5 ms·

I am not a lawyer (and not even an American), but from my perspective, I don't see how they can loose. They have a warrant. I used to work on telephone switch

I am not a lawyer (and not even an American), but from my perspective, I don't see how they can loose. They have a warrant. I used to work on telephone switches and we added code that would allow someone with a warrant to record conversations all the time. We even had a generic facility for it. The main difference, of course, is that adding an ability to allow someone to intrude on privacy for a service is different than adding functionality to a product that allows someone to intrude on privacy. The service provider can act as a gatekeeper to ensure that a warrant is provided. If you make a special build that anyone can load onto a device, then, of course, there is no gatekeeper for the warrant. The key is that I am aware of no law that requires a gatekeeper. Services ask for warrants out of respect for their customers. Often they don't respect their customers and provide access without a warrant. It's not like the software we added to the telephone switches requires some kind of special key or anything. There is no oversight and there has never been any oversight. The thing is that (as an American in US) you are under no obligation to hand over your cell phone, unless the police have a warrant. Once they have a warrant, then I don't think you have any recourse. As we have seen, you can be found in contempt of court if you do not reveal your password anyway. So from the perspective of the law, I think it is relatively straight forward. It's going to have to go all the way up to the supreme court. I imagine that the supreme court would choose to hear this case. Essentially you will have to argue that compelling a company to create an exploit to satisfy a warrant constitutes an unreasonable search if that exploit can also be used to perform illegal searches. I think the case would be heard, but I doubt very much that the argument will succeed. If the exploit is constructed on the condition that it is only used to satisfy the warrant in question, I'm pretty sure that it will be acceptable. We all know that such a condition need not be followed since the FBI et al don't care if the evidence they gather is admissible in court. However, I doubt it will matter legally.

