28 ms·

FBI agrees to unlock iPhone for Arkansas prosecutor

290 points by noarchy 11y ago

SixSigma 11y ago
At least it is in the Zeitgeist now, these kind of stories will be around for a while.
ihsw 11y ago
The technique used will be passed on down to anyone that the FBI deems fit, be it public or private. There is no oversight or limitations. Complete and total lack of justification. There's a word for this -- corruption.
- einarvollset 11y ago
  I don't think that word means what you think it means. Would it have pleased you more if, oh let's just for the sake of argument say: the government had to get some kind of a court order to get the information?
  - bhickey 11y ago
    Well, the grandparent did say "There is no oversight or limitations." So, yeah. I believe it would please 'em more if there was a court order involved.
    - einarvollset 11y ago
      Sorry. Sarcasm doesn't come across well: there is a court order, but because Apple decided to not help, they were removed from the oversight chain, hence arguably weakening the oversight.
      - marcoperaza 11y ago
        If the government gets a search warrant and seizes a safe from your home, they don't need the safe-maker's permission to crack it open.
        teacup50 11y ago
        They would if the safe was purely digital, based on vendor-controlled platform DRM that granted the vendor and only the vendor additional access to the safe.
      - Avenger42 11y ago
        Note that the FBI got the court order in a hearing to which Apple was not invited. The court gave Apple an opportunity to respond, and it was in the middle of that process when the FBI found another way in. It's not like the court told Apple "you need to immediately start working on this" and Apple said "no, we refuse".
  - bediger4000 11y ago
    Yes, as long as there was a public, adversarial argument about it, not some classified, logic-bending "memo" from a lawyer, or some one-sided star chamber FISA "court" order.
- marcoperaza 11y ago
  There is oversight and limitations. The government still needs a search warrant or legal ownership of a device in order to hack it. You're perfectly entitled to make your stuff harder to search, but once the government has a court order or warrant for the info, they're entitled to all the hacking they need to extract the data. Stop and think for a minute about what you're proposing, that the government need to now get a second search warrant for the removal of encryption. That's absolutely ridiculous. If they seize a safe from your home, they don't need special permission to crack it open.
  - ihsw 11y ago
    They don't need a search warrant. https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction Once it is in their possession, for whatever cheap and loose justification, they will open it. Your argument is under the assumption that they are not corrupt.
    - akie 11y ago
      'Corrupt' has a very specific meaning. It does not mean 'without morals', 'bad', or 'evil'. Whether or not the police or FBI will unlock this iPhone is most likely completely unrelated to whether or not they are corrupt.
matheweis 11y ago
... this also severely contradicts the narrative we were fed about "it's just this one phone, for, you know, TERRORISM".
- einarvollset 11y ago
  No it does not. Govt never claimed this. What it does is show that, the FBI will do exactly what the Chinese are currently most likely doing if need be.
  - matheweis 11y ago
    You are correct that they did not explicitly say this, however I do believe they - through Director James Comey's statements, strongly implied this: The San Bernardino litigation isn't about trying to set a precedent or send any kind of message... We simply want the chance, with a search warrant, to try to guess the terrorist's passcode without the phone essentially self-destructing and without it taking a decade to guess correctly. That's it. We don't want to break anyone's encryption or set a master key loose on the land. https://www.lawfareblog.com/we-could-not-look-survivors-eye-if-we-did-not-follow-lead https://www.lawfareblog.com/we-could-not-look-survivors-eye-...
    - teacup50 11y ago
      The precedent of "search warrants" already existed. They weren't creating it.
  - bediger4000 11y ago
    FBI Director James Comey claimed that unlocking this phone was really really about Terrorism: "So I hope folks will remember what terrorists did to innocent Americans at a San Bernardino office gathering and why the FBI simply must do all we can under the law to investigate that." (https://www.lawfareblog.com/we-could-not-look-survivors-eye-if-we-did-not-follow-lead https://www.lawfareblog.com/we-could-not-look-survivors-eye-...) It's possible, by some weird John Yoo-style contorted reading of the facts to say "FBI Director Comey said that, the US Government didn't say 'because terrorism'". That contorted reasoning would amount to lying by splitting hairs. Don't lie by splitting hairs.
hackuser 11y ago
Remember that the FBI said that if Apple provided a solution, it would not be used in other cases and that they were [Edit: not] going to use it as a precedent (IIRC the details).
