36 ms·
Justice Department Wants Apple to Unlock Nine More iPhones
- arrty88 11y ago> The Manhattan district attorney, Cyrus R. Vance Jr., foreground, and New York City’s police commissioner, William J. Bratton, behind him, say they have about 175 iPhones they have been unable to unlock. Wait, how many have they been able to unlock and how? Sheer luck?
- Eric_WVGG 11y agonah they have tools that can be embedded between the touchscreen and logic board, can be used to brute force https://www.youtube.com/watch?v=meEyYFlSahk https://www.youtube.com/watch?v=meEyYFlSahk I naively thought it was a machine with a robotic finger, derp
- cplease 11y agoOnly on iOS <= 8.1. Is there anything published that works since 8.1.1?
- jonah 11y agoThis is the blog post that video comes from: http://blog.mdsec.co.uk/2015/03/bruteforcing-ios-screenlock.html http://blog.mdsec.co.uk/2015/03/bruteforcing-ios-screenlock.... It has a bit more context.
- taneq 11y agoIs this close enough to your original idea? http://www.dashfest.com/?p=393 http://www.dashfest.com/?p=393
- nightpool 11y agoDepends a lot on the version of the phone and the state that they found them in, no?
- matthew-wegner 11y agoPerhaps luck (trying birthdays), perhaps getting pin numbers from other services (ATM card) and trying those...
- ceejayoz 11y agoAs long as the "delete after ten failed attempts" feature is off, you can try as many times as you want. It'll be slow going (the phone institutes delays after a bunch of failures), but I'm sure feeding SSNs, phone numbers, birthdays, etc. into it gets decent returns.
- rasz_pl 11y ago>> still works even with the “Erase data after 10 attempts” configuration setting enabled. Our initial analysis indicates that the IP Box is able to bypass this restriction by connecting directly to the iPhone’s power source and aggressively cutting the power after each failed PIN attempt, but before the attempt has been synchronized to flash memory
- r00fus 11y agoClearly this is an agenda. I still don't understand why Apple needs to save the FBI from it's own incompetence in asking the government office that managed the iPhone to reset the password. It seems to me that unless tech companies come together to defend Apple, we may see (unregulated and unaccountable) government become very very part of all facets of computing.
- ikeboy 11y agoI can't think of any way in which the FBI's incompetence would have legal implications for Apple's obligations. How would that work? If they're able to help, and can be compelled legally, why would the FBI having previously had the ability to get the data but losing it to a mistake change their obligation?
- rrggrr 11y agoState, county and municipal governments are next.
- hanief 11y agoDon't forget other countries.
- Piskvorrr 11y agoAnd just plain criminals, with political motives or not - passing a law never stopped those. "It would be unfortunate if the data from your lost iPhone somehow got leaked..."
- macspoofing 11y agoDivorce lawyers after that.
- tajen 11y agoCouple investigators after that, then divorce presales.
- drawkbox 11y agoBusiness idea/product theft and intel are always on deck.
- briankwest 11y agoI thought it was 12, now its 9? Are they using new math?
- brians 11y agoOctal. Aaaand they dropped one.
- BWStearns 11y agoAt least now all doubt is formally removed that they want to use the precedent set in the SB case for more mundane requests. Hopefully this should make Apples' PR fight easier.
- Shivetya 11y agoWell the spin game is guaranteed to ramp up. Sycophants are already laying the ground that Apple and Cook would have to accept some of the blame in any upcoming terrorist attacks. I am amazed they haven't tried the kiddie porn route yet. Still another issue is, if they were compelled to create it they could be compelled to surrender it too. With that its a matter of weeks or months before it gets leaked to a criminal organization or country. My long term concern is, would we ever know if they got compelled to change iOS to insert a backdoor that gets pushed to our phones. Even if we do how long before carriers are required to lock users out for not updating?
- rogerhoward 11y agoI've already seen the child porn angle playing out in posts on Facebook. This just a little while ago: "Every child porn videographer in America is trading in his camera for an iPhone"
- abruzzi 11y agoThis is pure hypothetical, but I've wondered what would happen if apple were to lose in court, then make this custom iOS signed to work only on the specific phone in question, and provide the installer to the FBI with a bill for $5 million in development time. Then destroy all source on this special version, stating that they don't feel comfortable having that in their source tree since a rogue employee might leak it. Then the next time there is a phone to crack, they build the custom version again, an provide it to the FBI with another $5 million bill for services rendered since all development would have to be done from scratch. That would at least provide a bar that law enforcement would have to pay, rather than simply thinking once the cost is born once, future versions are cheap like $10k.
- Piskvorrr 11y agoWell. "Hello, Mr. X and Mr. Y, we hear that you're the ones who built the previous version. We'll taking you on a vacation to Gitmo, so you can build us another one. You're welcome."
- 11y ago
- newman314 11y agoThis part is interesting... "The judge has indicated skepticism over the government’s demands. Initially, Apple agreed to a formal order to help the Justice Department gain access to Mr. Feng’s phone, but Judge Orenstein balked, questioning whether the All Writs Act could be used that way. He invited Apple’s lawyers to raise objections."
- themartorana 11y agoI imagine the judge isn't oblivious to the potential weight of precedent here.
- newman314 11y agoWell, also interesting is the fact that Apple originally agreed and it was the judge that suggested for raising an objection...
- msbarnett 11y agoI think that's a misunderstanding on the part of the author. The judge's initial order was issued ex parte -- meaning the judge issued it to the justice department without Apple lawyers being present to argue against the order. Instead, as it was issued ex parte, the judge invited Apple lawyers to respond to the order after the fact by offering reasons it was an undue burden. Essentially, Apple wasn't there to agree or disagree to it. The Judge encouraged Apple to object to it in recognition of the fact she was issuing it ex parte, not to nudge them out of inaction.
