98 ms·

U.S. Drops California Case Against Apple After Accessing iPhone

746 points by potshot 11y ago

Gratsby 11y ago
The case is droppable because it lacks public support. That was clear a month ago. It's an impossible scenario - requiring an engineering effort from a consumer focused company. If Apple wanted to comply, it would have been extraordinarily costly. What's good about the case is that it brought forth a discussion about privacy. This case coupled with the Clinton email scandal should move a few ideas forward developing solutions that wouldn't otherwise have been profitable ventures. Where Lavabit had a very niche market a few years ago, companies thinking along those lines will have success moving forward.
adriancooney 11y ago
Congratulations Apple and encryption. A precedent has be set. The FBI can't just bully companies into complying with their requests. Hopefully companies in future will have the integrity and courage to stand up like Apple did.
- JustSomeNobody 11y ago
  I'm not so sure the results are as you say.
matt_wulfeck 11y ago
You could say they dropped it because they accessed the phone. You might also say they dropped it because going to court and losing would greatly narrow the scope of the All Writs act. Then the "maybe illegal" spying coersion becomes "actually illegal"
- sremani 11y ago
  You can also say, your IPhone is not as secure as Apple claims and state actors can break it.
  - adevine 11y ago
    It was always known that the 5c, which is the device the FBI accessed, was less secure because it does not contain a Secure Enclave like later iPhones.
  - mtgx 11y ago
    Is there anything state actors can't break into? There will always be vulnerabilities to fix. Apple's and other companies' hope is not to fall too many steps behind the state actors.
    - lallysingh 11y ago
      PGP worked well enough for Snowden, right?
      - cookiecaper 11y ago
        Snowden had the element of surprise. They weren't actively trying to monitor his comms because they didn't know he was a risk until after the leaks. If the state wants to decrypt your messages badly enough, they have resources that they can devote to that (as well as multiple side channels that are probably easier than forcibly decrypting, including the infamous "beat with a wrench" trick). It's not trivial to defeat strong encryption, but it is doable given sufficient interest.
        marvin 11y ago
        Is there any evidence that any actor in the world is (in general) capable of figuring out the contents of e.g. an AES-encrypted message with the key unknown, assuming good opsec and a good implementation? I agree with your statement that state-level actors have strong capabilities, but this seems like a blanket statement which is likely untrue.
        koenigdavidmj 11y ago
        No, and I doubt that this capability would be revealed for something at the level of San Bernardino, or anything short of "ISIS is going to do a WMD attack against Manhattan".
- mtgx 11y ago
  I would hope the media follows up with "so what did you find out from it?" and don't just leave it to "trust us, we unlocked it".
  - fooey 11y ago
    They'll just say "can't comment on an active investigation" if they don't find anything to make the whole thing seem worthwhile.
    - zmmmmm 11y ago
      To which it would be reasonable to ask, "so why did you hold this whole case in public, against Apple's wishes, if it is now so secret you can't even comment on it?"
      - imron 11y ago
        To which they will reply, "we would not have commented on what we found on the device if Apple had been compelled to help us break in to it, and we will not be commenting on what found on the device now" Holding the case in public, and publishing the contents of the phone in public are very different things
        zmmmmm 11y ago
        > Holding the case in public, and publishing the contents of the phone in public are very different things And saying they "can't comment" as the GP suggested is different to publishing contents of the phone. They could easily comment on whether they found anything or not, whether it had any importance to the case, the nature of what they might have found without revealing specifics. If they do simply say they "can't comment" then we will know they are lying, because because they already did comment, quite voluntarily: they just held a whole court case in public about it which revealed all kinds of gory details. A court case which Apple asked to seal and the FBI said "no, we want this to be public".
    - anigbrowl 11y ago
- anigbrowl 11y ago
  It'll be easy enough to infer which it is later because if they have actually got data out of the phone then they'll amend the complaint against the co-conspirator(s) with the newly available information.
  - bunderbunder 11y ago
    Only if the data is useful. Which is far from guaranteed, as many have pointed out previously.
lisper 11y ago
Told ya. https://news.ycombinator.com/item?id=11199093 https://news.ycombinator.com/item?id=11199093
GuiA 11y ago
Would they be doing anything illegal if they in fact had not been able to unlock the phone, but were saying so to save face?
- malchow 11y ago
  Yes. AAPL has averred to the judge that they in fact accessed the phone. I was skeptical over the last 72 hrs whether that was a ruse or not. I now think it is not. "The government has now successfully accessed the data stored on Farook's iPhone and therefore no longer requires the assistance from Apple Inc. mandated by Court's Order Compelling Apple Inc. to Assist Agents in Search dated February 16, 2016." The government also gets to use the same logic regarding the power of the court to compel at some time in the future, when this assuredly comes up again.
- deleted 11y ago
  [deleted]
jamescun 11y ago
This is possibly the worst outcome. The tide of public opinion was turning towards Apple and privacy, and away from the FBI; for it to enter the court under this pretence there was a strong argument to be made against the latter. With this announcement, for the many, this matter will now be "resolved". When it inevitably rears its ugly head again, the same pretence may no longer be true.
- mikestew 11y ago
  There are a huge number of side effects that would have to be dealt with, but this case has made me think that Apple should have the option to say, "changed your mind? Nooo, that ship (which you, the FBI, built and christened) has sailed, buddy, and you're on board. This is going before a judge, like it or not, and we're doing it now."
  - hyperliner 11y ago
    They would have to make a claim against the DoJ. A party (the DoJ) has the right to drop their claim.
  - GraemeLion 11y ago
    Except that's not how courts work. Apple is the defendant, the government is the plaintiff. The plaintiff should always have the right to end a case/action. Allowing defendant's to continue cases allows for highly malicious actions to occur.
    - Bud 11y ago
      Oh? It seems to me that in this case, allowing the government to discontinue its trumped-up case is what has allowed the "highly malicious actions".
    - mikestew 11y ago
      Did I not say that there were side effects? :-) I realize this has problems, and I'm not the one to be providing solutions. However, "nuisance lawsuits" are a thing, and this case is probably the poster child. Only instead of "pay me and I'll go away", it's "we'll keep trying until we feel the tide of public opinion turns against us, then we'll pull out and try again...repeatedly." I don't know, just doesn't seem like the way things should work. You either have a case or not, public opinion be damned. So fine, defendant doesn't get to push continuing the case. Then how about FBI doesn't get to try again? Of course, problem there is that the next will be ensured to be just different enough to not fall under whatever regulation or law is set up to deal with such a thing.
chii 11y ago
I feel like cases shouldn't be droppable unless both parties mutually agree, and the courts also must first agree.the courts should not agree if it's a case that could set a precedent that can have far reaching implications. What if next time, a smaller player than Apple was caught in this sort of case, and they can't fight back as easily? Then it'd be easier to setup a precedent favourable to one party. This seems like a way to legally manipulate the common laws, and I think courts should put in place measures to prevent such manipulation.
- thecosas 11y ago
  Cover Apple's legal fees maybe? Argument for damage to Apple's reputation, etc? Pretty sure Apple doesn't want either of those things.
- nostrademons 11y ago
  Big companies can still buy little companies to take on their lawsuits, or they can provide funding & resources to fight a legal battle as part of an investment. I suspect that Google bought YouTube in part to avoid precisely this situation. If Viacom had won their lawsuit against YouTube, it would have endangered Google's core business: they would become liable not just for copyrighted material that they know about, but any copyrighted material on their servers, which encompasses the whole web. So they pay $1.6B for a tiny startup and a big lawsuit, and then use their full legal resources to fight (and eventually win) the lawsuit. (There is possibly an interesting get-rich-quick hack in there: do something in a legal grey area that lots of big companies are doing too, as part of their core business, and then get sued. It is then in the big company's interest to acquire you and fight your legal battles, lest they get put out of business by an unfavorable precedent. You're playing with fire in this case, though, since if the big company doesn't come to your aid you have a multi-hundred-billion dollar lawsuit hanging over you.)
  - blademan88 11y ago
    You wouldn't get-rich-quick... you'd agree to a buyout with horrible terms since you'd have zero bargaining power given the circumstances.
bradhe 11y ago
This claim seems dubious at best. There's no proof that they got access, and it's in their best interest to claim they did. On one hand, I'm not totally sure we should assume that they're not capable of gaining access to iPhones willy-nilly. On the other hand, I'm re-evaluating my security posture...
- GraemeLion 11y ago
  Apple has, as part of the case, admitted that data access was obtained by the FBI. Unless they're in on it too, of course.
- r00fus 11y ago
  Why would it be dubious? It's an older phone without a secure enclave - that's subject to the NAND mirroring trick. Then again, why can't Apple sue Cellebrite under the DMCA for bypassing their security?
- molecule 11y ago
  > This claim seems dubious at best. There's no proof that they got access, and it's in their best interest to claim they did. Wouldn't that be perjury? https://www.documentcloud.org/documents/2778264-Apple-Status-Report.html#document/p1/a285980 https://www.documentcloud.org/documents/2778264-Apple-Status...