- marcoperaza 11y ago
  >Remember that the FBI said that if Apple provided a solution, it would not be used in other cases and that they were going to use it as a precedent (IIRC the details). That's not what they said. What they said is that each particular case is about unlocking each particular phone. And mind you, these are phones that the government has every right to access if they can find a way, either because they have search warrants or are the legal owners (or have the permission of the legal owners) of the phone. There is nothing controversial about this. The government has used vulnerabilities to extract info from devices gathered during legal searches for a long time. If they seize a safe from your home, they don't need special permission to crack it open. The government still needs a search warrant or legal ownership of a device in order to perform a search. You're perfectly entitled to make your stuff harder to search, and they're entitled to all the hacking they need to extract the data.
  - hackuser 11y ago
    > What they said is that each particular case is about unlocking each particular phone. The FBI may have said that, but it doesn't really address the issues substantively and I think they said much more: Remember Apple argued that a solution they provided for one phone would be used for others, and a court decision could be precedent for other cases. The FBI disagreed; I don't remember the details of what they said, however. > these are phones that the government has every right to access if they can find a way I agree, but that's not the issue here. The issue is the FBI's apparent attempt to deceive the public and the courts.
    - teacup50 11y ago
      You're seriously distorting the truth here, not the FBI. The FBI said Apple could maintain control over any tools they made. Apple said "oh noes, we can't ever make a master key [but don't look behind the curtain, where you'll find that we have a master key or three, which is why we can make one in the first place]" Then the FBI found an alternative solution that doesn't require Apple's assistance, making the whole damn conversation moot -- including whether they'd use Apple's hypothetical "master key" on other phones.
droithomme 11y ago
Fairly obvious that no actionable information is being discovered on these phones.
- einarvollset 11y ago
  How so?
  - bediger4000 11y ago
    First, the San Bernadino shooters destroyed a lot of other computers/phones/disks - yet they left that iPhone unscathed (http://abcnews.go.com/US/san-bernardino-shooters-destroy-phones-hard-drives-sources/story?id=35570286 http://abcnews.go.com/US/san-bernardino-shooters-destroy-pho...). It was also a phone provided by Farook's employer. Unless Farook was a big dope, he used it for work stuff only. Since nobody got wind of the crimes before they happened, Farook was evidently Not a Dope. Third, the FBI has had access to iCloud backups from that device (http://www.latimes.com/business/la-fi-tn-apple-fbi-call-20160219-story.html http://www.latimes.com/business/la-fi-tn-apple-fbi-call-2016...), apparently the iCloud password was changed as part of accessing the backup data. The changed iCloud password is what caused the FBI to not be able to access the phone directly. So, I think we can be reasonably sure that no info of value will come off that phone. It's possible, but it seems unlikely.
    - einarvollset 11y ago
      So are you arguing that the police should not explore all reasonable sources of information when investigating a crime? You know, just sample a few and then if nothing comes up, just infer that everything is kosher?
      - bediger4000 11y ago
        Dude... you were the one that asked "How so?" in response to a statement that nothing of value would be recovered from the iPhone that the FBI was using as a means of creating a precedent. I gave you the "how so" reasons, I didn't say anything about not exploring reasonable sources of information. If FBI investigative time is a scarce resource, I would expect them to prioritize the sources of information, putting "less likely to yeild results" lower in the prioritized list. I would also expect them to stop investigating the material way down on the priority list if the material high on the priority list had yielded results.
molecule 11y ago
LA Times is reporting that the phone is an iPhone 6 > The FBI has agreed to help prosecutors gain access to an iPhone 6 and an iPod that might hold evidence in an Arkansas murder trial, just days after the agency managed to hack an iPhone linked to the San Bernardino terror attacks, a local prosecutor said Wednesday. http://www.latimes.com/local/lanow/la-me-ln-arkansas-fbi-phone-access-20160330-story.html http://www.latimes.com/local/lanow/la-me-ln-arkansas-fbi-pho...