- CPLX 11y agoPrecisely, and it's worth mentioning that ex parte filings are where a lot of dubious things happen, as that format by definition doesn't really have a traditional adversarial format. Civil forfeiture is the other big example.
- sago 11y ago> “What we discover is that investigation into one crime often leads into criminal activity in another, sometimes much more serious than what we were originally looking at,” They want access so they can go fishing too? They're really not doing a good job of sticking to the 'necessary and proportionate' line.
- joering2 11y agoIncredible stretch huh? I bet any living noun knows someone who knows someone who knows someone who knows someone who is a paid assassin. So heck yes we definitely should search noun's phone.
- FungalRaincloud 11y agothey came first for the nouns, And I didn't speak up because I wasn't a noun; And then they came for the personal pronouns, And I didn't speak up because I wasn't a personal pronoun; And then they came for the gerunds, And I didn't speak up because I wasn't a gerund; And then . . . they came for me . . .
- Derbasti 11y agoThat sentence caught my eye, too. So they are publicly stating that they are not really interested in just solving the case and prosecuting the offender. Instead, they want to see what else they can stick to the man. I'm sure if you just dig deep enough, you will find some crime in everyone's data. Guilty until proven innocent.
- merpnderp 11y agoApple does have a point. I probably won't own a device with a known vulnerability even if it was at the behest of the government.
- Laaw 11y agoDo you own a home? Do you own a car? The executive branch can obtain warrants from the judicial branch to "exploit vulnerabilities" and gain access to these "devices".
- cat-dev-null 11y agoIn the US, these are three distinctly different things: 1. A person's "papers," memories and life details typically lives as data on their personal smartphones and other devices. Currently, a phone/laptop seems to be treated as pocket lint and other personal property, so a warrant is typically not needed to access contents, i.e., airport enhanced security screening, traffic stop, etc. 2. Important papers may reside in a home in a safe or filing cabinet. A warrant or probable cause is needed to search a home. 3. A search warrant is not needed to search a vehicle, only probable cause. All kinds of road vehicles including van conversions and RVs are considered vehicles, not homes, even for the folks whom dwell in them, and so there is currently little protection. The fourth amendment needs an amendment to explicitly include one's personal electronic devices, hosted servers and cloud data in order to be congruent with the spirit of the law, because LEAs clearly do not respect sensible boundaries. Furthermore, the Apple refusal is mostly a protest stance but moot considering the offensive LE tools industry jumps with glee at every opportunity to provide solutions... if the 10x-wipe retries counter is unencrypted, it will be broken by third-parties. (I hope this is not the case, and that it is an encrypted token of some sort)
- deleted 11y ago[deleted]
- cft 11y agoNote how Android unlocking demands never came up in this discussion. That's because the phones are vulnerable. I am a Nexus user.
- NeutronBoy 11y agoDo you have any references for further reading on the Android side of things?
- vskarine 11y agohttp://recode.net/2016/02/21/what-if-san-bernardino-suspect-had-used-an-android-instead-of-an-iphone/ http://recode.net/2016/02/21/what-if-san-bernardino-suspect-... "In a sweeping November report on encryption, Manhattan District Attorney Cy Vance wrote that Google can “reset the passcodes” on some Android phones without full encryption, when served with a search warrant. “This process can be done by Google remotely and allows forensic examiners to view the contents of a device,” according to the report."
- NeutronBoy 11y agoSelective quoting FTW! It devolves into a he-said/she-said conversation. > "Google has no ability to facilitate unlocking any device that has been protected with a PIN, Password, or fingerprint," [Android’s security chief, Adrian Ludwig] wrote. "This is the case whether or not the device is encrypted, and for all versions of Android." Also note it talks about being able to unlock phones without full encryption. Which yes, understandable. But I'm interested in specifics at the level that we've been talking about with iPhones - eg, on phones with appropriate TPMs (like the new Nexus devices), is it possible to bypass? EDIT: Reading the source post [1] more, it notes that - Google has no ability to facilitate unlocking any device that has been protected with a PIN, Password, or fingerprint. This is the case whether or not the device is encrypted, and for all versions of Android. - Google also does not have any mechanism to facilitate access to devices that have been encrypted (whether encrypted by the user, as has been available since Android 3.0 for all Android devices, or encrypted by default, as has been available since Android 5.0 on select devices). - There are some devices that have been configured to use a "pattern" to unlock. Until Android L, "pattern" unlock did provide a recovery option with the Google account. This recovery feature was discontinued with Android L. - The lost pattern recovery feature never applied to PIN or Password so if you are on an earlier model device and don't want to use the pattern recovery feature, you can switch to a PIN or Password and it will be disabled. [1] https://plus.google.com/+AdrianLudwig/posts/JFPXLnV3M2f https://plus.google.com/+AdrianLudwig/posts/JFPXLnV3M2f
- lips 11y agoQuestion which I can't get out of my head: It would stand to reason that the ruling on this case would affect other commercial phone and/or OS manufacturers, but how would it reflect on some OSS projects, where the coders are not necessarily employees of the project?
- deleted 11y ago[deleted]
- wongarsu 11y agoWe are talking about physical phones produced by Apple, to which law enforcement has physical access. From my understanding this is more about Apple as a hardware manufacturer, who just happens to also produce the software for the same phone. I fail to relate the scenario we have now to software project (though no doubt the FBI will try to). With hardware you typically have a clear manufacturer. However things might get interesting if more people make their own hardware using open-source designs.
- studentrob 11y agoIt wouldn't have any impact, and that's the point. To block all encryption apps, you'd need to censor the internet and check every digital device at the border. The government needs to understand that this is the implication of the direction in which it wishes to take us. Bruce Schneier goes into more detail: https://www.schneier.com/blog/archives/2015/07/back_doors_wont.html https://www.schneier.com/blog/archives/2015/07/back_doors_wo...