  - imron 11y ago
    Sure, but what's a little perjury between government officials: http://www.salon.com/2013/06/12/how_james_clapper_will_get_away_with_perjury/ http://www.salon.com/2013/06/12/how_james_clapper_will_get_a...
    - fncypants 11y ago
      Lying to an indifferent, disagreeable, and dysfunctional legislature is one thing. Lying directly to a federal judge with contempt power is how one ends up in jail before packing up your suitcase and walking out the courtroom.
downandout 11y ago
I would treat this claim with a great deal of skepticism. However, this is by far the smartest play for the government. Had they gone to court and lost (probably after an appeal), they would have set a precedent that would be very problematic for them going forward. By claiming this, falsely or otherwise, they hurt Apple's security reputation (most consumers will not understand or care that this happens to be an old iPhone with an old version of iOS - they will just hear or read that an iPhone was cracked), and they avoided a potentially problematic legal outcome. The DOJ came out on top here, whether they are lying or not.
- snarkyturtle 11y ago
  But they needed to get third-party help in order to access the phone, just by suing Apple they seem like they're incompetent at their jobs...
  - partycoder 11y ago
    They are competent as they solved the problem.
  - nickff 11y ago
    On the other hand, many smaller companies could not have afforded to take this dispute as far as Apple did, so the FBI proved they were willing and able to cause significant final injury to anyone trying to protect their users' privacy. One could look at this case as proof of the ability for the FBI to extort information and cooperation.
- mcphage 11y ago
  Maybe, but they didn't actually accomplish any of their real goals—making it easy to force Apple to break their security. This particular phone is immaterial, and Apple can always talk big later about how they patched any of the security holes that the government used, to recover face.
  - downandout 11y ago
    >Maybe, but they didn't actually accomplish any of their real goals—making it easy to force Apple to break their security Unless one of their real goals was to get the conversation going about creating new laws that would make uncrackable products illegal, without actually testing the limits of existing laws. Because that is what they achieved. > This particular phone is immaterial, and Apple can always talk big later about how they patched any of the security holes that the government used, to recover face. That is a nuanced understanding of this issue that most consumers simply do not and will not have. Most will hear nothing other than "the feds can now crack iPhones" and will assume that government will be able to beat any future improvements too.
pavornyoh 11y ago
Can Apple counter sue for them to reveal how they accessed the phone? Surely, there must be a loophole in there somehow...
- GraemeLion 11y ago
  Nope. The government does not have to disclose investigative techniques. If Apple wanted to help the government, they could have, but they chose not to take that tact. Expecting the government to help Apple now is folly.
  - koenigdavidmj 11y ago
    Until the next case comes in, where the FBI says that what they tried last time didn't work.
  - pavornyoh 11y ago
    What about Cellebrite thus www.cellebrite.com. This article seems to suggest it is them - http://gizmodo.com/the-company-helping-unlock-the-san-bernardino-iphone-ha-1766641607 http://gizmodo.com/the-company-helping-unlock-the-san-bernar...
    - GraemeLion 11y ago
      Why would the company used have any responsbility? Remember, the phone is owned by San Bernadino county. They wanted it cracked. The holder was the San Bernadino Sherrifs', they want it cracked. The FBI wants it cracked. The judge issued a warrant covering the data on it, and then the all writs act compelling companies to assist if they can. Apple could not. Cellebrite could. I get what you're saying, but this is having your cake and eating it too. Apple chose not to assist. The FBI found someone who could. Why would that company then have to disclose to, basically, a third party (even a third party inventor of the phone) their standard work product and trade secrets?
  - tucif 11y ago
    Would it be possible to make a FOIA request?
scarmig 11y ago
This is a legally naive question, but how does this not run afoul of the Computer Fraud and Abuse Act? Particularly, how isn't this some violation of section a2 ("intentionally accesses a computer without authorization or exceeds authorized access," the same thing that got Aaron Swartz indicted)? Is it basically, since the feds had a warrant, they can do whatever they want? (And if they don't have a warrant, is it still legal?)
- fooey 11y ago
  If no prosecutor would ever touch it, is it really illegal?
- GraemeLion 11y ago
  There was an active warrant allowing it.
- pfg 11y ago
  There are laws against breaking into people's homes, and yet the police still does it daily. IANAL, but I assume a warrant would apply to this case just the same.
- dgacmu 11y ago
  Most of the time, people can't kick down your front door, search your house, and pack up a bunch of your possessions without your permission. Start digging here - https://en.wikipedia.org/wiki/Police_power_(United_States_constitutional_law) https://en.wikipedia.org/wiki/Police_power_(United_States_co... There are really a few sub-questions: Is it legal, and are the results admissible as evidence? Whether or not it's legal depends on the circumstances. There are many cases in which the police can search something, e.g., if they believe it's critical to prevent an immediate threat. Whether or not it's admissible is more thorny, and something that's still being fought out in the courts. (google: warrantless cell phone search admissible)
- GCA10 11y ago
  The phone belonged to San Bernardino County, which was quite happy to have the FBI get to work on it. Syed Farook had been authorized to use the phone, but only under the county's terms. If it had been Farook's phone, and if his surviving relatives asserted some claim, that might have made matters a little trickier. But in this case, Farook is dead. He never owned the phone. The organization that did own the phone wants the FBI to crack it, for easily understandable reasons. On ownership, at least, the facts are unusually friendly to the FBI.
RichieAHB 11y ago
While the claim about accessing the iPhone seems difficult to substantiate, the suggestion that the FBI have dropped the case seems likely. The fact that they can drop the case in this instance, when the wheels had started to come off, smacks of having their cake and eating. Let's hope the next case where they try to get the ball rolling towards the dangerous precedent they are looking to set yields a similar outcry as this one.
fucking_tragedy 11y ago
Reminder that the FBI used the deaths of 14 people to prop up their agenda of 'make the invoices we receive cheaper'. They chose this case and not any of the dozens of similar investigations mentioned in articles that have come out since. It's a disgrace to the victims, their families and friends. It's also a disgrace to the public, trying to scare us into complacency.
- cmurf 11y ago
  OK. But what does it say about the scant majority of the country that at least tacitly (through polls) supported the FBI in this? I think this whole thing is every bit as much a trial balloon to see how the public accepts the various arguments. And I think that's still unclear. The polls suggest a scant majority supported the FBI, but not enough to get Congress to change the law make it clear companies can be rolled over by the government. That means there will be a next time.
a3n 11y ago
I wonder what the government's obligation is to Apple, to let them know the nature of the vulnerability.
- GraemeLion 11y ago
  None.
- cmurf 11y ago
  Legally none. Ethically? I think it's worth debating what sort of public trust should be granted to government that sits on an exploit. But it also requires knowing how they did it. I think most likely they copied the flash, started iterating passcodes, and then reflashed the phone everytime they ran out of attempts. That's sufficiently obvious (to me anyway) that it's not much of an exploit worth documenting and also there's no software fix for such a thing. You'd need to put the passcode attempt counter on some separate piece of hardware that either can't be externally read or reflashed.
- nacs 11y ago
  I'm sure Apple already knows how they are doing it. The tech that FBI is claiming to have cracked is the iPhone 5C which does not have the Secure Enclave hardware that all later iPhones do and which are far more of an actual challenge to crack.
johnhattan 11y ago
Am I thinking right when it seems to me like the feds are kicking the can down the road? Even though the feds found an exploit that allows 'em to decrypt the current iOS, Apple's response is undoubtedly gonna be much-improved security in the next version. So in a few years when the feds demand that an iOS 10.x device be decrypted, this whole pageant will start over again.
- mcphage 11y ago
  > Am I thinking right when it seems to me like the feds are kicking the can down the road? Yes, but who knows when they'll ever get this good a case again?
Johnny555 11y ago
I wish Apple would be able to recoup their legal costs from the DoJ -- the government shouldn't be allowed to force a company to spend money on defending their rights (using our "unlimited" tax dollars to do so), only to drop the case at the last minute making the entire case moot. Apple should be able to recover their legal costs.
- GraemeLion 11y ago
  Somewhat agree, but Apple DID have a court order they were fighting. They did choose to fight this legally adjudicated and issued order. The owner of the phone and the law enforcement both wanted the phone decrypted. FWIW, I agree that privacy is ignored and should be respected, but apple chose this fight. I'm glad they did, but they knew it would cost them.
  - Johnny555 11y ago
    And the DoJ stopped fighting. If the DoJ ultimately won the case, then it's fair that Apple should have to pay their legal costs. But since using a 200 year old law to force Apple to do work they don't want to do was a legal stretch, if the DoJ lost the case then again I'd say the DoJ should pay Apple's legal costs.
    - teacup50 11y ago
      The law in question was passed the same week that congress submitted the fourth amendment. Please stop parroting "200 year old law".
      - Johnny555 11y ago
        Oh, you mean in 1789, 227 years ago?
        teacup50 11y ago
        Yes. The same week that the fourth amendment -- which is what provides us with strong protection against unreasonable search and seizure -- was approved by Congress. Or do you refer to that as a stale 200 year old law, too?
