, which is open source and (if you choose to use it as such) offline-only.
- rebootthesystem 11y ago
  That's the migration plan when I get the time to move the data over.

timr 11y ago

...and it's an entirely reasonable position to say that they should get it, if they have a warrant. Especially if the case as cut-and-dried as the San Bernardino one. The public debate on this has reached truly sad, nigh-Trumpian levels of hysteria and uninformed commentary. There is no "back-door" here. Encryption is not being compromised. This has very little to do with encryption at all, really: if the criminals in question were to use a strong password instead of a four-digit PIN, Apple could just shrug, say "not possible in our lifetimes", and that would be the end of it. But these criminals have easily brute-forceable PIN codes, and the investigators want to brute force them. This situation is about a legal fight of very narrow parameters: should it be possible for the government to compel a company to help extract its customers' "secure" data, via this specific, very old law. Reasonable people can disagree on this point. Unfortunately, the public debate has gone completely round the bend, with famous people grandstanding on totally irrelevant things (like "encryption back doors"), which have no bearing on anything at all. Moreover, as it turns out, Apple has been doing this for years for police investigations, and the empire has not yet fallen. If you're worried about the slippery slope, well...we're already well downhill, and our bottoms are wet. Perspective. I realize that it's not popular amongst the tinfoil-hat set that has set up residence here, but I think that there are times when we want our government to be able to do things like break into a suspect's phone. There should be safeguards (like warrants), of course, but it's a perfectly reasonable position to say that privacy is not absolute.

erkkie 11y ago
Fully agree with your comment about the discussion going full on hyperbole but at the same time agree that it's not Apple's job to intentionally weaken the security parameters of their firmware. Asking for encryption back doors is just another step from this, are you confident enough that it's not a risk worthy of consideration?
threatofrain 11y ago
I agree with you that people capitalize on events to fit into their political narratives, and I also agree that privacy is not an absolute value, and that tensions between values calls for tradeoffs to be made. But I do believe that calling this a backdoor is proper framing. Apple provided a weak password knowing that convenience often beats security, but Apple also provided a mechanism by which one can have weak passwords and still have strong security via a max-attempt mechanism. It is a circumvention of security features, and "backdoors" are about security, not encryption (which is merely a subset of security). I also think the legal fight is not circumscribed around narrow parameters with predictably narrow legal outcomes. The FBI cites a law from 1789 that says that the court may issue "...all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law". It does not sound easy to predict what case law shall determine to be "necessary or appropriate" 5-10 years from now.

froo 11y ago

"the FBI said they are not seeking to set a precedent in the case, but to get the company to help them open a single phone that may hold crucial evidence to help explain the most deadly terrorist attack on U.S. soil since Sept. 11, 2001." What qualifies this as being a terrorist attack? Is it because the colour of the perpetrator's skin wasn't white? Sandy Hook had double the number of resulting deaths and so is technically more deadly. Virgina Tech was done by a South Korean born man with even more deaths than Sandy Hook. Poor reporting WSJ

MacsHeadroom 11y ago
WSJ is simply reporting what the FBI said in reference to Sandy Hook. The FBI is at fault here, not WSJ.
- toyg 11y ago
  He-said/she-said is poor reporting.
  - croon 11y ago
    "He-said/she-said" is referring to reporting rumours. This is reporting of a public statement of a government agency.
    - toyg 11y ago
      It's also about reporting statements verbatim without trying to discern what the truth is. Writing down a public statement is basically just relaying a message; at that point you are writing a press release for them, not doing journalism. And then you wonder why they replace you with a Reuters feed...
      - dragonwriter 11y ago
        > at that point you are writing a press release for them Or, as is often the case, cut-and-pasting from a press release they provided you.

abpavel 11y ago

Sadly this is a tough sell, given that the general public perceives "encryption" as "password", unaware of the underlying technology and implications. It's doubly sadly that it was a government employee, in a government-controlled environment, using a government-managed device, and even when government had access they went and changed the password, locking themselves out. Critical thinking would lead one to question the need of any data at all, given the thoroughly demonstrated incompetence. Yet public filter stops on perception that that Apple once cooperated, but now chooses not to do so.