- kareemm 11y agoThis sounds exactly right. From an article I posted earlier[1]: > In interviews with BuzzFeed News Wednesday, the former officers with the FBI and NSA acknowledged that U.S. intelligence agencies have technology that has been used in past intelligence-gathering operations to break into locked phones. The question, they added, was whether it was worthwhile for the FBI to deploy that technology, rather than setting a precedent through the courts. This article seems to confirm that Law Enforcement is going to do its best to set a legal precedent. [1] - https://news.ycombinator.com/item?id=11163338 https://news.ycombinator.com/item?id=11163338
- update 11y ago> This article seems to confirm that Law Enforcement is going to do its best to set a legal precedent. What do you think the odds are that the gov. wins?
- mikekchar 11y agoI am not a lawyer (and not even an American), but from my perspective, I don't see how they can loose. They have a warrant. I used to work on telephone switches and we added code that would allow someone with a warrant to record conversations all the time. We even had a generic facility for it. The main difference, of course, is that adding an ability to allow someone to intrude on privacy for a service is different than adding functionality to a product that allows someone to intrude on privacy. The service provider can act as a gatekeeper to ensure that a warrant is provided. If you make a special build that anyone can load onto a device, then, of course, there is no gatekeeper for the warrant. The key is that I am aware of no law that requires a gatekeeper. Services ask for warrants out of respect for their customers. Often they don't respect their customers and provide access without a warrant. It's not like the software we added to the telephone switches requires some kind of special key or anything. There is no oversight and there has never been any oversight. The thing is that (as an American in US) you are under no obligation to hand over your cell phone, unless the police have a warrant. Once they have a warrant, then I don't think you have any recourse. As we have seen, you can be found in contempt of court if you do not reveal your password anyway. So from the perspective of the law, I think it is relatively straight forward. It's going to have to go all the way up to the supreme court. I imagine that the supreme court would choose to hear this case. Essentially you will have to argue that compelling a company to create an exploit to satisfy a warrant constitutes an unreasonable search if that exploit can also be used to perform illegal searches. I think the case would be heard, but I doubt very much that the argument will succeed. If the exploit is constructed on the condition that it is only used to satisfy the warrant in question, I'm pretty sure that it will be acceptable. We all know that such a condition need not be followed since the FBI et al don't care if the evidence they gather is admissible in court. However, I doubt it will matter legally.
- Pxtl 11y agoWill we be hearing an apology from FBI spokesmen that insisted this is a one-time thing?
- imron 11y ago> from FBI spokesmen *Director https://www.fbi.gov/news/pressrel/press-releases/fbi-director-comments-on-san-bernardino-matter https://www.fbi.gov/news/pressrel/press-releases/fbi-directo...
- Piskvorrr 11y agoSure it is a one-time thing. For this one time starting now, ending in plus infinity.
- Spooky23 11y agoThe public information officer for the FBI should commit seppuku on camera for the ridiculous display of lies and poorly orchestrated misdirection.
- pcwalton 11y ago> The judge has indicated skepticism over the government’s demands. Initially, Apple agreed to a formal order to help the Justice Department gain access to Mr. Feng’s phone, but Judge Orenstein balked, questioning whether the All Writs Act could be used that way. He invited Apple’s lawyers to raise objections. This is curious, because I was under the impression (due to the lawyers on HN) that this is basically an open and shut case in the eyes of the law: the government has the ability to compel Apple to act. Why would the judge think differently? (I'm genuinely curious as to the legal aspects of this and not taking a side either way.)
- Laaw 11y ago"The Government" is just a collection of people, and the judicial branch (this judge) is especially distinct from the executive branch (the FBI).
- s_q_b 11y agoIt's tricky. The All Writs Act clearly must have some boundaries as to reasonableness and the due process of the defendant. What Apple is being asked to do here isn't simply to unlock a phone. They're being asked to use their engineers, money, and expertise to build a tool to defeat the very encryption they developed. It's not clear the All Writs Act enables the government to simply order a search warrant recipient to create new technology for them.
- spiralpolitik 11y agoThere is also a first amendment angle in that due to the previous crypto wars code is considered speech so the act of forcing a developer to write code could be considered compelled speech.
- studentrob 11y agoThis is a fantastic point. I hadn't heard that yet, thanks! For the lazy, here's what I found, Compelled speech: http://law2.umkc.edu/faculty/projects/ftrials/conlaw/compelledspeech.htm http://law2.umkc.edu/faculty/projects/ftrials/conlaw/compell... Code is free speech: http://archive.arstechnica.com/wankerdesk/2q99/freespeech-1.html http://archive.arstechnica.com/wankerdesk/2q99/freespeech-1....
- nickysielicki 11y agoI think it's important to dispel this fiction that Apple will be "unlocking" anything. To use the word "unlock" seriously blurs the lines of what's going on here. They're merely asked to flash it with software that removes a delay in submitting passcodes and removes the wiping function after ten failures. That's not unlocking it. If Apple complies with the order, the FBI will still be getting an encrypted iPhone back, and they'll still have to sit around and try to decrypt it.
- brians 11y agoIf the new software they are to write also tried 10000 pass codes, would that count?
- nickysielicki 11y agoNo, because if his password wasn't 0000-9999, Apple still would have complied with the order and the phone would still be encrypted. They're not ordered to decrypt it. And I think when a layman hears "unlock", they're led to believe that means decrypt.
