13 ms·
FBI argues it can force Apple to turn over iPhone source code
- Piskvorrr 11y agoSure. Can it force Apple to sign a compiled binary?
- jpgvm 11y agoIf the FBI is to be believed they can compell anyone to do anything. That is effectively the scope of the All Writs Act.
- Piskvorrr 11y agoWhich means a police state, by definition. (Which is not "jack-booted thugs," but rather "agencies of the state are above the law"). That is the actual reason for trying to establish "All Writs Act applies to anything we want, and allows us to do anything we want." This will be the actual issue for the courts (and ultimately SCOTUS) to decide, the specific device is just a pretext. Hopefully the judicial branch will recognize how this can essentially cut off both itself and the legislative branch from any real control.
- woodman 11y ago> ...hopefully the judicial branch will recognize... Not a lot of hope on that front, as they've already demonstrated a willingness to abandon their duties: administrative subpoenas, tens of thousands, issued by federal law enforcement agencies - not courts.
- Piskvorrr 11y agoI see "we'll routinely approve almost anything" as significantly different from "meh, do whatever you please; just stop bothering us already".
- woodman 11y agoYou are aware that administrative subpoenas don't need approval right? For example: the FBI takes an interest in me and sends a subpoena to my ISP requesting all opened email older than 180 days. No judge involved. Now one could argue that there is still judicial oversight, it simply occurs after the fact... But like I said, tens of thousands of such subpoenas go out every year - it is pretty unrealistic to think that any serious oversight is occurring. So it is much closer to "meh, do whatever you please..." but more accurately it would be: Executive branch: "Yeehaa! Get outta mah way checks and balances, we got bad guys to string up and no time for robe wearing slowpokes!" Legislative branch: "Sounds like a great idea, white hats can do no wrong." Judicial branch: "...blank stare...shrug".
- coreyp_1 11y agoThat is an interesting question. "signing a binary" is a form of endorsement. If code == speech, as Apple is arguing, then compelling the endorsement of code is, quite literally, compelled speech, which may fall afoul of the 1st Amendment.
- facetube 11y agoApple made this specific argument in their motion to vacate. IMO it's a powerful one, because the potential implications for certificate authorities seem quite staggering.
- Zizzle 11y agoDick Clarke has been saying the same. > Clarke explained that the FBI was trying to get the courts to essentially compel speech from Apple with the All Writs Act. "This is a case where the federal government using a 1789 law trying to compel speech. What the FBI is trying to do is make code-writers at Apple, to make them write code that they do not want to write that will make their systems less secure," he said. "Compelling them to write code. And the courts have ruled in the past that computer code is speech." http://arstechnica.com/tech-policy/2016/03/former-cyber-czar-says-nsa-could-crack-the-san-bernadino-shooters-phone/ http://arstechnica.com/tech-policy/2016/03/former-cyber-czar...
- ctdonath 11y agoThe FBI is demanding the signing key along with the source code.
- woodman 11y agoNot only the source, they want the signing keys as well: "For the reasons discussed above, the FBI cannot itself modify the software on Farook's iPhone without access to the source code and Apple’s private electronic signature. The government did not seek to compel Apple to turn those over because it believed such a request would be less palatable to Apple. If Apple would prefer that course, however, that may provide an alternative that requires less labor by Apple programmers."
- acqq 11y agoIf the government compels Apple to give FBI Apple's private keys, the spy state starts to officially exists. Currently, the best practices assume that such "keys to the kingdom" are, for example by Apple, only in some hardware devices, guarded, needing presence of more than one person to be used and that every signature made with them is permanently considered and logged. Even if FBI protects the keys, their use of the things they sign with them won't be able to be followed: these would be just plain easily copyable programs.
- forgotpwtomain 11y agoI think even if this were legally viable it would be an unmitigated economic disaster for the US tech industry.
- stuaxo 11y agoI wonder, would it be possible for companies like Apple to completely up sticks and go somewhere else? Where would it be ?
- rubyfan 11y agoThere is no place to go, we all must fight the trend.
- dest 11y agoI guess that if Apple moved abroad, the US would allow the importation of iPhones on its territory only if they can be breakable by the FBI. So either Apple exits the US market (not reasonable I think), or it has to fight the FBI, which it does now.