ubernostrum 11y ago
The legal question here is really whether the All Writs Act can be used to compel development of new products with specific features law enforcement desires, because that's what it boils down to: they want a custom iOS build with custom security-bypass features that can be loaded onto any phone they want to snoop into. And when framed like that -- government ordering a private company, without negotiation or contract or even agreed-upon -in-advance compensation, to develop a product -- I don't think there's a chance in hell of it standing up. The question is whether the court that ends up hearing the final appeal will frame it like that.
- vectorjohn 11y ago
  How is it different than getting a phone company to install a wire tap? What you describe is not what's being asked for. What the FBI wants is a tool to get into this phone. They will definitely want to get into more phones in the future, but that's not the same as a single tool that gets into any phone. It can be a new one every time. If it wasn't possible to make such a tool, I'd be a lot more outraged. But it is. Tell me why that can't be done.
  - ubernostrum 11y ago
    The difference is that tools and equipment for wiretaps already exist. Tools that bypass the security features of more recent versions of iOS don't. Hence the FBI's desired insecureOS would be a new product, developed under compulsion from the FBI and the courts.
  - zaroth 11y ago
    The difference is simply that telecommunications are heavily regulated (see CALEA) where if you want to be a service provider you have to provide wiretap functionality. Personal computers in general are not covered by any such regulation. It is legal to create and use encryption on your own device without building in a government backdoor. For now.
    - teacup50 11y ago
      Ironically, the biggest threat to an unregulated computer future is the massive centralization of device control via platform DRM, in the hands of just a few companies like Apple. CALEA was extended to ISPs once the industry coalesced into a much smaller number of central players.
caf 11y ago
I don't think the question turns on unreasonable searches. Apple isn't being searched here. Instead, the question is whether the All Writs Act grants sufficient power to compel a company, third-party to the action, to build a tool for breaking into its product. This is different to your telephone interception example, because that interception is authorised by a specific statute, not using a general writ issued under the All Writs Act. The argument here is executive overreach - that they should be asking the legislature to pass a law specifically to require this kind of assistance, rather than using the All Writs Act.
swyman 11y ago
> Essentially you will have to argue that compelling a company to create an exploit to satisfy a warrant constitutes an unreasonable search if that exploit can also be used to perform illegal searches. From the majority opinion in another All Writs case that made it to the Supreme Court[1]: "[The lower court] was apparently concerned that sustaining the District Court's order would authorize courts to compel third parties to render assistance without limitation regardless of the burden involved and pose a severe threat to the autonomy of third parties who for whatever reason prefer not to render such assistance. Consequently the Court of Appeals concluded that courts should not embark upon such a course without specific legislative authorization. We agree that the power of federal courts to impose duties upon third parties is not without limits; unreasonable burdens may not be imposed." [1] https://www.law.cornell.edu/supremecourt/text/434/159 https://www.law.cornell.edu/supremecourt/text/434/159
- studentrob 11y ago
  Key point: unreasonable burdens may not be imposed The order also said: "The order provided that the Company be fully reimbursed at prevailing rates, and compliance with it required minimal effort on the part of the Company and no disruption to its operations" So the FBI could be expected to reimburse Apple for weakening its product and future earnings. More details on that specific case as it relates to Apple vs. FBI are available from a post by a computer crime law professor [1] [1] https://www.washingtonpost.com/news/volokh-conspiracy/wp/2016/02/19/preliminary-thoughts-on-the-apple-iphone-order-in-the-san-bernardino-case-part-2-the-all-writs-act/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...
vectorjohn 11y ago
The thing is, Apple made a phone with a backdoor. It has a backdoor already. Unlocked by apples software signing keys. If Apple wants to continue to do that, but wants to mostly respect their customers' privacy, they need to create a facility to unlock it selectively upon seeing a warrant. It really isn't that hard to do, since they can make firmware updates that only work on specific devices. It can and probably will be argues that this is exactly like wire tapping, where it is up to the telecom to actually demand a warrant before giving the gov access. It would be neat if the supreme Court would say this is unconstitutional on some ground, because that would seem to apply to other forms of wiretapping. They aren't fundamentally different. I'm sure the first time the gov asked a company to help them install wire taps, it seemed like a big deal. I think some people are being intellectually dishonest when they say a backdoor can't be created without sacrificing security for everyone else. It can be done such that your privacy on an iPhone is just as good after a backdoor is created as it was before. Which is to say, not perfect because Apple had the key either way. If you want real security use a good passcode and keep it in your head.
- URSpider94 11y ago
  You misunderstand. Apple can't unlock the phone with the signing keys, all they can do is make it easier to brute-force the passcode. If this person had used a long passphrase instead of a 4-digit code, even this software hack wouldn't help.
rsingel 11y ago
It is not settled law in the U.S. whether being forced to handover a password is "contempt of court" or actually self-incrimination protected by the Fifth Amendment. Wiretaps ordered into the U.S. phone and internet networks via CALEA and FCC rulings, which basically meant that all network and phone switches internationally would have the back door. (See what happened to Greek politicians thanks to that). But the phone portion of those rules came from a very deliberate act of Congress. (Don't get me started on CALEA and the Internet...) The All Writs act is vague as hell. And there are definitely laws that require legal process; your telephone records, for one. That's why the Congress passed a law retroactively immunizing AT&T, Verizon, et. al. for helping the NSA collect communications data on American citizens in plain violation of communication privacy laws. In this case, NOTHING is straightforward. Apple could win on First Amendment grounds; the assistance asked for could be determined to be too burdensome. The Fourth Amendment may not even be an issue. I'm not even sure this will go to the Supreme Court. If the feds lose, they may well choose NOT to appeal on purpose so they can continue browbeating companies with All Writs act in other jurisdictions and under seal.
- notlisted 11y ago
  What seems to be settled though is that people can be ordered to unlock their phones with a fingerprint… despite possible self-incrimination: http://www.dailydot.com/politics/virginia-fingerprint-key-disclosure-law-apple/ http://www.dailydot.com/politics/virginia-fingerprint-key-di...
  - rsingel 11y ago
    That's still not "settled." That's one state court ruling. Other states could rule differently. A federal court in that district could rule differently. That said, if your threat model involves anyone technically sophisticated or any government actor, I would suggest not relying solely on a fingerprint ID to control access to a device.

ubernostrum 11y ago

The legal question here is really whether the All Writs Act can be used to compel development of new products with specific features law enforcement desires, because that's what it boils down to: they want a custom iOS build with custom security-bypass features that can be loaded onto any phone they want to snoop into. And when framed like that -- government ordering a private company, without negotiation or contract or even agreed-upon -in-advance compensation, to develop a product -- I don't think there's a chance in hell of it standing up. The question is whether the court that ends up hearing the final appeal will frame it like that.

vectorjohn 11y ago
How is it different than getting a phone company to install a wire tap? What you describe is not what's being asked for. What the FBI wants is a tool to get into this phone. They will definitely want to get into more phones in the future, but that's not the same as a single tool that gets into any phone. It can be a new one every time. If it wasn't possible to make such a tool, I'd be a lot more outraged. But it is. Tell me why that can't be done.
- ubernostrum 11y ago
  The difference is that tools and equipment for wiretaps already exist. Tools that bypass the security features of more recent versions of iOS don't. Hence the FBI's desired insecureOS would be a new product, developed under compulsion from the FBI and the courts.
- zaroth 11y ago
  The difference is simply that telecommunications are heavily regulated (see CALEA) where if you want to be a service provider you have to provide wiretap functionality. Personal computers in general are not covered by any such regulation. It is legal to create and use encryption on your own device without building in a government backdoor. For now.
  - teacup50 11y ago
    Ironically, the biggest threat to an unregulated computer future is the massive centralization of device control via platform DRM, in the hands of just a few companies like Apple. CALEA was extended to ISPs once the industry coalesced into a much smaller number of central players.