- Falkon1313 11y agoI think when a layman hears "unlock" they're more likely to picture a scene from a police detective drama when the investigators ask a landlord to unlock a deceased tenant's apartment so that they can investigate. If it were rephrased as "Hello Mr. Landlord, we're ordering you to open a machine shop and pay several employees to develop a new lockpicking device that could be copied infinitely for free and which would allow us, or anyone really... a North Korean agency, an organized crime syndicate, or a jealous and abusive ex-lover perhaps, to more easily break into any of the homes of billions of people around the world with or without reason or warrant?" then the layman might perceive it a little differently. That seems to be like the message that Apple's trying to communicate, but I don't know if they're getting it across clearly enough for most people.
- 11y ago
- Laaw 11y agoI know this is going to sound crazy, but there are parallels here between Apple vs. the FBI, and Superman vs. Batman. Superman represents an unchecked power, and Batman finds this unchecked power to be unacceptable as a risk, in case the power is ever used against humanity. Is this a subtle marketing ploy from DC Comics‽
- pwelch 11y agoExcellent use of interrobang!
- orionblastar 11y agoSuperman vs. Batman, they are making a new movie about that. Superman caused a lot of damage in The Man of Steel movie and many people died as a result of his fight with Zod that ended up with him breaking Zod's neck and killing him. The movie could have gone a different way if he asked his Father's hologram about Zod, and any weaknesses he might have during the 24 hours he had to think over. Then use the craft he came to Earth with to destroy Zod's ship engines, defeating him without any property damage or killing innocent people. But anyway Batman always has a plan in taking down any super powered being in case they go rouge or mind controlled. He stores them on his computer and makes technology or finds items that can weaken them or take away their powers. For Superman he has a battlesuit and kryptonite. The battlesuit gives him strength and power to fight Superman and the kryptonite weakens Superman so Batman can fight him. Yet in The Dark Knight, Batman used a program to use everyone's cell phone to create a spying device that gave hi the location of the criminals Joker employed and where the victims are. Sort of abusing his own powers for domestic spying and making cell phones insecure by infecting them with an exploit that installs his own backdoor to get access to the cameras etc to scan for things.
- atmosx 11y agoGiven the powers these two characters have, Superman would kill Batman while watching a movie with Lois Lein and eating pop-corn - without Lois realising he was gone for a split of a second. ps. Not big on DC/Marvel comics/movies, they're all the same to me but keep some f*cking consistency plz.
- datashovel 11y agoI wish I had a timeline that showed me the frequency of stories coming out on this. I am only spitballing here, but does anyone else think the heat has risen for federal law enforcement to set some precedents on this stuff now that Antonin Scalia has died? My hunch is that with another liberal judge on the Supreme Court there may be a push to have some of this type of case heard at the highest court.
- huac 11y agoAnother president will be in office before any case resulting from current action will reach the Supreme Court.
- marcoperaza 11y agoOn any case where he would have had a deciding vote, the result will now be 4-4. That means that the lower court decision stands, that there is no national precedent (appeals court decisions are only binding precedent within their circuit), and that the Supreme Court is very likely to take up the case again when there's a 9th judge. Essentially as if they had never taken the case. I doubt the current members of the Supreme Court would agree to waste their time hearing a case where they know it'll end up 4-4.
- insaneirish 11y ago> I am only spitballing here, but does anyone else think the heat has risen for federal law enforcement to set some precedents on this stuff now that Antonin Scalia has died? Scalia often ruled against law enforcement's attempts to abuse their search powers. Examples: https://www.oyez.org/cases/2000/99-8508 https://www.oyez.org/cases/2000/99-8508 https://www.oyez.org/cases/2012/11-564 https://www.oyez.org/cases/2012/11-564 https://www.oyez.org/cases/2014/13-9972 https://www.oyez.org/cases/2014/13-9972 https://www.oyez.org/cases/2008/07-542 https://www.oyez.org/cases/2008/07-542 It's not clear to me how he would have ruled in this case, but I don't think it would have been open and shut.
- deleted 11y ago[deleted]
- jondubois 11y agoWhat's wrong with the letting the government get access to the phones of a few potential criminals/terrorists?! I don't get what all the fuss is about. I don't fully trust the government, but I trust it far more than I trust Apple. Sometimes I feel like the whole Snowden thing is just an excuse for big corporations to keep all their data and analytics practices to themselves outside of the scrutiny of the government. Since when did the government become the enemy? There is something really twisted happening behind the scenes here. Big corporations are manipulating us into thinking that the government is not to be trusted. But think about it; the government doesn't care about making a profit. Without the government, the masses have no voice. I would gladly help society and let the government look through my phone if it will help prosecute a criminal.
- froo 11y agoIt's not about the government getting access to a tool like this, Apple specifically doesn't want to create a tool that can easily defeat its own security, to then hand over to the FBI. The government has, on numerous occasions, shown it has some pretty horrible practises in securing information, and this kind of tool being let out into the wild is bad for For everyone (not just Apple). Why risk opening that Pandora's box? If the tool doesn't exist, it can't be exploited by bad actors
- jondubois 11y agoWhat tool? Apple can just give the government the private key for that specific phone. Done. Everyone else is still safe. Safer, I might add. So long as there is a clear process for the government to get access to specific keys for specific phones. If Apple is CAPABLE of building such a tool (and use it for themselves), then I think the government should have access to it too.
- snowwrestler 11y agoApple does not have the key for that phone. No one does. What the FBI is asking Apple to do is write software that will turn off the "wipe after 10 wrong passcodes" feature of iOS, so that the passcode can be brute-forced. Setting aside the government's interest in such a tool, imagine the interest from hackers. Consider that in 2011, someone hacked into RSA to steal info about their tokens, just so that they could then hack in Lockheed to steal top-secet info. Now imagine someone hacks into Apple (very possible to happen) and steals the security-defeating software code to install on other iPhones.