- junto 11y agoI wonder how far Apple are prepared to go? Does anyone know how far they need to go to put themselves outside of US jurisdiction? I know some companies already sign their software releases outside the US for tax reasons. Is that also enough to exclude themselves from being forced to hand over the keys? I'm starting to picture a world, where software development (as well as corporate structures and finance) are off-shored to development havens, similar to the Swiss and their banking. We already have the start of data havens. How long until these large companies see the benefit from a legal perspective to defend themselves from an over-reaching government? How would Wall Street react to such a move? Is such a move away from Wall Street even possible? Can companies switch exchanges?
- SEJeff 11y agoWell wall St would react very negatively if the US could demand source or back doors. It would severely hurt Apple's stock, of which the iPhone is their top performer. I suspect knowing this, they would go all the way and with their 150ish billion in pure cash reserves, the FBI has an awfully big fight on their hands. Apple could easily waste 10-15 years in red tape and appeals with a case like this all the while designing the iPhone so that even with the source it is hack resistant
- ThrustVectoring 11y agoIt's very difficult to sell phones to Americans while thumbing your nose at the American legal system.
- ps4fanboy 11y agoI really hope if they manage to get the source code it leaks and weakens another American technology company, maybe when their industry is dead they will realize its a global market place.
- ehartsuyker 11y agoExcept that would be absolutely horrible for everyone, so maybe we should hope that doesn't happen.
- Grishnakh 11y agoWhy would it be horrible for everyone if American companies were weakened? There are companies outside the US, you know. It's not like we're going go back to the Dark Ages if American corporations all suddenly ceased to exist. Apple users would be unhappy, of course, because they'd have to switch to LG or Samsung phones, but "absolutely horrible"? Are you kidding?
- ehartsuyker 11y agoI think the ecosystem isn't a zero sum game (not profits, but generally the advancement of software). Apple doing well helps other people do well. Do you really think that if Apple completely stopped existing right now that it wouldn't have a massive negative impact on consumers and other businesses?
- Grishnakh 11y agoMassive? No. Assuming their Apple devices didn't also suddenly stop existing, they'd have a little pain with transitioning to alternatives. There are plenty of alternatives out there to Apple products right now, and with Apple corporation suddenly winked out of existence, that'd leave a big gap for other competitors to take over that space. If anyone is completely and utterly dependent on Apple for their livelihood, that's really their own dumb fault. Nothing apple does is all that critical that you can't get something/someone else to do it, though of course there'd be some pain in the transition. (The same goes for anyone willingly locking themselves into any proprietary vendor.) I guess one drawback is that we'd probably see a significant uptake in Windows Phones, and they might actually get above 5% marketshare.... Anyway, MS bashing aside, my point is: Apple is just a seller of convenience, nothing they make is all that critical that it can't be replaced. Anything you can do with an iPhone, you can do with an Android phone. Anything you can do with a Mac, you can do with a Windows or Linux PC. It'd be annoying to have to get a replacement device and migrate to it and maybe new software, but "massive negative impact"? No. Now, if everyone's Apple device suddenly winked out of existence too, that would be a bigger problem, but that's because of the data stored on those devices, not because of the devices themselves being so valuable. But as long as they kept backups of anything important (and not on Apple-branded backup devices...), that shouldn't be that hard to work around either.
- ehartsuyker 11y ago> The FBI’s brief dismisses all of this as a marketing ploy, and then blasts Apple as a literal threat to American democracy, writing: “Apple’s rhetoric is not only false, but also corrosive of the very institutions that are best able to safeguard our liberty and our rights: the courts, the Fourth Amendment, longstanding precedent and venerable laws, and the democratically elected branches of government.” Ironically, Apple giving users encryption doesn't weaken the Fourth Amendment; it makes it stronger because it provides the ability for citizens to be "secure in their persons, houses, papers, and effects, against unreasonable searches and seizures" in a way that the courts recently have been unable to.
- mstade 11y agoAlso, since when is the FBI a "democratically elected" branch of government?
- blisterpeanuts 11y agoThe FBI is technically part of an "elected" branch, but it's nonetheless a semi-autonomous agency not directly accountable to the people who voted for the President. Even the President could be investigated by the FBI. We just have to trust that good people were appointed to this agency, and be ready to fight them in court when not-so-good people make bad decisions.
- harryh 11y agoThe FBI is part of the executive branch which is democratically elected.
- naringas 11y agothe FBI is executive branch!? I would've never occured to me... I thought all law enforcement was on the judicial branch. TIL.