cmurf 11y ago
Who wants to take bets on how? My bet is they copied the flash, and are iterating passcode guesses until it slows down too much (or implodes, however it's configured) and then they reflash and iterate again. And it was only a 4 digit passcode, so it was pretty easy to do this. The next bet is whether they find anything relevant? My bet is no. Next bet after that is whether they admit it? My bet is they won't. But the more important one is if they tell Apple or open a CVE for the exploit they used if it's not a flash and guess technique they used? Is it ethical for FBI to sit on an exploit?
- airza 11y ago
  that's not how the security enclave works as far as i know, you can't copy that part off and so you can't copy off + bruteforce the drive?
  - HappyTypist 11y ago
    You can't copy that part off to another device but you can reflashing the chip on the device.
  - askldfhjkasfhd 11y ago
    I don't think the iPhone in question was of a generation that had the security enclave, was it?
  - icebraining 11y ago
    From what I understand, the iPhone in question is an older model, without the secure enclave.
    - TazeTSchnitzel 11y ago
      The person in question had an iPhone 5C, which is very similar internally to an iPhone 5, and it doesn't have the Secure Enclave because it lacks Touch ID. The 5's successor, iPhone 5S, has it, I think.
  - mikeash 11y ago
partiallypro 11y ago
Who wants to be there was absolutely nothing on the phone of value for the intelligence community? It's like the Reddit "what's in the safe" threads. I just wonder what methods they used, I think it'd be pretty interesting to learn just the general strategy, as I assume they would never tell how exactly they did it.
personjerry 11y ago
I suspect they didn't actually crack it. I think it's likely that they just realized the losing battle they were fighting. It sounded like a lot of public sentiment was against the FBI and they were unlikely to win the case (and it seemed like the information wasn't vital to them anyway) so they just gave an excuse to drop the case. This has an additional benefit: rather than having the "boundaries" here be defined by a ruling, now in theory they have more time to work in a "gray area".
- Alex3917 11y ago
  They may also be saving their political capital to indict Hillary.
- omonra 11y ago
  I'm not sure about public sentiment - have you seen polls about it? My take is that HN crowd is completely unrepresentative vis-a-vis the opinion of majority on this issue.
  - personjerry 11y ago
    You may be right; I have not. I had read that most of the big companies like Facebook and Microsoft, at least, were against the FBI on this issue so that is more of what I meant by "public" sentiment, although now thinking about it, that means I've made a much less compelling argument.
dustinpkane 11y ago
How do we think they did this? Probably copied phone's memory and implemented a way to restore the state of the phone, then brute force try passcodes? I guess that could take only a week if they had only a 4 digit passcode.
imron 11y ago
> Government agencies are now able at least to break into handsets which don’t yet have the latest software upgrades. Surely that should be latest hardware upgrades. The latest software upgrades are no good if not backed up by the secure enclave.
cwills 11y ago
Hard to verify. Perhaps if the FBI or other law enforcement continue to use the supposed vulnerability - eventually information obtained from a breached iPhone will appear in court as evidence..
vinhboy 11y ago
I wonder which security group helped the FBI. There must be another whole world of, government friendly, security researchers I don't hear about.
shalmanese 11y ago
The FBIs motives have always been nakedly transparent in this case. They had no interest in the specific phone, they wanted to use it as a wedge issue to force a precedent. Once they figured out this avenue was a bust, they withdrew to find a different angle. Since everything is classified anyway, it's irrelevant if they actually cracked the phone or not but if they did, it was probably by buying an exploit from the NSA TAO store [1]. [1] https://en.m.wikipedia.org/wiki/NSA_ANT_catalog https://en.m.wikipedia.org/wiki/NSA_ANT_catalog
HoppedUpMenace 11y ago
Just a random thought: Isn't it quite an interesting coincidence that they found a way into the iPhone just as people were reporting problems with iOS 9.3?
- JustSomeNobody 11y ago
  Coincidence. But not very interesting. I think.
- HoppedUpMenace 11y ago
  It would appear random thoughts are not entertained here lol.
snowwrestler 11y ago
I'm seeing a lot of comments to the effect that the government will just try again at some point. Well, welcome to life in a democracy. Nothing is ever settled with finality because there are plenty of ways for future generations to change the laws we cherish today--for good or ill. We could revoke the 13th and 14th Amendments and have slavery again--there is no legal impediment to that. That we don't do that is a reflection of our cultural values--today--which we continually discuss and reinforce. We could abolish the EPA, or the IRS, or the NSA. We don't because these have enough supporters who value what they do, today. The 2nd Amendment remains strong today because millions of Americans work every day to keep it that way. So, the long-term solution for strong encryption must be a cultural one. We have to be prepared to fight the crypto wars forever, like unions are still fighting the labor wars a century later. Like civil rights activists are fighting racism even today--and will be for the foreseeable future. Is that depressing? Not to me; I find it inspiring, much better than a world in which government decisions are truly final. Beware that level of power IMO.
- syshax 11y ago
  >We could revoke the 13th and 14th Amendments and have slavery again--there is no legal impediment to that. Actually, I think this is the genius of the amendment system. You are correct that it could happen. But unlike laws that can be passed or revoked by Congress by political whim, the barrier to creating or overturning Constitutional amendments is much higher and more difficult to pass.
  - studentrob 11y ago
    Plus the point of our system is to allow both good and bad ideas to be discussed openly so everyone can decide their merits. We haven't seen the likes of Trump since Nixon, and he won't be the last, but we are stronger for giving him room to speak. The bad ideas will hang themselves, even if he becomes president. The US president is not all powerful. There are many limits in place.
    - EdHominem 11y ago
JustSomeNobody 11y ago
Can't wait to find out what they found on it.
remarkEon 11y ago
If true, what's the significance of that speculation that it was an Israeli contractor that built this? Who gets access to this hack?
- BackPropagate 11y ago
  There is no "significance".
jrbapna 11y ago
Was I the only one who assumed the DOJ could unlock the phone for a while now, but instead chose to legally force Apple to do it to set a precedence? This news almost seems like a win for Apple; if there was a good chance that the DOJ would have won the case, they probably would have pursued it till the end.
xufi 11y ago
As expected. The FBi just wanted some media attention as far as I believe it to be
spdustin 11y ago
Is there any avenue for Apple to begin legal action against the US Gov't for hacking the phone, in order to shine a light on the truth of how the phone was "hacked"?
p01926 11y ago
It stinks that the case ended like this — without setting a sensible precedent — but I think there is still some upside: FBI director Comey's "Going Dark" narrative no longer holds water with anyone who's paying attention. He cried wolf so loud he's been heard on every continent. If and when he tries this again, he'll get a ton more blowback. Similarly, Obama's jibes about security "absolutism" now appear ridiculous. As are his criticism of impenetrable black boxes protecting child molesters. What he really wants is for the Emmental-like extensions of our brains to have even more holes. That's an obviously un-winnable argument. Also, the bar for proving you've tried all possible alternatives for gaining access just got a lot higher in applying the All Writs Act. It took three months plus a month of major international news stories specifically about this court case to gain entry — something that might really be impossible to achieve next time. But now everyone knows when they swore under oath many times in multiple public venues that they couldn't gain access, what they really meant was "not yet" and not "it's impossible". Finally, Apple should now be motivated to remove themselves as the weak link in their security ecosystem. System updates shouldn't be possible without first wiping the information needed to derive the encryption key or first supplying that key. I can also dream about them open sourcing their code to allow security researchers to bug hunt (an impossible dream). And maybe they'll change their minds on bug bounties. Whatever happens, it's now beyond doubt that foreign entities are exploiting vulnerabilities in the iPhone and we all expect Apple to beef up their security accordingly — regardless of how this may hinder law enforcement.
thegayngler 11y ago
Is it true that Apple doesn't pay people to hack their products so they can patch up their security holes.
free2rhyme214 11y ago
The only thing this title tells me is that the iPhone 5C is not secure anymore. Thoughts?
- fabulist 11y ago
  One shouldn't expect much of anything to remain secure if an organization with the resources of the FBI has physical possession of it.
free2rhyme214 11y ago
The only thing this title tells me is that the iPhone 5C is not secure anymore. Thoughts?
mtgx 11y ago
If it only worked this once, why not declassify it? http://money.cnn.com/2016/03/28/news/companies/fbi-apple-iphone-case-cracked/index.html http://money.cnn.com/2016/03/28/news/companies/fbi-apple-iph...
joering2 11y ago
Hats off to John McAfee!
nodesocket 11y ago
The reality is that the FBI accessed it, so they no longer required Apple's help. "The Justice Department said Monday it has accessed data on the iPhone used by a shooter in last year's San Bernardino, California, attacks and no longer needs Apple's help in cracking it." Apparently a 3rd party from Israel (http://www.cellebrite.com/ http://www.cellebrite.com/) helped the FBI which begs the question, how did they do it? Do they have universal access to all iOS devices or just this particular device? This really makes me start to think there is a backdoor.
- TazeTSchnitzel 11y ago
  One suggestion I heard was to reset the state of the NAND constantly to evade the PIN input limit.
- nobodyshere 11y ago