caf 11y ago

I don't think the question turns on unreasonable searches. Apple isn't being searched here. Instead, the question is whether the All Writs Act grants sufficient power to compel a company, third-party to the action, to build a tool for breaking into its product. This is different to your telephone interception example, because that interception is authorised by a specific statute, not using a general writ issued under the All Writs Act. The argument here is executive overreach - that they should be asking the legislature to pass a law specifically to require this kind of assistance, rather than using the All Writs Act.

swyman 11y ago

> Essentially you will have to argue that compelling a company to create an exploit to satisfy a warrant constitutes an unreasonable search if that exploit can also be used to perform illegal searches. From the majority opinion in another All Writs case that made it to the Supreme Court[1]: "[The lower court] was apparently concerned that sustaining the District Court's order would authorize courts to compel third parties to render assistance without limitation regardless of the burden involved and pose a severe threat to the autonomy of third parties who for whatever reason prefer not to render such assistance. Consequently the Court of Appeals concluded that courts should not embark upon such a course without specific legislative authorization. We agree that the power of federal courts to impose duties upon third parties is not without limits; unreasonable burdens may not be imposed." [1] https://www.law.cornell.edu/supremecourt/text/434/159 https://www.law.cornell.edu/supremecourt/text/434/159

studentrob 11y ago
Key point: unreasonable burdens may not be imposed The order also said: "The order provided that the Company be fully reimbursed at prevailing rates, and compliance with it required minimal effort on the part of the Company and no disruption to its operations" So the FBI could be expected to reimburse Apple for weakening its product and future earnings. More details on that specific case as it relates to Apple vs. FBI are available from a post by a computer crime law professor [1] [1] https://www.washingtonpost.com/news/volokh-conspiracy/wp/2016/02/19/preliminary-thoughts-on-the-apple-iphone-order-in-the-san-bernardino-case-part-2-the-all-writs-act/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

vectorjohn 11y ago

The thing is, Apple made a phone with a backdoor. It has a backdoor already. Unlocked by apples software signing keys. If Apple wants to continue to do that, but wants to mostly respect their customers' privacy, they need to create a facility to unlock it selectively upon seeing a warrant. It really isn't that hard to do, since they can make firmware updates that only work on specific devices. It can and probably will be argues that this is exactly like wire tapping, where it is up to the telecom to actually demand a warrant before giving the gov access. It would be neat if the supreme Court would say this is unconstitutional on some ground, because that would seem to apply to other forms of wiretapping. They aren't fundamentally different. I'm sure the first time the gov asked a company to help them install wire taps, it seemed like a big deal. I think some people are being intellectually dishonest when they say a backdoor can't be created without sacrificing security for everyone else. It can be done such that your privacy on an iPhone is just as good after a backdoor is created as it was before. Which is to say, not perfect because Apple had the key either way. If you want real security use a good passcode and keep it in your head.

URSpider94 11y ago
You misunderstand. Apple can't unlock the phone with the signing keys, all they can do is make it easier to brute-force the passcode. If this person had used a long passphrase instead of a 4-digit code, even this software hack wouldn't help.

rsingel 11y ago

It is not settled law in the U.S. whether being forced to handover a password is "contempt of court" or actually self-incrimination protected by the Fifth Amendment. Wiretaps ordered into the U.S. phone and internet networks via CALEA and FCC rulings, which basically meant that all network and phone switches internationally would have the back door. (See what happened to Greek politicians thanks to that). But the phone portion of those rules came from a very deliberate act of Congress. (Don't get me started on CALEA and the Internet...) The All Writs act is vague as hell. And there are definitely laws that require legal process; your telephone records, for one. That's why the Congress passed a law retroactively immunizing AT&T, Verizon, et. al. for helping the NSA collect communications data on American citizens in plain violation of communication privacy laws. In this case, NOTHING is straightforward. Apple could win on First Amendment grounds; the assistance asked for could be determined to be too burdensome. The Fourth Amendment may not even be an issue. I'm not even sure this will go to the Supreme Court. If the feds lose, they may well choose NOT to appeal on purpose so they can continue browbeating companies with All Writs act in other jurisdictions and under seal.

notlisted 11y ago
What seems to be settled though is that people can be ordered to unlock their phones with a fingerprint… despite possible self-incrimination: http://www.dailydot.com/politics/virginia-fingerprint-key-disclosure-law-apple/ http://www.dailydot.com/politics/virginia-fingerprint-key-di...
- rsingel 11y ago
  That's still not "settled." That's one state court ruling. Other states could rule differently. A federal court in that district could rule differently. That said, if your threat model involves anyone technically sophisticated or any government actor, I would suggest not relying solely on a fingerprint ID to control access to a device.