- Pwngea 11y ago
  IIRC, didn't the unlock in the San Bernardino case use an exploit(s) specific to the 5C or something? Also IIRC the iPhone 6 has some sort of hardware-level protection against this.
  - bobbles 11y ago
    The FBIs request to Apple was for a specific to that 5c device 'hack' but they never released the details of what they actually did to get into it
  - plorg 11y ago
    Anything you may have heard is almost certainly speculation. It seems pretty likely that a particular Israeli company supplied the FBI with an exploit, but no one has said anything about that exploit being specific to the 5c. Even Apple does not seem to know what the exploit was, as they are pursuing legal options (or dropping hints to that effect) to compel the FBI to reveal it to them.
    - taspeotis 11y ago
      > no one has said anything about that exploit being specific to the 5c. Cellebrite describes [1] the solution as working for iOS 8.x on the following devices: > Cellebrite's unlocking capability supports the following devices: iPhone 4S / 5 / 5C, iPad 2 / 3G / 4G,iPad mini 1G, and iPod touch 5G running iOS 8 ... [1] http://www.cellebrite.com/Pages/cellebrite-solution-for-locked-apple-devices-running-ios-8x http://www.cellebrite.com/Pages/cellebrite-solution-for-lock...
dang 11y ago
Url changed from http://techcrunch.com/2016/03/30/sure-why-not-fbi-agrees-to-unlock-iphone-for-arkansas-prosecutor/ http://techcrunch.com/2016/03/30/sure-why-not-fbi-agrees-to-..., which is a knockoff of an AP story that they mention but never link to.
free2rhyme214 11y ago
I'm glad I have an iPhone 6. Anything without touchID is now insecure thanks to the FBI. It sounds like Apple knew this would happen which is why they recently hired a Signal developer: http://techcrunch.com/2016/02/25/apple-hires-developer-behind-signal-edward-snowdens-favorite-secure-chat-app/ http://techcrunch.com/2016/02/25/apple-hires-developer-behin...
- perfectstorm 11y ago
  "The FBI has agreed to help prosecutors gain access to an iPhone 6 and an iPod..." So yea, it's an iPhone 6. http://www.latimes.com/local/lanow/la-me-ln-arkansas-fbi-phone-access-20160330-story.html http://www.latimes.com/local/lanow/la-me-ln-arkansas-fbi-pho...
  - free2rhyme214 11y ago
    Makes me think ABC omitted that on purpose :(
  - x0054 11y ago
    If you use your iPhone 6 WITH touch ID, that is, you actually use touch id to unlock it, it makes it all the more easy for them to unlock it. They can not compel you to provide a password, as of yet, but they can compel you to provide a finger print, and they would probably have a fingerprint of yours anyway, as that is a standard procedure during booking. If you (for some reason) are concerned about FBI having access to your phone, do not use touch ID.
    - dublinben 11y ago
      On the other hand, using Touch ID allows you to have a much longer/stronger passphrase, since you don't have to enter it as often.
      - x0054 11y ago
        This is why I use a jailbrake tweak that let's me draw a passcode after initial unlock, but requires a full alphanumeric password on reboot or after 5 ties. I have no clue why Apple has yet to incorporate that feature directly in the OS. Not sure if the fact that the phone being jailbroken is a further vulnerability, but to be honest, I don't really worry about FBI, as much as I am concerned about loosing my phone and having someone find it and open it.
usaphp 11y ago
Serious question: how is this "unlocking iPhone case", any different from what fbi and other agencies used to do for a while when they seize computers for example, or a locked safe? They also "unlocked" those devices after they got a warrant, what makes this "iPhone case" any different? If they have a warrant - and a way to unlock the device - what is the reason of all this buzz around it?