  I think they (apple) might send a specially prepared iPhone undercover with some verbose logging enabled and ask to have it cracked by such a company, and try to locate the breach.
- nobodyshere 11y ago
  I think they (apple) might send a specially prepared iPhone undercover with some verbose logging enabled and ask to have it cracked by such a company, and try to locate the breach.
f_allwein 11y ago
fwiw, John McAffee has said that he can decrypt the iPhone: http://www.siliconbeat.com/2016/02/18/102312/ http://www.siliconbeat.com/2016/02/18/102312/
billhendricksjr 11y ago
I promise I don't wear a tin foil hat, but it would be great if they proved that they did access it. The cynic in me wonders if they're tapping out because they didn't want to lose in court and set a precedent they don't like.
sinak 11y ago
While this case might have ended, but the battle isn't over yet. Via Matthew Keys on Twitter: "There are 6 other cases where Apple is still fighting the DOJ re: unlocking phones" https://twitter.com/matthewkeyslive/status/714583232117755904 https://twitter.com/matthewkeyslive/status/71458323211775590... ^ Link includes an image with 7 other cases where Apple has either objected to warrants, 2 that are still in process. The most interesting one is the last, which involves an iPhone 6+ running iOS 9.1. It's not yet clear whether the zero day that allowed the government to access the San Bernardino phone also works on the iPhone 6, which has a secure enclave (unlike the San Bernardino phone). There are some other iPhone 6 and iPhone 5S devices in the list too running older versions of iOS.
davesque 11y ago
I'm a little worried now about how long it will be before they come back and claim that there was some critical piece of evidence on the phone and start saying how evil Apple is for not wanting to cooperate because what are they, freedom haters?
stephensurh 11y ago
This doesn't really mean anything. The question is: Does Apple have the right to make an uncrackable phone? We have no resolution on that issue: Only the knowledge that the iPhone 5s is not such a phone.
- terminado 11y ago
  Hmmm, well, what metaphysical Right does the action of creating such a phone fall under, philosophically speaking? Which broader Right is this specific activity a representation of? What does the act of fabricating a secret keeper mean, and does a company gain rights, or are the rights of some set of individuals collectively conferred upon the company by default? Would making a different object, such as a gun, alter said rights? Pretty sure the constitution says Apple can proceed without interference, but these are questions worth contemplating.
Negative1 11y ago
Woah, wait a minute. By purposely bypassing security restrictions present on the device via some sort of exploit isn't the FBI violating the iPhone terms of use? Could Apple theoretically sue them for doing this (and most importantly, for not sharing _how_ they did this)?
- philovivero 11y ago
  As I understand it, one is not allowed to sue the government unless the government gives you permission first. I don't know if there are any limitations around this other than public opinion. But I suspect if Apple attempted this, the FBI would just say they're not allowed to sue.
awqrre 11y ago
Could some random party bring that lawsuit back to court on "behalf" of the FBI without the FBI's approval?
jameshart 11y ago
So in the last week, a lot of media reports around the Brussels attacks have focused on how, in the immediate aftermath of the arrest of an alleged Paris conspirator, the Belgian authorities were premature in announcing that they were learning information about his co-conspirators, which caused those people to bring forward their attack plans. Now, the FBI has just announced to the world that any information locked up in the San Bernardino iPhone is now in their hands. Presumably any co-conspirators who thought their contact details might be in that phone are now aware of that. Now, on the other hand, for the past month or so, the FBI has on the contrary been doing a very good job of informing the world, with to some extent Apple's help, that they did not have access to the information in that phone. That may have served to reassure those same conspirators that the FBI was not onto them.. When perhaps they had actually cracked the phone some time ago, and were in fact in the process of employing that intelligence. Too charitable to suspect the FBI of having pulled that off?
- TazeTSchnitzel 11y ago
  AFAIK didn't the San Bernadino person not use their work phone for this? The iPhone the FBI wanted into was their work phone, already Government-controlled. Not their burner phone, which was destroyed.
  - jameshart 11y ago
    As far as you know. Now consider that the FBI statements about what evidence they gathered from San Bernardino (evidence which is largely not part of a criminal prosecution so not subject to defense discovery) as part of a vector of information which the FBI might choose to manipulate to better enable their ability to exploit the intelligence they have. So what do you really know about work phones and burner phones?
frabbit 11y ago
Meh. If any of this exposes anything, it is that you do not want your secrets to rest in anyone's hands but your own. Apple may/may-not have managed to protect their keys, but there is no guarantee that is the case. Meanwhile Joe Public comes away with the idea Apple==SafeEncryption. If this were some new encrypted messaging service we'd all be ripping the shit out of it just on this basis.
karmacondon 11y ago
So what happens to the other 200+ iphones that law enforcement needed opened? It seems like there are at least certain iphones that can be opened using this method and similar hardware based approaches. Are the feds going to move forward with that? It seems like accessing this particular phone wasn't trivial or cheap. So I'd imagine that it will come down to whether or not it's "worth" the cost of flashing individual chips for each of the other devices. And what happens if there is potentially exonerating evidence on one of those phones? Does the defense team have to come up with the money to pay for a lab or outside company to open the phone? And also, is an encrypted phone going to be the new 'dna evidence'? Like, will a brand new iphone that's linked to a major crime be held away for years until the security community can hack it, potentially setting people free or sending them to jail? Sorry for all the interrogatives. Even though this particular case has been settled, there are still a lot of questions surrounding default device level encryption.
drallison 11y ago
So, the US DOJ has in hand an exploit which allows them to access protected data on an iPhone, access that Apple and the phone's designers clearly did not intend to be allowed. Ethical behavior would have the US DOJ describe the exploit to Apple immediately so that the flaw in the system can be repaired. Publishing the exploit in publicly available documents would speed Apple's efforts to repair the fault.
- thesimon 11y ago
  But that would help the terrorists !1 /s
mzarate06 11y ago
One question I'm not seeing often ... From here, what's stopping the FBI from claiming they found X, Y, and Z on the phone, and further claiming they were all important pieces of evidence, that could possibly have prevented the attack, etc., etc., when they really didn't? Then, use that to bolster their arguments against encryption and privacy? What means will keep them honest about what they did or did not find?
Grue3 11y ago
Here's what really happened: they made Apple the offer they couldn't refuse, and Apple unlocked it. The rest is just a PR move for naive people to keep thinking their Apple phones are secure.
fucking_tragedy 11y ago
This is just to drum up iPhone 6 sales with it's secure enclave ;)
known 11y ago
"Never do anything against conscience even if the state demands it." --Einstein
pasbesoin 11y ago
So, finally, the need for the perception that they can accomplish this on their own outweighed the need for the perception that they can compel this of a third party. Meh
sandra_saltlake 11y ago
Hats Off to John McAffee.
dschiptsov 11y ago
Via over the air OS "upgrade", I suppose?
girkyturkey 11y ago
Now does this mean that iPhones can be hacked? The government has said that in the vast majority of cases it will disclose security vulnerabilities, though in a small handful it doesn't. It would be good for everyone’s security if they disclosed, but they probably won’t
- ctdonath 11y ago
  It means there is a known & exploitable flaw in one security option on one model of phone running one version of an operating system. Given that a government had to hire a computer forensics company to do it, I wouldn't call this a "hack" (a la the difference between a locksmith and a burglar). Apparently there is a law (enacted under the Obama) requiring the disclosure of the cracking technique, at least to the manufacturer, precisely to facilitate improvements in security.
  - PascalsMugger 11y ago
    Does this disclosure requirement apply when the work is contracted to a third party? I have a hard time believing security companies would ever work for the government if doing so required them disclosing the vulnerabilities they use to the manufacturer. If the disclosure is not required of third parties then all such a policy does is incentivizes government agencies to ostensibly farm out such work to compliant security firms. This is how we end up with private firms as extensions of government a la Blackwater. Seems ill advised.
sjreese 11y ago
So, the long-term solution for strong encryption must be a cultural one. We have to be prepared to fight the crypto wars forever, like unions are still fighting the labor wars a century later. Like civil rights activists are fighting racism even today--and will be for the foreseeable future. So true .. and it up to you to continue our peoples struggle. - I've seen this time and time again .. WTC7 was one of those don't believe your eyes. and Now the Gov. lackeys need your info to sell as so-called information brokers to get you special offers. Based on any and all of your actions. ( think supper cookies ) but moved to a mobile platform you! And you if don't want special offers - then you are a terrorist! - and YOU become the focus. Not WTC7 - Waco or that poor man in the US house who forgot he was 2nd admin C&C denied. But did not get a chance to explain - before the cover up started. I support APPLE & Mr. Snowden vs. the FBI/INFORMATION BROKERS on this hope you do as well.
squozzer 11y ago
As much as I dislike its implications, this is the way the case should have gone. Most of us knew the Feds would eventually crack the iPhone - the attempt to deputize Apple in their investigation was a matter of expedience.
jgalt212 11y ago
Yay, now AAPL is free to go back to focusing on evading taxes.