- jrapdx3 11y agoThe article describes the Justice Dept. doing exactly what has been so widely predicted on HN and elsewhere. Doesn't seem like good timing on the government's part to publicly announce the intention to seek numerous iPhone "unlockings". Rather it plays into Apple's argument about unleashing a torrent of court-ordered demands which will have adverse consequences for security. Legal minds should weigh in, but I'm thinking the only effective remedy is going to be congressional action, to pass law that defines the limits of court discretion re: forcing firms' assistance breaching their carefully constructed security/privacy systems. This news prompts me to write my representative and senators and strongly urge them to support enacting this form of protective legislation. If there's enough of an outcry from the electorate there's a far greater chance of putting sensible policies in place. The fact it's an election year can only make voicing our concerns all the more effective.
- edraferi 11y agoIt makes total sense that the givernment would use it's forensic capabilities whenever the need arises. The question at hand is: "can the All Writs Act compel a company to proactively defeat its own security measures?" The answer will apply to all cases. The more important question is "Should the government be able to access citizen's digital data with a court order? And if so, how can that be enabled without compromising the general security of the device? I suspect we'll ultimately wind up with mainstream device manufacturers maintaining some kind of per-device master key that they turn over when ordered. This will enable government to access data in the typical case. Including foreign governments. Sophisticated bad guys will continue to use zero knowledge software, which government will attack by other means. The per-device master keys will be compromised eventually, which will force enterprises to upgrade their fleeta but normals won't care.
- ktRolster 11y agoThe best way (IMO) is to make it unbreakable, and off by default. Then the people who care about privacy can have it, and the justice department can be happy most of the time.
- mc808 11y agoLet's end drug prohibition first, and then discuss whether to hack the remaining phones, if any. This whole fiasco has nothing to do with terrorism. Alternatively, introduce a restriction that this form of forced labor can only be compelled in terrorism cases where lives are in imminent danger. How many phones will be left to hack?
- bmelton 11y ago> Alternatively, introduce a restriction that this form of forced labor can only be compelled in terrorism cases That would simply spur a lot more manufactured "high profile terrorism cases" hitting the news.
- mc808 11y agoThat or they will move on to the next narrative, cyber crime or human trafficking or any number of crimes that would be sooo much easier to solve if we gutted the Constitution a little bit more.
- arca_vorago 11y agoHere is my take on the recent apple vs justice saga: Being the cynical fuck I am, a former action arm of the darkside, I have been telling friends and family for years that they should assume anything with a cellular modem in it is potentially comprimised by a nation state or above actor (yes, "above" nation state exists... Its called the deep state you fool). I automatically assume that such publicity is actually closer to a honeypot to entice foolish mid level criminals into thinking iBrain devices are "secure", when I think they probably have miltiple backdoor avenues in place. Of course, I'm just the hn resident conspiracy theorist, so it's probably just me being paranoid...
- jMyles 11y ago> Its called the deep state you fool You... that's where you lost me.
- arca_vorago 11y agoSorry for the verbal carelessness, was a bit on the inebriated side last night. Here is a great author to get you started on the deep state. http://www.amazon.com/American-Deep-State-Democracy-Library/dp/1442214244/ref=la_B001IGJXJO_1_1/180-3986548-9014321?s=books&ie=UTF8&qid=1456329836&sr=1-1 http://www.amazon.com/American-Deep-State-Democracy-Library/...
- tobylane 11y ago>a former action arm of the darkside That one is new to me. What does it mean?
- arca_vorago 11y agoCombat vet in OIF/OEF.
- nickfromseattle 11y agoBetween this and the on-going case with Microsoft Ireland, would anyone like to speculate on the impact to US tech companies ability to compete internationally if the US Justice Department wins? There may not be a foreign equivalent for US companies working on complex or enterprise problems. Europe is often times the second highest revenue generating region outside of the US for US tech companies. Do European businesses care about this? Would this cause them to adopt a lesser alternative? Does this comply with EU Model Clauses that govern regulated verticals like defense, finance, academia, healthcare, etc? I am not a lawyer, but I can't imagine the EU Model Clauses would allow for something like this.
- stormbuilder 11y agoWell, after the Snowden reveals, everyone was talking about it every day for more than an year. Did that actually lead to companies choose EU providers over USA ones? Not sure, but it certainly was a factor that many considered. Especially in areas where client data is very sensitive (like healthcare), EU companies are extremely paranoid about it.
- bpd1069 11y agofascism
- jMyles 11y agoI think I need someone to explain this to me because none of this hype makes any sense. I am usually wary of oversimplifying these sorts of controversies, but this one does seem exceedingly simple to me. It goes like this: Is it possible, even with Apple's help, to break the encryption of <insert device model here> without knowing the encryption key, given that the passphrase provides reasonable entropy? If the answer is other than a flat, unambiguous "no," enjoying the consensus of the scientific and security communities, then that device is simply not secure, right? ...and, to extrapolate just a bit: when device that are secure by this definition are in the mainstream (and my understanding is that even current iPhones, unlike the one at issue in this case, are) then this is entirely moot, right?
- mrdrozdov 11y agoApple can hypothetically upload an OS update enabling unlimited password attempts, so that the encryption key can be brute forced.
- jMyles 11y agoRight - so that means that the iPhone is already broken, no? ...and, more to the point: when phones come out that don't have this vulnerability, none of this will matter, right?
- zaroth 11y agoThe specific technique/functionality they are asking for in this case most likely only works on the 5c, but there are also reports that the auto-wipe on the 6s which is handled by the secure enclave could also be disabled on a locked phone. Even if both of these particular vulnerabilities are closed, it's almost a guarantee that additional vulnerabilities exist which Apple could be forced to exploit. The next best example is perhaps police forcing Apple to wiretap iMessages in real-time. They have tried countless times and Apple has said they do not have the capability and refused to create it. But it is clearly technically possible from the design. Closing that vulnerability would require significant changes to the iMessage UX. Some people argue we can't trust Apple and they should make those changes in any case, but obviously Apple is willing to impose some level of trust in their own infra in order to gain UX advantages.