- deleted 11y ago
  [deleted]
- einarvollset 11y ago
  I think because Apple decided, after the Snowden illegal wiretapping stories, to grandstand for PR purposes. And many tech writers took that bait.
  - Gustomaximus 11y ago
    That's really not a fair summary of the situation. Apple took a stand, rightly in my view, to dig their heels in under the request to make a permanent back door for FBI (and likely other groups) usage. There is a massive difference.
    - einarvollset 11y ago
      I respect that view. Here's where I disagree: I think Apple taking a similar stand for the illegal wiretapping makes sense (giant open door, no court oversight), but not for this case (could be clean roomed, court oversight)
      - swyman 11y ago
        Is a company that makes safes legally required to have a master key or to create a master key even when they don't want to? The question is whether or not a 3rd party can be compelled to create something which does not exist in order to aid in the execution of a search warrant. I think it's pretty clear based on prior All Writs Act precedent[1] that Apple should not be required to produce new software code for cases like this. [1] https://en.wikipedia.org/wiki/United_States_v._New_York_Telephone_Co.#Opinion_of_the_Court https://en.wikipedia.org/wiki/United_States_v._New_York_Tele...
_l3es 11y ago
This is a blatant violation of https://www.law.cornell.edu/uscode/text/18/2511 https://www.law.cornell.edu/uscode/text/18/2511 which prohibit direct interception of communications, 4th amendment/UN rights to privacy and encryption http://www.ohchr.org/EN/Issues/FreedomOpinion/Pages/CallForSubmission.aspx http://www.ohchr.org/EN/Issues/FreedomOpinion/Pages/CallForS... extending to personal devices, and circumventing 5th amendment rights of compelled decryption.
- einarvollset 11y ago
  Unlikely, because they have a valid search warrant.
- DannyBee 11y ago
  Errr, it's pretty much none of those things :) (ie they have a valid search warrant, the fifth amendment does not protect you here under any current caselaw, etc)
  - profmonocle 11y ago
    > the fifth amendment does not protect you here under any current caselaw I can't see even a speculative 5th amendment argument. If they can crack your phone without your cooperation, how could they possibly be forcing you to incriminate yourself?
- _l3es 11y ago
  Edit, guess I didn't do my research on the scope of what a warrant allows to be done.
marcoperaza 11y ago
Put down the pitchforks people. This is standard operating procedure and you're not gonna win any arguments opposing it. If the government gets a search warrant for the contents of a safe in your home, they're perfectly entitled to crack it open with whatever techniques they discover. The now-moot case against Apple was about whether they can compel the safe-maker's assistance, which is a very different issue. This is the protection against search and seizure that you're entitled to within the US: >The right of the people to be secure in their persons, houses, papers, and effects,[a] against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
spacehome 11y ago
"just this one phone"
cmurf 11y ago
How does the prosecution prove the plaintext came from defendants' devices? When DNA is used as evidence not only is there chain of custody rules for biological material, but the details of DNA extraction and comparison are openly documented. You don't just have someone claim something is a match, there's proof.
- forgotpwtomain 11y ago
  They might just be planning to use the information learned from this to assist in the prosecution without providing it as evidence? For example they could subpoena those involved in the imessage conversations or find other criminal leads?
  - mattlutze 11y ago
    If the information is used to build a case against a particular person, my non-lawyer understanding is that it becomes evidence. Or rather, if one of those leads ends up being complicit in the charges, you have to prove as the prosecution how you came to that conclusion. You can't just say "we started investigations, then magic, then we interviewed this guy and figured it out." Historically, when the FBI or some other organization helps but doesn't want to be named as part of the process (to protect their secret methods of accessing or collecting information), prosecutors will do something called "parallel construction," in which they build an alternative timeline to how they could have come by the information that led to the new interviews. It's interesting that in this case, with the FBI publicly acting in support, they're giving up the ghost on that and opening themselves to perhaps being called for testimony. I'm curious how they'd use state secrets protections to get around having to explain their process, and whether a local/appellate/superior court justice(s) would allow it.