746 points by potshot 11y ago

The case is droppable because it lacks public support. That was clear a month ago. It's an impossible scenario - requiring an engineering effort from a consumer focused company. If Apple wanted to comply, it would have been extraordinarily costly. What's good about the case is that it brought forth a discussion about privacy. This case coupled with the Clinton email scandal should move a few ideas forward developing solutions that wouldn't otherwise have been profitable ventures. Where Lavabit had a very niche market a few years ago, companies thinking along those lines will have success moving forward.

adriancooney 11y ago

Congratulations Apple and encryption. A precedent has be set. The FBI can't just bully companies into complying with their requests. Hopefully companies in future will have the integrity and courage to stand up like Apple did.

JustSomeNobody 11y ago
I'm not so sure the results are as you say.

matt_wulfeck 11y ago

You could say they dropped it because they accessed the phone. You might also say they dropped it because going to court and losing would greatly narrow the scope of the All Writs act. Then the "maybe illegal" spying coersion becomes "actually illegal"

sremani 11y ago
You can also say, your IPhone is not as secure as Apple claims and state actors can break it.
- adevine 11y ago
  It was always known that the 5c, which is the device the FBI accessed, was less secure because it does not contain a Secure Enclave like later iPhones.
- mtgx 11y ago
  Is there anything state actors can't break into? There will always be vulnerabilities to fix. Apple's and other companies' hope is not to fall too many steps behind the state actors.
  - lallysingh 11y ago
    PGP worked well enough for Snowden, right?
    - cookiecaper 11y ago
      Snowden had the element of surprise. They weren't actively trying to monitor his comms because they didn't know he was a risk until after the leaks. If the state wants to decrypt your messages badly enough, they have resources that they can devote to that (as well as multiple side channels that are probably easier than forcibly decrypting, including the infamous "beat with a wrench" trick). It's not trivial to defeat strong encryption, but it is doable given sufficient interest.
      - marvin 11y ago
        Is there any evidence that any actor in the world is (in general) capable of figuring out the contents of e.g. an AES-encrypted message with the key unknown, assuming good opsec and a good implementation? I agree with your statement that state-level actors have strong capabilities, but this seems like a blanket statement which is likely untrue.
        koenigdavidmj 11y ago
        No, and I doubt that this capability would be revealed for something at the level of San Bernardino, or anything short of "ISIS is going to do a WMD attack against Manhattan".
mtgx 11y ago
I would hope the media follows up with "so what did you find out from it?" and don't just leave it to "trust us, we unlocked it".
- fooey 11y ago
  They'll just say "can't comment on an active investigation" if they don't find anything to make the whole thing seem worthwhile.
  - zmmmmm 11y ago
    To which it would be reasonable to ask, "so why did you hold this whole case in public, against Apple's wishes, if it is now so secret you can't even comment on it?"
    - imron 11y ago
      To which they will reply, "we would not have commented on what we found on the device if Apple had been compelled to help us break in to it, and we will not be commenting on what found on the device now" Holding the case in public, and publishing the contents of the phone in public are very different things
      - zmmmmm 11y ago
        > Holding the case in public, and publishing the contents of the phone in public are very different things And saying they "can't comment" as the GP suggested is different to publishing contents of the phone. They could easily comment on whether they found anything or not, whether it had any importance to the case, the nature of what they might have found without revealing specifics. If they do simply say they "can't comment" then we will know they are lying, because because they already did comment, quite voluntarily: they just held a whole court case in public about it which revealed all kinds of gory details. A court case which Apple asked to seal and the FBI said "no, we want this to be public".
  - anigbrowl 11y ago
anigbrowl 11y ago
It'll be easy enough to infer which it is later because if they have actually got data out of the phone then they'll amend the complaint against the co-conspirator(s) with the newly available information.
- bunderbunder 11y ago
  Only if the data is useful. Which is far from guaranteed, as many have pointed out previously.

lisper 11y ago

Told ya. https://news.ycombinator.com/item?id=11199093 https://news.ycombinator.com/item?id=11199093

GuiA 11y ago

Would they be doing anything illegal if they in fact had not been able to unlock the phone, but were saying so to save face?

malchow 11y ago
Yes. AAPL has averred to the judge that they in fact accessed the phone. I was skeptical over the last 72 hrs whether that was a ruse or not. I now think it is not. "The government has now successfully accessed the data stored on Farook's iPhone and therefore no longer requires the assistance from Apple Inc. mandated by Court's Order Compelling Apple Inc. to Assist Agents in Search dated February 16, 2016." The government also gets to use the same logic regarding the power of the court to compel at some time in the future, when this assuredly comes up again.
deleted 11y ago
[deleted]

jamescun 11y ago

This is possibly the worst outcome. The tide of public opinion was turning towards Apple and privacy, and away from the FBI; for it to enter the court under this pretence there was a strong argument to be made against the latter. With this announcement, for the many, this matter will now be "resolved". When it inevitably rears its ugly head again, the same pretence may no longer be true.

mikestew 11y ago
There are a huge number of side effects that would have to be dealt with, but this case has made me think that Apple should have the option to say, "changed your mind? Nooo, that ship (which you, the FBI, built and christened) has sailed, buddy, and you're on board. This is going before a judge, like it or not, and we're doing it now."
- hyperliner 11y ago
  They would have to make a claim against the DoJ. A party (the DoJ) has the right to drop their claim.
- GraemeLion 11y ago
  Except that's not how courts work. Apple is the defendant, the government is the plaintiff. The plaintiff should always have the right to end a case/action. Allowing defendant's to continue cases allows for highly malicious actions to occur.
  - Bud 11y ago
    Oh? It seems to me that in this case, allowing the government to discontinue its trumped-up case is what has allowed the "highly malicious actions".
  - mikestew 11y ago
    Did I not say that there were side effects? :-) I realize this has problems, and I'm not the one to be providing solutions. However, "nuisance lawsuits" are a thing, and this case is probably the poster child. Only instead of "pay me and I'll go away", it's "we'll keep trying until we feel the tide of public opinion turns against us, then we'll pull out and try again...repeatedly." I don't know, just doesn't seem like the way things should work. You either have a case or not, public opinion be damned. So fine, defendant doesn't get to push continuing the case. Then how about FBI doesn't get to try again? Of course, problem there is that the next will be ensured to be just different enough to not fall under whatever regulation or law is set up to deal with such a thing.

chii 11y ago

I feel like cases shouldn't be droppable unless both parties mutually agree, and the courts also must first agree.the courts should not agree if it's a case that could set a precedent that can have far reaching implications. What if next time, a smaller player than Apple was caught in this sort of case, and they can't fight back as easily? Then it'd be easier to setup a precedent favourable to one party. This seems like a way to legally manipulate the common laws, and I think courts should put in place measures to prevent such manipulation.

thecosas 11y ago
Cover Apple's legal fees maybe? Argument for damage to Apple's reputation, etc? Pretty sure Apple doesn't want either of those things.
nostrademons 11y ago
Big companies can still buy little companies to take on their lawsuits, or they can provide funding & resources to fight a legal battle as part of an investment. I suspect that Google bought YouTube in part to avoid precisely this situation. If Viacom had won their lawsuit against YouTube, it would have endangered Google's core business: they would become liable not just for copyrighted material that they know about, but any copyrighted material on their servers, which encompasses the whole web. So they pay $1.6B for a tiny startup and a big lawsuit, and then use their full legal resources to fight (and eventually win) the lawsuit. (There is possibly an interesting get-rich-quick hack in there: do something in a legal grey area that lots of big companies are doing too, as part of their core business, and then get sued. It is then in the big company's interest to acquire you and fight your legal battles, lest they get put out of business by an unfavorable precedent. You're playing with fire in this case, though, since if the big company doesn't come to your aid you have a multi-hundred-billion dollar lawsuit hanging over you.)
- blademan88 11y ago
  You wouldn't get-rich-quick... you'd agree to a buyout with horrible terms since you'd have zero bargaining power given the circumstances.

bradhe 11y ago

This claim seems dubious at best. There's no proof that they got access, and it's in their best interest to claim they did. On one hand, I'm not totally sure we should assume that they're not capable of gaining access to iPhones willy-nilly. On the other hand, I'm re-evaluating my security posture...