tomberek 11y ago

What about a different approach? A society does want to allow access to information for investigative purposes while protecting security. Then what about allowing court orders for companies to bypass security in their products with the caveat that the access method is made publicly reproducible. This forces the company to fix the vulnerability and forces the government to carefully consider which cases are important enough. Just brainstorming..... not a solid proposal. Shoot some holes in it please.

rurban 11y ago

On a side note: The FBI didn't/couldn't even properly investigate 9/11 so why do they still dare to use this wording? ("to help them open a single phone that may hold crucial evidence to help explain the most deadly terrorist attack on U.S. soil since Sept. 11, 2001") What came out of PENTTBOM? One single court case against Moussaoui, who was not directly involved in 9/11 at all, but that's it. Hundreds of arrests which led to nothing but illegitime long-term hold ups under military law, but no due law. If Apple can help them to extract data from those phones, fine. But Apple apparently built secure phones without bypass, so they are out of luck and it makes no sense to come up with fantasy warrants without any technical solution.

jbverschoor 11y ago

What happened to "just one phone"

coldnebo 11y ago

I'm not sure I understand this. Apple seems to be limiting all discussion to in-situ mechanisms of cracking, but no one is talking about external means. For example ICE-level debuggers require sophisticated hardware that is not easily available to everyone. Likewise, the XBOX encryption was very difficult to crack without Ghz hardware. Just put the critical path in the prom and then bypass the prom with your own hardware-level circuit. The device itself can be keyed so that only Apple hardware bypass is allowed to connect in this way. Now you have a physical bypass that is difficult if not impossible to get around, but enables warranted access by agencies that own the limited hardware. This also has the advantage of human cost. You can't easily apply this method to millions of phones without a huge cost in time and effort. Even if the device is stolen, it limits exposure to phones in the physical possession of the hardware bypass which is surely better than compromising millions of phones. And so what that the critical path patch exists out in the open? Knock yourself out and make an emulator that will unlock hw emulated phones (which is a difficult task, not even the IOS emulator is a true hw emulator), but it won't work on the actual hardware unless the prom is swapped which is hardly trivial. The key signing argument has little weight by the way. DVD manufacturers had the same stance and the root key was leaked to the public. How can Apple guarantee the same won't happen with their keys? It seems both Apple and the FBI are withholding something, but on face value the technical requirements should allow warranted access. The fact that they don't is a flaw in the technology design. Case law surely has precedents in this area? Can safe manufacturers be required to make bypass mechanisms for bank vaults? What about non-criminal property law? Say a family member dies and the legal estate needs access?

joekrill 11y ago

> the encryption of personal devices has become a serious problem for criminal investigators in a variety of cases and setting And so has the second amendment -- but that doesn't mean we should get rid of it. Yes, their job is hard. That's the nature of the job. Just because something makes a job more difficult doesn't mean it's a bad thing. I don't get why they insist on making this argument.

sieveoferos 11y ago
I agree with the general sentiment of "don't get rid of things only because they make certain jobs more difficult" - but I don't think the FBI is arguing for getting rid of encryption. I think they want to be able to break security surrounding encryption sometimes and under certain circumstances.
- tobylane 11y ago
  They amount to the same thing, depending on how its done and who gets it. If any law enforcement who tries hard (FBI, MI5, China) to fight what they want to fight gets hold of Apple's tool then that encryption is not so much outlawed as pointless to use. It's because of the feverant fight on something (communism, black civil rights protesters, anti capitalists, future civil rights upholders) leads to questionable use of any tool that we can't give them too many tools. In the UK the mayor of London bought 3 water cannon trucks but has been forbidden to use them - where will they be in ten years time?

malandrew 11y ago

This may be a totally absurd question, but is there a way to comply such that the government explicitly acknowledges that a case cannot be used as precedence? i.e. comply with the order, but this case legally can't be referred to ever again as justification of precedence in any other case.