- brudgers 11y agoIn the US, judges adjudicate from the facts presented. Unlike many other legal systems, judges do not investigate. Roughly speaking, the judicial branch of the US Federal government is very small, little more than judges and their clerks. The US Constitution grants it little explicit power and its principle source of political power, declaring laws unconstitutional, was established solely by the Federal physician's own precedent: one day the US Supreme Court started declaring laws unconstitutional.
- bsder 11y agoThe FBI basically just told the judicial and legislative branches to go pound sand. No judge is going to be willing to let this level of power grab against the judiciary to slide. Apple's lawyers must be very happy right now.
- soft_dev_person 11y agoI'm almost starting to believe there are forces in the FBI trying to thwart the case for the FBI, by making so ridiculous claims that the legal precedence will be set for a long time, preventing the FBI or any agency to get this kind of power. But then again, it's more likely they just completely lost sight of how the real world actually functions, and their own mandate. If this actually does go through, my view of the US will be closely aligned with Iran and North-Korea.
- hammock 11y agoWasn't there something in TPP prohibiting member governments from forcing companies to hand over source code? (I know it's not passed yet)
- DavideNL 11y agoI hope Apple will further improve iOS encryption so it can not be broken, even by people (FBI or Apple) having access to the source code. There should be no signing key that can be used without first entering the correct PIN in the first place. That's the real problem here, isn't it?
- dm_mongodb 11y agoi can imagine reasons why apple would want or need to be able to update secure enclave firmware without the correct pin entered first. #2-3 are highly speculative: 1) fear of a bug. just the right firmware bug and you have 100 million phones lose data, and perhaps bricked too. unlikely, but consider the cost. i would be worried about this if i were in charge of the iphone project and the secure enclave feature were newish. we can imagine pretty good solutions to this one though, with work and time. 2) out of 100+ countries where they sell phones, over time, some will give them a confidential court order saying they must retain this capability. if a foreign court order, they could refuse to comply, but then would have to exit that market -- infeasible if multiple countries. and a different 'version' for just those countries would be noticed over time by security researchers? 3) they might already have an order as such from the U.S., for foreign intelligence purposes. as mentioned a different international version if noticed is a PR disaster for apple. so the easiest way to comply is just do it that way for all phones. perhaps they push back on the fbi request because that's the one they can talk about, yet it templates the whole issue.
- mizchief2 11y agoThe FBI's purpose isn't to unlock this phone. They already know it has nothing of value on it. What they want is the precedence to use the court to go against the will of congress. This has already been brought up and the people and their representatives shot it down.
- dm_mongodb 11y agoI don't understand. Can someone please clarify for me. They physically have the phone right? Could they not just read the whole flash, try a pin, write back the whole flash, repeat? (i.e. take the phone apart) (given it is a 5C with no secure enclave)
- Phlarp 11y agoI suspect there are a myriad of technical means to pop the phone, including the method you outline, but I doubt the FBI has the talent or connections to get it done in way that would be presentable to court. (I.E. Nobody in house is capable and any contractors they would hire to do it don't want their methods made public in an open trial) One assumes the NSA would make short work of this phone's lock if it had been recovered from the OBL compound, but using them in this instance also brings in some dicey legal issues (they "can't" operate domestically) and the NSA is even less willing to give up it's own tactics than a security consulting firm would be. FBI seems to have chosen to go the "lawyer up and look for a court order and some wet blanket executives willing to hand things over" route-- Tim Cook is, thankfully, well principled enough to tell them to pound sand. Surely, at some point in time, the FBI will figure out how to recruit technical staff that is capable of doing more than just extorting bitcoins from cyber drug kingpins.
- justncase80 11y agoWould giving them access to the source code even matter, other than morally speaking? Meaning, just having the code won't let them crack a phone and it won't let them patch the OS so that its subsequently crackable would it? When the FBI is worse than the terrorists they need to take a step back and think about the bigger picture a little bit.
- restalis 11y agoHmm... I remember a while ago when China was bashed for such an attitude. Isn't that just fascinating?
- npunt 11y agoSeparation of powers sure has it's benefits though.