GraemeLion 11y ago
Apple has, as part of the case, admitted that data access was obtained by the FBI. Unless they're in on it too, of course.
r00fus 11y ago
Why would it be dubious? It's an older phone without a secure enclave - that's subject to the NAND mirroring trick. Then again, why can't Apple sue Cellebrite under the DMCA for bypassing their security?
molecule 11y ago
> This claim seems dubious at best. There's no proof that they got access, and it's in their best interest to claim they did. Wouldn't that be perjury? https://www.documentcloud.org/documents/2778264-Apple-Status-Report.html#document/p1/a285980 https://www.documentcloud.org/documents/2778264-Apple-Status...
- imron 11y ago
  Sure, but what's a little perjury between government officials: http://www.salon.com/2013/06/12/how_james_clapper_will_get_away_with_perjury/ http://www.salon.com/2013/06/12/how_james_clapper_will_get_a...
  - fncypants 11y ago
    Lying to an indifferent, disagreeable, and dysfunctional legislature is one thing. Lying directly to a federal judge with contempt power is how one ends up in jail before packing up your suitcase and walking out the courtroom.

downandout 11y ago

I would treat this claim with a great deal of skepticism. However, this is by far the smartest play for the government. Had they gone to court and lost (probably after an appeal), they would have set a precedent that would be very problematic for them going forward. By claiming this, falsely or otherwise, they hurt Apple's security reputation (most consumers will not understand or care that this happens to be an old iPhone with an old version of iOS - they will just hear or read that an iPhone was cracked), and they avoided a potentially problematic legal outcome. The DOJ came out on top here, whether they are lying or not.

snarkyturtle 11y ago
But they needed to get third-party help in order to access the phone, just by suing Apple they seem like they're incompetent at their jobs...
- partycoder 11y ago
  They are competent as they solved the problem.
- nickff 11y ago
  On the other hand, many smaller companies could not have afforded to take this dispute as far as Apple did, so the FBI proved they were willing and able to cause significant final injury to anyone trying to protect their users' privacy. One could look at this case as proof of the ability for the FBI to extort information and cooperation.
mcphage 11y ago
Maybe, but they didn't actually accomplish any of their real goals—making it easy to force Apple to break their security. This particular phone is immaterial, and Apple can always talk big later about how they patched any of the security holes that the government used, to recover face.
- downandout 11y ago
  >Maybe, but they didn't actually accomplish any of their real goals—making it easy to force Apple to break their security Unless one of their real goals was to get the conversation going about creating new laws that would make uncrackable products illegal, without actually testing the limits of existing laws. Because that is what they achieved. > This particular phone is immaterial, and Apple can always talk big later about how they patched any of the security holes that the government used, to recover face. That is a nuanced understanding of this issue that most consumers simply do not and will not have. Most will hear nothing other than "the feds can now crack iPhones" and will assume that government will be able to beat any future improvements too.

pavornyoh 11y ago

Can Apple counter sue for them to reveal how they accessed the phone? Surely, there must be a loophole in there somehow...

GraemeLion 11y ago
Nope. The government does not have to disclose investigative techniques. If Apple wanted to help the government, they could have, but they chose not to take that tact. Expecting the government to help Apple now is folly.
- koenigdavidmj 11y ago
  Until the next case comes in, where the FBI says that what they tried last time didn't work.
- pavornyoh 11y ago
  What about Cellebrite thus www.cellebrite.com. This article seems to suggest it is them - http://gizmodo.com/the-company-helping-unlock-the-san-bernardino-iphone-ha-1766641607 http://gizmodo.com/the-company-helping-unlock-the-san-bernar...
  - GraemeLion 11y ago
    Why would the company used have any responsbility? Remember, the phone is owned by San Bernadino county. They wanted it cracked. The holder was the San Bernadino Sherrifs', they want it cracked. The FBI wants it cracked. The judge issued a warrant covering the data on it, and then the all writs act compelling companies to assist if they can. Apple could not. Cellebrite could. I get what you're saying, but this is having your cake and eating it too. Apple chose not to assist. The FBI found someone who could. Why would that company then have to disclose to, basically, a third party (even a third party inventor of the phone) their standard work product and trade secrets?
- tucif 11y ago
  Would it be possible to make a FOIA request?

scarmig 11y ago

This is a legally naive question, but how does this not run afoul of the Computer Fraud and Abuse Act? Particularly, how isn't this some violation of section a2 ("intentionally accesses a computer without authorization or exceeds authorized access," the same thing that got Aaron Swartz indicted)? Is it basically, since the feds had a warrant, they can do whatever they want? (And if they don't have a warrant, is it still legal?)

fooey 11y ago
If no prosecutor would ever touch it, is it really illegal?
GraemeLion 11y ago
There was an active warrant allowing it.
pfg 11y ago
There are laws against breaking into people's homes, and yet the police still does it daily. IANAL, but I assume a warrant would apply to this case just the same.
dgacmu 11y ago
Most of the time, people can't kick down your front door, search your house, and pack up a bunch of your possessions without your permission. Start digging here - https://en.wikipedia.org/wiki/Police_power_(United_States_constitutional_law) https://en.wikipedia.org/wiki/Police_power_(United_States_co... There are really a few sub-questions: Is it legal, and are the results admissible as evidence? Whether or not it's legal depends on the circumstances. There are many cases in which the police can search something, e.g., if they believe it's critical to prevent an immediate threat. Whether or not it's admissible is more thorny, and something that's still being fought out in the courts. (google: warrantless cell phone search admissible)
GCA10 11y ago
The phone belonged to San Bernardino County, which was quite happy to have the FBI get to work on it. Syed Farook had been authorized to use the phone, but only under the county's terms. If it had been Farook's phone, and if his surviving relatives asserted some claim, that might have made matters a little trickier. But in this case, Farook is dead. He never owned the phone. The organization that did own the phone wants the FBI to crack it, for easily understandable reasons. On ownership, at least, the facts are unusually friendly to the FBI.

RichieAHB 11y ago

While the claim about accessing the iPhone seems difficult to substantiate, the suggestion that the FBI have dropped the case seems likely. The fact that they can drop the case in this instance, when the wheels had started to come off, smacks of having their cake and eating. Let's hope the next case where they try to get the ball rolling towards the dangerous precedent they are looking to set yields a similar outcry as this one.

fucking_tragedy 11y ago

Reminder that the FBI used the deaths of 14 people to prop up their agenda of 'make the invoices we receive cheaper'. They chose this case and not any of the dozens of similar investigations mentioned in articles that have come out since. It's a disgrace to the victims, their families and friends. It's also a disgrace to the public, trying to scare us into complacency.

cmurf 11y ago
OK. But what does it say about the scant majority of the country that at least tacitly (through polls) supported the FBI in this? I think this whole thing is every bit as much a trial balloon to see how the public accepts the various arguments. And I think that's still unclear. The polls suggest a scant majority supported the FBI, but not enough to get Congress to change the law make it clear companies can be rolled over by the government. That means there will be a next time.

a3n 11y ago

I wonder what the government's obligation is to Apple, to let them know the nature of the vulnerability.

GraemeLion 11y ago
None.
cmurf 11y ago
Legally none. Ethically? I think it's worth debating what sort of public trust should be granted to government that sits on an exploit. But it also requires knowing how they did it. I think most likely they copied the flash, started iterating passcodes, and then reflashed the phone everytime they ran out of attempts. That's sufficiently obvious (to me anyway) that it's not much of an exploit worth documenting and also there's no software fix for such a thing. You'd need to put the passcode attempt counter on some separate piece of hardware that either can't be externally read or reflashed.
nacs 11y ago
I'm sure Apple already knows how they are doing it. The tech that FBI is claiming to have cracked is the iPhone 5C which does not have the Secure Enclave hardware that all later iPhones do and which are far more of an actual challenge to crack.

johnhattan 11y ago

Am I thinking right when it seems to me like the feds are kicking the can down the road? Even though the feds found an exploit that allows 'em to decrypt the current iOS, Apple's response is undoubtedly gonna be much-improved security in the next version. So in a few years when the feds demand that an iOS 10.x device be decrypted, this whole pageant will start over again.

mcphage 11y ago
> Am I thinking right when it seems to me like the feds are kicking the can down the road? Yes, but who knows when they'll ever get this good a case again?

Johnny555 11y ago

I wish Apple would be able to recoup their legal costs from the DoJ -- the government shouldn't be allowed to force a company to spend money on defending their rights (using our "unlimited" tax dollars to do so), only to drop the case at the last minute making the entire case moot. Apple should be able to recover their legal costs.

