4 ms·

When has Apple complied with a warrant that sought to compel a digital signature?

timr 11y ago
They're not being asked to provide "a digital signature". They're being asked to enable a brute-force attack on a single phone. Here's the full text of the request: http://www.ndaa.org/pdf/SB-Shooter-Order-Compelling-Apple-Asst-iPhone.pdf http://www.ndaa.org/pdf/SB-Shooter-Order-Compelling-Apple-As... Order #2 is the relevant order. But to answer your question, they've complied with similar warrants on at least 70 cases in the past: http://www.npr.org/2016/02/22/467602161/the-seeds-of-apples-standoff-with-doj-may-have-been-sown-in-brooklyn http://www.npr.org/2016/02/22/467602161/the-seeds-of-apples-... The only difference in this case is whether or not the FBI can compel Apple to make and install a custom build of iOS to crack the phone.
- mikeash 11y ago
  "Make and install a custom build" means compelling a digital signature, since the custom OS build must be signed before the device will accept it.
  - timr 11y ago
    That's a distinction without a difference. Presumably Apple has done signed custom installs on the ~70 other iPhones they've brute-forced under warrant, because signed firmware has existed on iOS since (IIRC) the iPhone 3G. In any case, the legal question has nothing to do with encryption. It's an incidental detail.
    - mikeash 11y ago
      Those 70 other cases didn't involve installing a custom OS. They were running older OSes that did not do as good a job protecting the user's data, and thus could be attacked without any changes to the OS. The whole reason this thing has blown up now is because Apple finally improved their security to the point where the old attacks no longer work.
      - timr 11y ago
        You are wrong. Apple cracked the other phones by installing software that brute-forced the password. They didn't have someone sit there and punch in 10,000 codes like a monkey. Moreover, Apple won't comply with valid warrants for phones running iOS7, so it doesn't really have anything to do with the security of the OS. This started only because a federal judge made an issue of the legal justification for the first time ever: http://arstechnica.com/tech-policy/2015/10/feds-since-apple-can-unlock-iphone-5s-running-ios-7-it-should/ http://arstechnica.com/tech-policy/2015/10/feds-since-apple-...
        facetube 11y ago
        Again, do you have any evidence whatsoever for your claim that a piece of brute-forcing software written by Apple already exists?
        timr 11y ago
        How about the fact that these tools have existed in the public domain for every version prior to iOS8, plus the fact that Apple could do this in Apple stores for customers, plus basic common sense? http://www.ibtimes.co.uk/translock-utility-ios-can-brute-force-passcode-jailbroken-iphone-1493296 http://www.ibtimes.co.uk/translock-utility-ios-can-brute-for... But OK, if you insist...here's "evidence" straight from the EFF: "For older phones with no encryption, Apple already had a software version to bypass the unlock screen (used, for example, in Apple stores to unlock phones when customers had forgotten their passcode)." https://www.eff.org/deeplinks/2016/02/technical-perspective-apple-iphone-case https://www.eff.org/deeplinks/2016/02/technical-perspective-... And before you go there: whether or not you call this "brute forcing" is, again, a distinction without a difference. The FBI wants access to a single, password-protected phone, under warrant, and Apple has historically maintained custom software that helped them comply with these exact requests. Nobody knowledgable about this case cares that the software has to iterate through 10,000 numbers, or uses some other method to gain entry. They just want the outcome.
        facetube 11y ago
    - facetube 11y ago
      Presumably, or backed up with a reliable source? I've not seen any credible claim or piece of evidence that Apple has signed custom binaries for law enforcement.

timr 11y ago

They're not being asked to provide "a digital signature". They're being asked to enable a brute-force attack on a single phone. Here's the full text of the request: http://www.ndaa.org/pdf/SB-Shooter-Order-Compelling-Apple-Asst-iPhone.pdf http://www.ndaa.org/pdf/SB-Shooter-Order-Compelling-Apple-As... Order #2 is the relevant order. But to answer your question, they've complied with similar warrants on at least 70 cases in the past: http://www.npr.org/2016/02/22/467602161/the-seeds-of-apples-standoff-with-doj-may-have-been-sown-in-brooklyn http://www.npr.org/2016/02/22/467602161/the-seeds-of-apples-... The only difference in this case is whether or not the FBI can compel Apple to make and install a custom build of iOS to crack the phone.

mikeash 11y ago
"Make and install a custom build" means compelling a digital signature, since the custom OS build must be signed before the device will accept it.
- timr 11y ago
  That's a distinction without a difference. Presumably Apple has done signed custom installs on the ~70 other iPhones they've brute-forced under warrant, because signed firmware has existed on iOS since (IIRC) the iPhone 3G. In any case, the legal question has nothing to do with encryption. It's an incidental detail.
  - mikeash 11y ago
    Those 70 other cases didn't involve installing a custom OS. They were running older OSes that did not do as good a job protecting the user's data, and thus could be attacked without any changes to the OS. The whole reason this thing has blown up now is because Apple finally improved their security to the point where the old attacks no longer work.
    - timr 11y ago
      You are wrong. Apple cracked the other phones by installing software that brute-forced the password. They didn't have someone sit there and punch in 10,000 codes like a monkey. Moreover, Apple won't comply with valid warrants for phones running iOS7, so it doesn't really have anything to do with the security of the OS. This started only because a federal judge made an issue of the legal justification for the first time ever: http://arstechnica.com/tech-policy/2015/10/feds-since-apple-can-unlock-iphone-5s-running-ios-7-it-should/ http://arstechnica.com/tech-policy/2015/10/feds-since-apple-...
      - facetube 11y ago
        Again, do you have any evidence whatsoever for your claim that a piece of brute-forcing software written by Apple already exists?
        timr 11y ago
        How about the fact that these tools have existed in the public domain for every version prior to iOS8, plus the fact that Apple could do this in Apple stores for customers, plus basic common sense? http://www.ibtimes.co.uk/translock-utility-ios-can-brute-force-passcode-jailbroken-iphone-1493296 http://www.ibtimes.co.uk/translock-utility-ios-can-brute-for... But OK, if you insist...here's "evidence" straight from the EFF: "For older phones with no encryption, Apple already had a software version to bypass the unlock screen (used, for example, in Apple stores to unlock phones when customers had forgotten their passcode)." https://www.eff.org/deeplinks/2016/02/technical-perspective-apple-iphone-case https://www.eff.org/deeplinks/2016/02/technical-perspective-... And before you go there: whether or not you call this "brute forcing" is, again, a distinction without a difference. The FBI wants access to a single, password-protected phone, under warrant, and Apple has historically maintained custom software that helped them comply with these exact requests. Nobody knowledgable about this case cares that the software has to iterate through 10,000 numbers, or uses some other method to gain entry. They just want the outcome.
        facetube 11y ago
  - facetube 11y ago
    Presumably, or backed up with a reliable source? I've not seen any credible claim or piece of evidence that Apple has signed custom binaries for law enforcement.