- studentrob 11y agoDoesn't this make the FBI's case weaker with the public and the court, given there would then be more points of attack for hackers? Comey went on record saying the tool should be secure in Apple's hands because Apple knows what it is doing [1] And, he didn't even think of this tactic until Darrell Issa suggested it at the Congressional hearing [2]. > Issa: Did you receive the source code from Apple? Did you demand the source code? > Comey: Did we ask Apple for their source code? Not that I'm aware of It seems like the FBI is grasping at straws here. Does anyone buy this charade? The PR on the DOJ's side is atrocious. From the beginning, "just about one phone" was obviously a lie, and it's all been downhill since then. For once, the fear, uncertainty and doubt tactics of the government are not working. I'm happy about that but concerned for our future when law enforcement blames technologists for not handing over data to phones. We need to continue educating each other on these issues regardless of what the courts say, and regardless of what ultimately comes out of Congress. [1] https://youtu.be/g1GgnbN9oNw?t=2h43m12s https://youtu.be/g1GgnbN9oNw?t=2h43m12s [2] https://youtu.be/g1GgnbN9oNw?t=1h21m33s https://youtu.be/g1GgnbN9oNw?t=1h21m33s
- nobody_nowhere 11y agoYou're treating the public case the FBI made earlier as if it reflects its actual beliefs and motivations. Looking at the pattern of actions, rather than the rhetoric, suggests something else to me. And it's a little early to say that it's not working. It's not working as well as they'd like. It's certainly not working for the echo chamber of HN and tech nerds, but what we think is irrelevant. It's not over 'til the fat lady sings, as they say....
- Bud 11y agoAlso, best not to get cocky about whether it's "working" or not. Remember that the government can come back to this again and again with carefully-crafted test cases. They only need to get it right once. We have to fight this off successfully every time.
- jrcii 11y ago> It's certainly not working for the echo chamber of HN True. I would also go a bit further and say it doesn't appear to be working with the House Judiciary Committee. I watched all five and a half hours of the inquiry and overall, the committee including the chairman seemed strongly on Apple's side. There were only 2-3 dissenting positions in favor of the FBI.
- spaceheeder 11y agoCould anyone explain to me, legally, why the FBI wouldn't be allowed to compel Apple to provide this? The government was able to compel private SSL keys from Lavabit. If the only difference is "Apple has money to fight the court order," then would a court's refusal to grant the FBI access to the source code and signing keys create a precedent that could protect future Lavabits?
- isamuel 11y agoThe Lavabit case was decided on entirely procedural grounds—the Fourth Circuit never said that it was OK to compel the disclosure of the SSL keys, only that Lavabit had waived its objections in the district court (at which stage Lavabit was acting without counsel). Source: I briefed and argued the Lavabit case in the Fourth Circuit.
- spaceheeder 11y agoFascinating. And saddening. Would Lavabit have been protected if a prevailing Apple had stymied government access to cryptographic keys prior to their coming under scrutiny?
- Pyxl101 11y agoThe government didn't start by asking for LavaBit's SSL key. They asked LavaBit to start intercepting communication to/from one user. LavaBit had done so in the past in other cases. LavaBit's refusal to do so in that case thus immediately looked suspicious to the court. LavaBit mishandled the case and tried to escape responsibility with stupid, poorly-argued logic, and poorly handled delays on their part. When LavaBit failed to take prompt action to enable interception, the government finally demanded the SSL keys to do it themselves. If I were you I wouldn't trust the guy involved in LavaBit in the future, Ladar Levison. He frankly did not seem to be up to the challenge of running a company that is prepared to navigate this space, from the way he bungled the case. He got basic things wrong about how to engage first with the FBI, then with a court over a court order, and made his position worse by ineptly arguing with the court without advice of council. He blew his shot to raise arguments with the court later as a result. Furthermore, he clearly made misleading claims about the security of the product, and I believe knowingly. LavaBit had by that point had already helped the govt surveil other users, all the while maintaining that the communications were secure and that even they couldn't read them. I have no axe to grind with LavaBit - these are all conclusions I reached by investigating the case myself. You can see this for yourself by reading the court transcripts and news articles. While his intention to provide a secure communications product was noble in the abstract, I would personally trust neither his technology judgment nor his business judgment in how to run a company or handle tough legal circumstances in the future. He did stupid, immature shit like, when finally ordered to provide his encryption key, he printed it out on paper in an illegibly small font. The court of course compelled him in an industry standard format. That kind of thing is just immature and makes the situation worse for him and his users by extension. http://arstechnica.com/tech-policy/2014/04/lavabit-held-in-contempt-of-court-for-printing-crypto-key-in-tiny-font/ http://arstechnica.com/tech-policy/2014/04/lavabit-held-in-c... Any tech person with an adequate knowledge of