GraemeLion 11y ago
Somewhat agree, but Apple DID have a court order they were fighting. They did choose to fight this legally adjudicated and issued order. The owner of the phone and the law enforcement both wanted the phone decrypted. FWIW, I agree that privacy is ignored and should be respected, but apple chose this fight. I'm glad they did, but they knew it would cost them.
- Johnny555 11y ago
  And the DoJ stopped fighting. If the DoJ ultimately won the case, then it's fair that Apple should have to pay their legal costs. But since using a 200 year old law to force Apple to do work they don't want to do was a legal stretch, if the DoJ lost the case then again I'd say the DoJ should pay Apple's legal costs.
  - teacup50 11y ago
    The law in question was passed the same week that congress submitted the fourth amendment. Please stop parroting "200 year old law".
    - Johnny555 11y ago
      Oh, you mean in 1789, 227 years ago?
      - teacup50 11y ago
        Yes. The same week that the fourth amendment -- which is what provides us with strong protection against unreasonable search and seizure -- was approved by Congress. Or do you refer to that as a stale 200 year old law, too?

cmurf 11y ago

Who wants to take bets on how? My bet is they copied the flash, and are iterating passcode guesses until it slows down too much (or implodes, however it's configured) and then they reflash and iterate again. And it was only a 4 digit passcode, so it was pretty easy to do this. The next bet is whether they find anything relevant? My bet is no. Next bet after that is whether they admit it? My bet is they won't. But the more important one is if they tell Apple or open a CVE for the exploit they used if it's not a flash and guess technique they used? Is it ethical for FBI to sit on an exploit?

airza 11y ago
that's not how the security enclave works as far as i know, you can't copy that part off and so you can't copy off + bruteforce the drive?
- HappyTypist 11y ago
  You can't copy that part off to another device but you can reflashing the chip on the device.
- askldfhjkasfhd 11y ago
  I don't think the iPhone in question was of a generation that had the security enclave, was it?
- icebraining 11y ago
  From what I understand, the iPhone in question is an older model, without the secure enclave.
  - TazeTSchnitzel 11y ago
    The person in question had an iPhone 5C, which is very similar internally to an iPhone 5, and it doesn't have the Secure Enclave because it lacks Touch ID. The 5's successor, iPhone 5S, has it, I think.
- mikeash 11y ago

partiallypro 11y ago

Who wants to be there was absolutely nothing on the phone of value for the intelligence community? It's like the Reddit "what's in the safe" threads. I just wonder what methods they used, I think it'd be pretty interesting to learn just the general strategy, as I assume they would never tell how exactly they did it.

personjerry 11y ago

I suspect they didn't actually crack it. I think it's likely that they just realized the losing battle they were fighting. It sounded like a lot of public sentiment was against the FBI and they were unlikely to win the case (and it seemed like the information wasn't vital to them anyway) so they just gave an excuse to drop the case. This has an additional benefit: rather than having the "boundaries" here be defined by a ruling, now in theory they have more time to work in a "gray area".

Alex3917 11y ago
They may also be saving their political capital to indict Hillary.
omonra 11y ago
I'm not sure about public sentiment - have you seen polls about it? My take is that HN crowd is completely unrepresentative vis-a-vis the opinion of majority on this issue.
- personjerry 11y ago
  You may be right; I have not. I had read that most of the big companies like Facebook and Microsoft, at least, were against the FBI on this issue so that is more of what I meant by "public" sentiment, although now thinking about it, that means I've made a much less compelling argument.

dustinpkane 11y ago

How do we think they did this? Probably copied phone's memory and implemented a way to restore the state of the phone, then brute force try passcodes? I guess that could take only a week if they had only a 4 digit passcode.

imron 11y ago

> Government agencies are now able at least to break into handsets which don’t yet have the latest software upgrades. Surely that should be latest hardware upgrades. The latest software upgrades are no good if not backed up by the secure enclave.

cwills 11y ago

Hard to verify. Perhaps if the FBI or other law enforcement continue to use the supposed vulnerability - eventually information obtained from a breached iPhone will appear in court as evidence..

vinhboy 11y ago

I wonder which security group helped the FBI. There must be another whole world of, government friendly, security researchers I don't hear about.

shalmanese 11y ago

The FBIs motives have always been nakedly transparent in this case. They had no interest in the specific phone, they wanted to use it as a wedge issue to force a precedent. Once they figured out this avenue was a bust, they withdrew to find a different angle. Since everything is classified anyway, it's irrelevant if they actually cracked the phone or not but if they did, it was probably by buying an exploit from the NSA TAO store [1]. [1] https://en.m.wikipedia.org/wiki/NSA_ANT_catalog https://en.m.wikipedia.org/wiki/NSA_ANT_catalog

HoppedUpMenace 11y ago

Just a random thought: Isn't it quite an interesting coincidence that they found a way into the iPhone just as people were reporting problems with iOS 9.3?

JustSomeNobody 11y ago
Coincidence. But not very interesting. I think.
HoppedUpMenace 11y ago
It would appear random thoughts are not entertained here lol.

snowwrestler 11y ago

I'm seeing a lot of comments to the effect that the government will just try again at some point. Well, welcome to life in a democracy. Nothing is ever settled with finality because there are plenty of ways for future generations to change the laws we cherish today--for good or ill. We could revoke the 13th and 14th Amendments and have slavery again--there is no legal impediment to that. That we don't do that is a reflection of our cultural values--today--which we continually discuss and reinforce. We could abolish the EPA, or the IRS, or the NSA. We don't because these have enough supporters who value what they do, today. The 2nd Amendment remains strong today because millions of Americans work every day to keep it that way. So, the long-term solution for strong encryption must be a cultural one. We have to be prepared to fight the crypto wars forever, like unions are still fighting the labor wars a century later. Like civil rights activists are fighting racism even today--and will be for the foreseeable future. Is that depressing? Not to me; I find it inspiring, much better than a world in which government decisions are truly final. Beware that level of power IMO.

syshax 11y ago
>We could revoke the 13th and 14th Amendments and have slavery again--there is no legal impediment to that. Actually, I think this is the genius of the amendment system. You are correct that it could happen. But unlike laws that can be passed or revoked by Congress by political whim, the barrier to creating or overturning Constitutional amendments is much higher and more difficult to pass.
- studentrob 11y ago
  Plus the point of our system is to allow both good and bad ideas to be discussed openly so everyone can decide their merits. We haven't seen the likes of Trump since Nixon, and he won't be the last, but we are stronger for giving him room to speak. The bad ideas will hang themselves, even if he becomes president. The US president is not all powerful. There are many limits in place.
  - EdHominem 11y ago

JustSomeNobody 11y ago

Can't wait to find out what they found on it.

remarkEon 11y ago

If true, what's the significance of that speculation that it was an Israeli contractor that built this? Who gets access to this hack?

BackPropagate 11y ago
There is no "significance".

jrbapna 11y ago

Was I the only one who assumed the DOJ could unlock the phone for a while now, but instead chose to legally force Apple to do it to set a precedence? This news almost seems like a win for Apple; if there was a good chance that the DOJ would have won the case, they probably would have pursued it till the end.

xufi 11y ago

As expected. The FBi just wanted some media attention as far as I believe it to be

spdustin 11y ago

Is there any avenue for Apple to begin legal action against the US Gov't for hacking the phone, in order to shine a light on the truth of how the phone was "hacked"?

p01926 11y ago

It stinks that the case ended like this — without setting a sensible precedent — but I think there is still some upside: FBI director Comey's "Going Dark" narrative no longer holds water with anyone who's paying attention. He cried wolf so loud he's been heard on every continent. If and when he tries this again, he'll get a ton more blowback. Similarly, Obama's jibes about security "absolutism" now appear ridiculous. As are his criticism of impenetrable black boxes protecting child molesters. What he really wants is for the Emmental-like extensions of our brains to have even more holes. That's an obviously un-winnable argument. Also, the bar for proving you've tried all possible alternatives for gaining access just got a lot higher in applying the All Writs Act. It took three months plus a month of major international news stories specifically about this court case to gain entry — something that might really be impossible to achieve next time. But now everyone knows when they swore under oath many times in multiple public venues that they couldn't gain access, what they really meant was "not yet" and not "it's impossible". Finally, Apple should now be motivated to remove themselves as the weak link in their security ecosystem. System updates shouldn't be possible without first wiping the information needed to derive the encryption key or first supplying that key. I can also dream about them open sourcing their code to allow security researchers to bug hunt (an impossible dream). And maybe they'll change their minds on bug bounties. Whatever happens, it's now beyond doubt that foreign entities are exploiting vulnerabilities in the iPhone and we all expect Apple to beef up their security accordingly — regardless of how this may hinder law enforcement.

thegayngler 11y ago

Is it true that Apple doesn't pay people to hack their products so they can patch up their security holes.

free2rhyme214 11y ago

The only thing this title tells me is that the iPhone 5C is not secure anymore. Thoughts?

fabulist 11y ago
One shouldn't expect much of anything to remain secure if an organization with the resources of the FBI has physical possession of it.

free2rhyme214 11y ago

The only thing this title tells me is that the iPhone 5C is not secure anymore. Thoughts?

mtgx 11y ago

If it only worked this once, why not declassify it? http://money.cnn.com/2016/03/28/news/companies/fbi-apple-iphone-case-cracked/index.html http://money.cnn.com/2016/03/28/news/companies/fbi-apple-iph...

joering2 11y ago

Hats off to John McAfee!

nodesocket 11y ago

The reality is that the FBI accessed it, so they no longer required Apple's help. "The Justice Department said Monday it has accessed data on the iPhone used by a shooter in last year's San Bernardino, California, attacks and no longer needs Apple's help in cracking it." Apparently a 3rd party from Israel (http://www.cellebrite.com/ http://www.cellebrite.com/) helped the FBI which begs the question, how did they do it? Do they have universal access to all iOS devices or just this particular device? This really makes me start to think there is a backdoor.