    - venomsnake 11y ago
      My non-lawyer reads it differently - the poisonous tree fruit is when you infringe on someone's rights. If you obtain information that is not reliable, you can act on it (and convince judge to give you warrants) just probably not use it in real trial. I also think it depends if you want more information for the current suspect or you are on a fishing expedition
rcthompson 11y ago
I don't really have a too much of a problem with them unlocking individual phones. I have a problem with them asking for the master key to all phones, which is what they were doing in the San Bernardino case.
- nitrogen 11y ago
  But this request also shows that unlocking was never about just that one phone.
sschueller 11y ago
Can apple sue to get the FBI or that Israeli firm that unlocked the San Bernardino phone to find out how they are unlocking these phones?
- roel_v 11y ago
  Anyone can sue for anything anytime, but there is no way they'll ever get to compel the FBI to do so, no.
x0054 11y ago
Are there any good articles on the difference between iPhone 5, 5c, 6, and 6c in terms of security? Also, has anyone covered why NAND Flash clone attack vector would not work? I had many people tell me that is definitely, for sure, certainly would not work, and yet no one I spoke with could explain exactly why that was the case.
- ghshephard 11y ago
  Good (excellent) article on IOS security: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf See Page 12 on advantage of A7 or higher processor, but, in particular: "On devices with an A7 or later A-series processor, the delays are enforced by the Secure Enclave. If the device is restarted during a timed delay, the delay is still enforced, with the timer starting over for the current period. " The question still outstanding, is whether the Secure Enclave can be modified, and also, whether it can be modified without a passcode.
  - venomsnake 11y ago
    And where does Secure Enclave store the counter? Does it have flash inside the processor? Otherwise - just unplug and replug the battery Edit: Any device that is nand cloned will not be using apple power anyway. And we have all kinds of low temperature, low voltage bit flip attacks anyway.
    - x0054 11y ago
      The Secure Enclave does have it's own flash, it apparently even has it's own OS. What do you mean by bit flip attack? I am actually really interested in how it would be possible.
      - andyjohnson0 11y ago
        A bit flipping attack is where a change to the cyphertext results in a predictable change to the (decrypted) plaintext [1]. Re venomsnake's comment, I'm not sure how this applies to the secure enclave though, or the relevance of low temperatures. https://en.wikipedia.org/wiki/Bit-flipping_attack https://en.wikipedia.org/wiki/Bit-flipping_attack
roel_v 11y ago
I'm pretty sure there are quite a few FBI people chuckling these days about how all of this turned out for Apple :)
x0054 11y ago
Apple SHOULD NOT demand to find out how the FBI did it because it would expose them to discovery requests in future court cases where they would have to tell other people (read China / Russia) how to do it. For now they have plausible deniability and they have plenty of talent to figure out how it was done, or if all else fails, they can pay that same security firm to tell them under cover of an NDA.
- nobodyshere 11y ago
  Nope. It could be one of many security flaws that are unknown. And you can't be sure which one they used.
  - x0054 11y ago
    But the problem still remains, if it's well publicized that they were told about the hack, next time they are compelled by the court they will have to tell everyone what FBI told them.
- kingosticks 11y ago
  'If all else fails' they would have to write the security firm a blank cheque. I know Apple have a lot of money but the fee would likely be astronomical. Unless, of course, Apple wanted an ongoing contract with the firm to dig out vulnerabilities (on top of whatever they already do). I wonder if that sort of relationship would be economical for both parties.
- talmand 11y ago
  If it is discovered that Apple knows about the exploit, regardless of how they know about it, then they can be compelled to reveal it in court. An NDA does not give one a pass on testifying in a court of law. It is in Apple's best interest to find out what the exploit is, how long it's been out there, and fix it instead of playing legal games. Such an exploit in the wild is a security concern for every person who owns that phone, not just criminals. There is no telling how many people are out there accessing privileged information in the private and government sectors with that phone. It is a concern covering criminal activity all the way to foreign government spying. As a bonus, if it's an exploit that's been known from before the FBI's claim that only Apple can help them breach the phone, then we know the FBI was full of it. The FBI has been known to use questionable tactics before and backed out of cases that weren't going their way to avoid revealing those questionable tactics. This whole iPhone thing reeks of this.
jerianasmith 11y ago
Glad to learn that. I am sure it is gong to be a welcome step.
hellofunk 11y ago
I wonder what they are all thinking over Apple HQ about this... I suspect it is some variant of "Ok, now how to make these phones even more secure?"