encryption and security could have seen through LavaBit's security model. It's not possible to provide webmail in a mode where the webmail provider can't read your email. http://www.infoworld.com/article/2609583/encryption/how-secure-was-lavabit-s--secure--email--not-very--says-researcher.html http://www.infoworld.com/article/2609583/encryption/how-secu... > "The ciphertext, key, and password," [Moxie] Marlinspike wrote [in his analysis of LavaBit], "are all stored on the server using a mechanism that is solely within the server's control and which the client has no ability to verify. There is no way to ever prove or disprove whether any encryption was ever happening at all, and whether it was or not makes little difference. ... Even though they advertised that they 'can't' read your email, what they meant was that they would choose not to." Marlinspike also took exception to the way the password supplied by the user also does double duty as an encryption key, a practice frowned upon by password researchers. The article above also links to Levison's reply which is not convincing at all: > Marlinspike is assuming that the Lavabit system was designed to be a substitute for the security provided by end-to-end encryption systems like PGP. It was not. Lavabit’s encrypted storage feature was designed solely to protect e-mails at rest. Huge, huge hedging right there. If you're using PGP then there is virtually no benefit to using LavaBit at all. > Why protect the data at rest? To limit the data Lavabit could access and therefore turn over to the government. When the government seeks a specific user’s data, it is given what is stored on disk, e.g., any metadata found in a server’s log files and any e-mail content the provider has access to. Clearly the government wants to intercept data in transit too, and LavaBit had helped them do it prior to this case. Yet LavaBit continued running and advertising its services. Furthermore, if I recall correctly, LavaBit stored the user's data encryption key encrypted with the user's password, so all it took is one login from a user under surveillance and the government would have gotten the keys to decrypt all the data at rest too. A competent technologist should have known that was a risk from the beginning, so if he actually missed that threat vector it should tell you something; but even if he didn't know from the beginning, he knew after the first time he helped do that for the FBI. There is only one circumstance in which LavaBit's security model would have worked, which is if the user under surveillance never logs into LavaBit again after the surveillance begins. But if they log in even once more, their password flows to LavaBit and thus the govt, which can decrypt all the user's data at rest. This is what the court initially ordered LavaBit to do IIRC: intercept the password of one user on login, and then provide the user's data. And LavaBit had done so upon earlier requests. The fact that he did not disclose this threat vector to his users from the beginning tells you something about his intentions.
- blisterpeanuts 11y agoSurrendering the source code to iOS? That sounds like a huge overreach by a law enforcement agency. That thumb drive would be worth billions of dollars. A $60K/year bureaucrat is supposed to protect it from Apple's competitors? I wonder how long it would be before this prized intellectual property ended in the hands of Samsung, various Chinese companies, maybe a copy floating around Russian and East European networks, and eventually Google labs? The scary thing is that the FBI, with the support of the President and quite a few top Congressional leaders, could very well win.
- evunveot 11y agoWouldn't it be straightforward for Apple to design future iPhones to accept device-targeted updates in order to comply with law enforcement requests like the one that started all this? Just add a step: 1) Is this update signed by Apple? 2) Does this update indicate a particular device and if so is this that device? I wouldn't support the government compelling Apple to implement that, but I don't think I'd have a problem with Apple doing it voluntarily. Of course, if it's not a government mandate then anyone who cares (for criminal reasons or otherwise) can just use other devices that don't have the same system in place, so in the end it's just security theater. But at least it might detour some government attempts to overreach and effectively outlaw encryption entirely.
- cbeach 11y agoThe UK govt is equally eager to ban/compromise encryption, and I think the challenge for technologists is to find ways around this. How difficult would it be to develop a protocol that concealed encrypted payloads in innocent-looking plaintext traffic? A kind of "clandestine encryption." I suppose the problem is that individuals might get away with using clandestine encryption, but no convenient service provided by companies like Apple would be able to.
- dreamcompiler 11y agoIt's called deniable encryption. https://en.wikipedia.org/wiki/Deniable_encryption https://en.wikipedia.org/wiki/Deniable_encryption
- chrramirez 11y agoI felt something in my stomach when they implied that people who actually don't care about security are the ones who buys Android phones.
- thoughtsimple 11y agoAccording to the WSJ, less than 10% of Android phones are encrypted.
- Glyptodon 11y agoThis is at least much more plausibly legal than drafting Apple employees as slave labor.
- thyrsus 11y agoI'm very comfortable with President Obama's broad policies an intentions, but when it comes to privacy rights, I have one question: What would Richard Nixon do?