TazeTSchnitzel 11y ago
One suggestion I heard was to reset the state of the NAND constantly to evade the PIN input limit.
nobodyshere 11y ago
I think they (apple) might send a specially prepared iPhone undercover with some verbose logging enabled and ask to have it cracked by such a company, and try to locate the breach.
nobodyshere 11y ago
I think they (apple) might send a specially prepared iPhone undercover with some verbose logging enabled and ask to have it cracked by such a company, and try to locate the breach.

f_allwein 11y ago

fwiw, John McAffee has said that he can decrypt the iPhone: http://www.siliconbeat.com/2016/02/18/102312/ http://www.siliconbeat.com/2016/02/18/102312/

billhendricksjr 11y ago

I promise I don't wear a tin foil hat, but it would be great if they proved that they did access it. The cynic in me wonders if they're tapping out because they didn't want to lose in court and set a precedent they don't like.

sinak 11y ago

While this case might have ended, but the battle isn't over yet. Via Matthew Keys on Twitter: "There are 6 other cases where Apple is still fighting the DOJ re: unlocking phones" https://twitter.com/matthewkeyslive/status/714583232117755904 https://twitter.com/matthewkeyslive/status/71458323211775590... ^ Link includes an image with 7 other cases where Apple has either objected to warrants, 2 that are still in process. The most interesting one is the last, which involves an iPhone 6+ running iOS 9.1. It's not yet clear whether the zero day that allowed the government to access the San Bernardino phone also works on the iPhone 6, which has a secure enclave (unlike the San Bernardino phone). There are some other iPhone 6 and iPhone 5S devices in the list too running older versions of iOS.

davesque 11y ago

I'm a little worried now about how long it will be before they come back and claim that there was some critical piece of evidence on the phone and start saying how evil Apple is for not wanting to cooperate because what are they, freedom haters?

stephensurh 11y ago

This doesn't really mean anything. The question is: Does Apple have the right to make an uncrackable phone? We have no resolution on that issue: Only the knowledge that the iPhone 5s is not such a phone.

terminado 11y ago
Hmmm, well, what metaphysical Right does the action of creating such a phone fall under, philosophically speaking? Which broader Right is this specific activity a representation of? What does the act of fabricating a secret keeper mean, and does a company gain rights, or are the rights of some set of individuals collectively conferred upon the company by default? Would making a different object, such as a gun, alter said rights? Pretty sure the constitution says Apple can proceed without interference, but these are questions worth contemplating.

Negative1 11y ago

Woah, wait a minute. By purposely bypassing security restrictions present on the device via some sort of exploit isn't the FBI violating the iPhone terms of use? Could Apple theoretically sue them for doing this (and most importantly, for not sharing _how_ they did this)?

philovivero 11y ago
As I understand it, one is not allowed to sue the government unless the government gives you permission first. I don't know if there are any limitations around this other than public opinion. But I suspect if Apple attempted this, the FBI would just say they're not allowed to sue.

awqrre 11y ago

Could some random party bring that lawsuit back to court on "behalf" of the FBI without the FBI's approval?

jameshart 11y ago

So in the last week, a lot of media reports around the Brussels attacks have focused on how, in the immediate aftermath of the arrest of an alleged Paris conspirator, the Belgian authorities were premature in announcing that they were learning information about his co-conspirators, which caused those people to bring forward their attack plans. Now, the FBI has just announced to the world that any information locked up in the San Bernardino iPhone is now in their hands. Presumably any co-conspirators who thought their contact details might be in that phone are now aware of that. Now, on the other hand, for the past month or so, the FBI has on the contrary been doing a very good job of informing the world, with to some extent Apple's help, that they did not have access to the information in that phone. That may have served to reassure those same conspirators that the FBI was not onto them.. When perhaps they had actually cracked the phone some time ago, and were in fact in the process of employing that intelligence. Too charitable to suspect the FBI of having pulled that off?

TazeTSchnitzel 11y ago
AFAIK didn't the San Bernadino person not use their work phone for this? The iPhone the FBI wanted into was their work phone, already Government-controlled. Not their burner phone, which was destroyed.
- jameshart 11y ago
  As far as you know. Now consider that the FBI statements about what evidence they gathered from San Bernardino (evidence which is largely not part of a criminal prosecution so not subject to defense discovery) as part of a vector of information which the FBI might choose to manipulate to better enable their ability to exploit the intelligence they have. So what do you really know about work phones and burner phones?

frabbit 11y ago

Meh. If any of this exposes anything, it is that you do not want your secrets to rest in anyone's hands but your own. Apple may/may-not have managed to protect their keys, but there is no guarantee that is the case. Meanwhile Joe Public comes away with the idea Apple==SafeEncryption. If this were some new encrypted messaging service we'd all be ripping the shit out of it just on this basis.

karmacondon 11y ago

So what happens to the other 200+ iphones that law enforcement needed opened? It seems like there are at least certain iphones that can be opened using this method and similar hardware based approaches. Are the feds going to move forward with that? It seems like accessing this particular phone wasn't trivial or cheap. So I'd imagine that it will come down to whether or not it's "worth" the cost of flashing individual chips for each of the other devices. And what happens if there is potentially exonerating evidence on one of those phones? Does the defense team have to come up with the money to pay for a lab or outside company to open the phone? And also, is an encrypted phone going to be the new 'dna evidence'? Like, will a brand new iphone that's linked to a major crime be held away for years until the security community can hack it, potentially setting people free or sending them to jail? Sorry for all the interrogatives. Even though this particular case has been settled, there are still a lot of questions surrounding default device level encryption.

drallison 11y ago

So, the US DOJ has in hand an exploit which allows them to access protected data on an iPhone, access that Apple and the phone's designers clearly did not intend to be allowed. Ethical behavior would have the US DOJ describe the exploit to Apple immediately so that the flaw in the system can be repaired. Publishing the exploit in publicly available documents would speed Apple's efforts to repair the fault.

thesimon 11y ago
But that would help the terrorists !1 /s

mzarate06 11y ago

One question I'm not seeing often ... From here, what's stopping the FBI from claiming they found X, Y, and Z on the phone, and further claiming they were all important pieces of evidence, that could possibly have prevented the attack, etc., etc., when they really didn't? Then, use that to bolster their arguments against encryption and privacy? What means will keep them honest about what they did or did not find?

Grue3 11y ago

Here's what really happened: they made Apple the offer they couldn't refuse, and Apple unlocked it. The rest is just a PR move for naive people to keep thinking their Apple phones are secure.

fucking_tragedy 11y ago

This is just to drum up iPhone 6 sales with it's secure enclave ;)

known 11y ago

"Never do anything against conscience even if the state demands it." --Einstein

pasbesoin 11y ago

So, finally, the need for the perception that they can accomplish this on their own outweighed the need for the perception that they can compel this of a third party. Meh

sandra_saltlake 11y ago

Hats Off to John McAffee.

dschiptsov 11y ago

Via over the air OS "upgrade", I suppose?

girkyturkey 11y ago

Now does this mean that iPhones can be hacked? The government has said that in the vast majority of cases it will disclose security vulnerabilities, though in a small handful it doesn't. It would be good for everyone’s security if they disclosed, but they probably won’t

ctdonath 11y ago
It means there is a known & exploitable flaw in one security option on one model of phone running one version of an operating system. Given that a government had to hire a computer forensics company to do it, I wouldn't call this a "hack" (a la the difference between a locksmith and a burglar). Apparently there is a law (enacted under the Obama) requiring the disclosure of the cracking technique, at least to the manufacturer, precisely to facilitate improvements in security.
- PascalsMugger 11y ago
  Does this disclosure requirement apply when the work is contracted to a third party? I have a hard time believing security companies would ever work for the government if doing so required them disclosing the vulnerabilities they use to the manufacturer. If the disclosure is not required of third parties then all such a policy does is incentivizes government agencies to ostensibly farm out such work to compliant security firms. This is how we end up with private firms as extensions of government a la Blackwater. Seems ill advised.

sjreese 11y ago

So, the long-term solution for strong encryption must be a cultural one. We have to be prepared to fight the crypto wars forever, like unions are still fighting the labor wars a century later. Like civil rights activists are fighting racism even today--and will be for the foreseeable future. So true .. and it up to you to continue our peoples struggle. - I've seen this time and time again .. WTC7 was one of those don't believe your eyes. and Now the Gov. lackeys need your info to sell as so-called information brokers to get you special offers. Based on any and all of your actions. ( think supper cookies ) but moved to a mobile platform you! And you if don't want special offers - then you are a terrorist! - and YOU become the focus. Not WTC7 - Waco or that poor man in the US house who forgot he was 2nd admin C&C denied. But did not get a chance to explain - before the cover up started. I support APPLE & Mr. Snowden vs. the FBI/INFORMATION BROKERS on this hope you do as well.

squozzer 11y ago

As much as I dislike its implications, this is the way the case should have gone. Most of us knew the Feds would eventually crack the iPhone - the attempt to deputize Apple in their investigation was a matter of expedience.

jgalt212 11y ago

Yay, now AAPL is free to go back to focusing on evading taxes.