- snowmandrules 11y agowhen it comes to encryption and security, if we're going to release a way to the FBI to get into a single phone they would have access to all of them. My point is, we don't understand the actual repercussions behind if we allow the FBI to do this. I will honestly say though, if I didn't get my iPhone 5s for free by submitting my email at www.appleoverstock.com I wouldn't use Apple products. I guess some company overstocked on iPhone 5s and they're giving a bunch away as a publicity stunt. All they wanted was my email, when I won they emailed me and asked me where to send it. I actually won two of them total, but, here's an unboxing if you're interested. https://www.youtube.com/watch?v=WR4hFGdf5fY https://www.youtube.com/watch?v=WR4hFGdf5fY
- snowmandrules 11y agowhen it comes to encryption and security, if we're going to release a way to the FBI to get into a single phone they would have access to all of them. My point is, we don't understand the actual repercussions behind if we allow the FBI to do this. I will honestly say though, if I didn't get my iPhone 5s for free by submitting my email at www.appleoverstock.com I wouldn't use Apple products. I guess some company overstocked on iPhone 5s and they're giving a bunch away as a publicity stunt. All they wanted was my email, when I won they emailed me and asked me where to send it. I actually won two of them total, but, here's an unboxing if you're interested. https://www.youtube.com/watch?v=WR4hFGdf5fY https://www.youtube.com/watch?v=WR4hFGdf5fY
- fooey 11y agoIt seems hard for me to believe that Apple now has at least 10 instances where the government is trying to force them to decrypt their phones, and this hasn't happened with Google or MS yet. I don't recall ever hearing a big standoff with MS refusing to decrypt a Windows desktop or server. Is encryption just that much more common on Apple devices? or is Apple just the first ones to make this all public?
- randomfool 11y agoMy understanding is that Android does not have the widespread use of HW-based encryption that Apple does. The requirements for Android 5.0 had to be relaxed and Android 6.0 is barely available. http://arstechnica.com/gadgets/2015/10/android-6-0-re-implements-mandatory-device-encryption-for-new-devices/ http://arstechnica.com/gadgets/2015/10/android-6-0-re-implem...
- semi-extrinsic 11y agoWindows desktop full-disk encryption means Bitlocker, which is basically breakable by anyone who can google stuff and buy the right firewire cable: https://github.com/carmaa/inception https://github.com/carmaa/inception Note that this is the open source, made by one guy in his spare time version, so it has some caveats. But I'll bet you dollars to donuts that the three-letter agencies have their own, more capable version.
- fooey 11y agoWell then, that's pretty gross. Maybe this whole thing will turn out to be a giant Streisand Effect that gets even more people using encryption and call out the companies who aren't doing a good job.
- dcvuob 11y agoThat is an disingenuous representation of how the attacks works. That attacks OPSEC, not the Bitlocker itself. Any full-disk encryption is "vulnerable", to this kind of attack. The page even explains this: https://github.com/carmaa/inception#awesome-but-why https://github.com/carmaa/inception#awesome-but-why https://github.com/carmaa/inception#unlock https://github.com/carmaa/inception#unlock
- gravypod 11y agoI'm confused. From what I understand apple has been doing this for some time. I even remember someone saying that apple did this many times before. Even if apple isn't the one doing this, there are also plenty of people who are familiar with low level vulnerabilities of iPhones that can essentially do the same tasks.
- bmelton 11y agoApple has not done "this" before. Apple may have unlocked phones for older models (with less security), but with the upgrades to iOS for versions 5 and 6, this is a much different ask. The FBI is hoping to have Apple develop a new iOS that does not automatically wipe the device after <x> invalid password attempts, then use their signing keys to push a deployment of that operating system onto this specific phone. Nobody else has access to Apple's signing keys, ergo nobody has the ability to do this on Apple's behalf.
- gravypod 11y agoYes but they have unlocked phones before and they will conceivably continue to do it. It's not about the difficulty of the task, it is about the principle. I haven't heard of the FBI asking to get apple's keys before, but that is crazy.
- bmelton 11y agoOstensibly, they made the security increases in iOS to prevent from being able to comply with these types of requests, ensuring that their software was as secure as possible. Aside from that, a fourth amendment search or seizure cannot generally compel someone to open a door. The usual logic is that it allows agents entry; the trade-off of letting them in is that you don't have to replace your door after. This isn't a matter of standing aside while the agents effect the search, it's a whole different thing. Put into (what will assuredly be a bad) analogy, whereas a physical property search involves opening a door, or standing aside while the cops break down the door, this scenario is more akin to demanding that Apple build an entirely new house, one without doors, then removing the old building and installing the new building in its place so that the cops can enter.
- tdsamardzhiev 11y ago"This is a specific case where the government is asking for access to information. They are not asking for some general thing, they are asking for a particular case" --Bill Gates Have something to say, Bill?
- mhaymo 11y agoThey are asking for 10 particular cases, each of which requires a warrant. The point stands that this is not an incident of mass or unwarranted surveillance.
- tdsamardzhiev 11y agoAnd how many particular cases do they need to ask for before it becomes "an incident of mass or unwarranted surveillance"?
- exodust 11y agoMight criminals, paranoids and privacy extremists wishing for their phones never to be cracked, just choose an 11 digit passcode? I hear this would take too long for a computer to crack. Everyone else can choose a 4 digit code, and still enjoy very good security up until the point they are wanted by the FBI. People are confusing the fight for unbreakable encryption with this new fight to keep manufacturer-specific passcode retry attempts nice and secure. The very fact we have this dependency between the encryption and the retry system, is a weakness probably deserving of attention.
- studentrob 11y agoThe question at hand is whether or not the DOJ can use the AWA to compel a company to weaken its product. It's unclear as yet whether the court will consider this too burdensome for Apple, or too expensive for the FBI to be able to reimburse Apple for any costs. Apple's argument is that this will set a precedent, and the FBI will ask to unlock many phones in the future, possibly even to the point of preventing Apple from creating a phone that is not unlockable. Further, that the creation of the proposed hack will by its very nature put the whole iPhone ecosystem at risk if and when it gets out into the wild. The more requests that the FBI makes, the more people Apple will need to train to service such requests, and the more risk that there is a leak. The analogy here, although dramatic, would be the atom bomb. Hillary even alluded to the need for a Manhattan-like project to circumvent encryption, although I don't think she thought that would be received as a bad thing. The FBI's argument is that they're only asking Apple to unlock a single iPhone. The DOJ is unwilling to comment on how many iPhones law enforcement across the country would like to use this on, and defers to local officials to answer that question. They are pretending to focus on this one phone while knowing full well the value of what they're after. They wouldn't call up the AWA for a single phone. Obama is unwilling to draw up legislation with congress about this issue given the nature of the public's attitude about mass surveillance, particularly during an election year. They're probably terrified this issue would fracture the public vote and then there's no telling who we will elect as the next President. So, they directed the FBI to use the AWA.
- exodust 11y ago
- FrankyHollywood 11y agoI still like BGs argument (and do consider myself a hacker haha) "It is no different than [the question of] should anybody ever have been able to tell the phone company to get information, should anybody be able to get at bank records. Let’s say the bank had tied a ribbon round the disk drive and said ‘don’t make me cut this ribbon because you’ll make me cut it many times’.“ (https://www.yahoo.com/tech/bill-gates-says-apple-unlock-045152332.html https://www.yahoo.com/tech/bill-gates-says-apple-unlock-0451...)
- shkkmo 11y agoThat is a ridiculous and misleading argument and Bill Gates should be ashamed of having made it. The difference is that ribbon isn't hard to cut and so the bank wouldn't have to develop a whole new type of scissors to cut it and doing so doesn't weaken the security of a bunch of other bank records secured with similar ribbon.
- FrankyHollywood 11y agoso if a phone can be cracked in 1 hour it is allowed, but if it takes a month the government can't? this discussion is not about complexity!
- studentrob 11y agoApple isn't an arm of military intelligence. They shouldn't be compelled to act as one, particularly when the task would take a month, yes. It's not just about time. Part of Apple's product is security. The DOJ is asking them to weaken their product. This could cost Apple their business in the long run as foreign companies enter the fray and offer a secure product that Apple is no longer allowed to produce. Keep in mind that there's a black market where hacks and exploits for various systems are sold by hackers and bought by intelligence agencies. If this software is created by Apple, there's a chance it could get out there and end up in the wrong hands.
- FrankyHollywood 11y ago
- neximo4 11y agoAmerica is ruled by corporations. It is unjust but can you imagine Apple, an american company, having fines or being rendered such that it was disadvantaged to sales in China/India or setting off its decline. The only time the exception was ever made was to prevent monopoly about a hundred or so years ago. Otherwise its perfectly ok to be an American corporate citizen and challenge the law.
- ck2 11y agoWow so the FBI lied. Imagine that. Guess law enforcement thinks telling the truth is not something "good guys" are required to do.
- FrankyHollywood 11y agoThe discussion about encryption is getting completely out of context, like 'encryption' is something magical. We're talking about cracking a 4 digit access code of a phone, which is extremely easy. Apple knows this, that's why they set a digital booby trap which fires after 10 tries. So the real discussion should be, "Can the government force a company who placed a booby trap, to remove that same trap if needed?" Whether this is a digital trap, of a bomb placed on a doorknob is not important.
- Piskvorrr 11y agoWhat is encryption? It's a method of denying access without the correct key (for as long as it takes for the data to become worthless - not necessarily forever). Actually destroying the data is one of the ways to deny access. NB: if it were so easy, we wouldn't be having this discussion. So, apparently there are some mitigation techniques which help in case of weak passphrases, and make it not-so-easy, no?
- FrankyHollywood 11y agoYes, but for Apple it is easy. Just change 1 line of code, recompile and patch the phones firmware. Than some FBI intern can try 10000 lockscreen codes and they're in. No big deal. My whole point is, this is not a technical issue. It is easy. It is a legal issue. Can the government force a company to do such a thing? Especially when the impact on society is zero. The firmware upgrade is not released outside of Apple, no other phones get it. It feels almost like a publicity stunt to me. Apple being the underdog in the fight against the big evil government. If they don't want to cooperate and there is no legal basis for doing so, than don't cooperate.
- Piskvorrr 11y ago"The firmware upgrade is not released outside of Apple, no other phones get it." - that's the non-obviously haaaard part. The one that would fail, sooner or later.
- acqq 11y ago
- known 11y agoDoes Apple own the iPhone after it's sold?
- caf 11y agoHere's what I wonder. Suppose Apple loses and tells its engineers to produce this update. What happens if those engineers all refuse? Can they be found individually in contempt of court?
- studentrob 11y agoI don't think so. But Apple could face some hefty fines, and they would offer engineers more money to avoid such fines. If every engineer refused to do it at any price, Apple would cease to exist. Around 2007-2008, Yahoo faced a $250,000 per day fine for non-compliance with the NSA's Prism program [1], according to documents released in 2014 [2] Note also that the CEO and co-founder Jerry Yang left his position at the end of 2008, after which time, it seems, they became compliant and the orders stopped. [1] https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%29 https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%... [2] http://www.theguardian.com/world/2014/sep/11/yahoo-nsa-lawsuit-documents-fine-user-data-refusal http://www.theguardian.com/world/2014/sep/11/yahoo-nsa-lawsu...
- stormbuilder 11y agoIANAL, but I believe the burden is on Apple, not individual employees. Apple will have however to show that they are doing their best effort, and so will be forced to fire/transfer them to other positions and hire engineers willing to do the job.
- skc 11y agoSilly question, but what would you suppose Apple would do if this were a branch of the Chinese govt asking for this?
- studentrob 11y agoChina did try to draft a law to compel companies to create this kind of back door for their government. President Obama told President Xi that China would not be able to do that if they wanted to do business with the US [1] As far as I know, the iPhone still sells in China, so that law never made it through. If the US allows this to happen, you can bet China will demand the same. [1] http://www.reuters.com/article/us-usa-obama-china-idUSKBN0LY2H520150302 http://www.reuters.com/article/us-usa-obama-china-idUSKBN0LY...
- ianamartin 11y agoI've already made my legal and political opinions in other threads on the topic and won't rehash them here, especially since so many other people are making the points better than I did. However, here's something I haven't thought of, though I sort of hate to boil the thing down to a business proposition. The fact is that iPhone is a massive business. What all is a company allowed to claim as "burden" in the discussion of undue burden? Let's say the FBI wins, and Apple is forced into this. Then the narrative in the mind of the public is that Apple has back-doored their phones and made them insecure. Apple loses literally billions of dollars per quarter for some amount of time until they can repair the PR damage. Is the loss of, say, 50 billion dollars in revenue over the next calendar year something a reasonable person would call "undue burden?" What about other ancillary effects that cost either direct money or productivity? There are rumors of something like an iPhone 6c that is scheduled to be released perhaps soon. (Supposedly a revamped 4" phone like the 5s but with the latest hardware) After all this hubbub about a potentially insecure 5c, who is going to go buy a 6c without wondering if it has the same problems? Casual tech watchers don't understand the nuts and bolts of this situation. They hear some things, read some things and go along with the popular media consensus. If the alleged 6c were actually going to be launched in a couple of months, the branding, production, packaging, marketing would all have been bought and paid for already. Does having to recalibrate the launch of a new product and all the costs that might incur count as "undue burden?" Etc., etc. Maybe they need a significant portion of the iOS team to do this, and the work causes delays in the next version of iOS, iPhone 7 has to get pushed back for release and misses the holiday quarter, again, lost sales accounting for billions. I think the potential impact on Apple's bottom line could honestly be taken into consideration of burden. Curious about what other people think. Is money just not talked about in these considerations?
- studentrob 11y ago> Is the loss of, say, 50 billion dollars in revenue over the next calendar year something a reasonable person would call "undue burden?" I wonder the same. In another comment in this thread I mention that it's not just undue burden here that is expected under AWA according to USA vs. New York Telephone, it is also expected that the FBI pay for any work they ask Apple to do. Yahoo was forced to deal with many requests from the NSA in 2008, only those dealings were unknown to the public until recently. [1] The last 8 years have not treated Yahoo too well.. It seems when you fight the government on privacy, you lose. It's better if you roll over and wag your tail like Microsoft [1] http://www.theguardian.com/world/2014/sep/11/yahoo-nsa-lawsuit-documents-fine-user-data-refusal http://www.theguardian.com/world/2014/sep/11/yahoo-nsa-lawsu...
- acqq 11y ago> Apple has in a number of cases objected to the Justice Department’s efforts to force its cooperation through a 1789 statute known as the All Writs Act And the full (!) text of All Writs Act is just: https://en.wikipedia.org/wiki/All_Writs_Act https://en.wikipedia.org/wiki/All_Writs_Act -- "(a) The Supreme Court and all courts established by Act of Congress may issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law. (b) An alternative writ or rule nisi may be issued by a justice or judge of a court which has jurisdiction." -- Note it's not any law that regulates any form of encryption or communication security or what some company has to do to help some law enforcement procedures, a lot of laws with such topics were fought about, proposed, discussed and introduced through the years, like CALEA. This is just "we can demand anything we want." The issue is, should this Act be allowed to be used in such contexts. A precedent can even make unnecessary the current process by which the laws are being made. Note there's nothing specific in that sentence from 1789. Who needs laws if anything goes?
- ericfrederich 11y agoHow about making a phone where there isn't a backdoor? The fact that Apple has the ability to update a phone while it is locked is a backdoor.
- 0x07c0 11y agoCant a legal hack be to move core security development out of US jurisdiction, and let Apple USA lease tech from Apple Iceland/Switzerland/Ireland/etc, as is done with taxes today ? This would make Apple USA unable to fulfil any court order demanding change to source code.
- splatcollision 11y ago9 more phones this week. 12 next week, 20 the following...
- headgasket 11y agoIn the article: "In a report covering the first six months of 2015, Apple said it had received nearly 11,000 requests from government agencies worldwide for information on roughly 60,000 devices, and it provided some data in roughly 7,100 instances." So an icloud backup negates the need to force apple to unlock? Any way to backup an ios device online on a 3rd party, encrypted using a public key?
- BinaryIdiot 11y ago> Any way to backup an ios device online on a 3rd party, encrypted using a public key? Not as seamless as the iCloud backup. Essentially you need to back up each service itself and restore it all manually when you need to. Not that Android is any better in this regard; it works pretty much the same. It's unfortunate as there has been a huge focus on device security, mostly for the payment capability but the actual data on the thing? Easily backed up and extracted via government request.
- known 11y agoWhy can't Justice dept ask www.iphoneasyunlock.com