- pbhjpbhj 11y ago
  >"Ok, now how to make these phones even more secure?" Or more likely how to _market_ the next round of phones as being more secure and whether claiming the upgrade is essential for businesses ("our old phones are all broken now, you must upgrade") will lead to a gross increase in profits or not.
Mtinie 11y ago
...and now it begins.* * Officially, because presumably it's been going on for a long time but not publicly discussed to the degree that it is being discussed now.
arthurgibson 11y ago
"Drexler and Staton have both pleaded not guilty to capital murder, aggravated robbery and other charges in the deaths of the c, who were both 66." Is it just acceptable at this point to publish AP content with typos?
- spacehome 11y ago
  Would you pay more money for a proofread article? Would you pay anything at all for online journalism?
merpnderp 11y ago
So if the FBI is just going to have the Israeli company Cellebrite unlock the phone, why couldn't Conway prosecutor's office do this directly? And given the number of public articles of opinion offered to the FBI on how trivial it was to unlock 5c and previous iPhones, and the number of companies offering unlocking them as a service, is the FBI just incredibly slow at setting a standard forensic process, or is there some other reason these phones aren't being unlocked?
- cboppert 11y ago
  Are there legal precedents which allow courts to employ international help for state cases? Is that legal? Are there issues? Maybe it's a financial thing? What's the cost of using one of these outside companies like Cellebrite? I read that there was a chip replication process in play which meant even if the security mechanisms wiped the chip after X attempts you'd just have more chips ready with the same exact image to try, thus negating the issue. That sounds expensive. But I'm not sure. Can a state prosecutor afford that? And in the end, I might be totally wrong on a ton of this.
mizchief2 11y ago
I don't have a problem with law-enforcement getting a warrant for an individual's device and then using whatever means available to get information off of that device. It's the warrantless or use of general warrants to justify mass surveillance that I have an issue with.
godgod 11y ago
Further proof that the FBI was lying when it claimed that the hack they were pushing apple to create was just all just bull.

290 points by noarchy 11y ago

At least it is in the Zeitgeist now, these kind of stories will be around for a while.

ihsw 11y ago

The technique used will be passed on down to anyone that the FBI deems fit, be it public or private. There is no oversight or limitations. Complete and total lack of justification. There's a word for this -- corruption.

einarvollset 11y ago
I don't think that word means what you think it means. Would it have pleased you more if, oh let's just for the sake of argument say: the government had to get some kind of a court order to get the information?
- bhickey 11y ago
  Well, the grandparent did say "There is no oversight or limitations." So, yeah. I believe it would please 'em more if there was a court order involved.
  - einarvollset 11y ago
    Sorry. Sarcasm doesn't come across well: there is a court order, but because Apple decided to not help, they were removed from the oversight chain, hence arguably weakening the oversight.
    - marcoperaza 11y ago
      If the government gets a search warrant and seizes a safe from your home, they don't need the safe-maker's permission to crack it open.
      - teacup50 11y ago
        They would if the safe was purely digital, based on vendor-controlled platform DRM that granted the vendor and only the vendor additional access to the safe.
    - Avenger42 11y ago
      Note that the FBI got the court order in a hearing to which Apple was not invited. The court gave Apple an opportunity to respond, and it was in the middle of that process when the FBI found another way in. It's not like the court told Apple "you need to immediately start working on this" and Apple said "no, we refuse".
- bediger4000 11y ago
  Yes, as long as there was a public, adversarial argument about it, not some classified, logic-bending "memo" from a lawyer, or some one-sided star chamber FISA "court" order.
marcoperaza 11y ago
There is oversight and limitations. The government still needs a search warrant or legal ownership of a device in order to hack it. You're perfectly entitled to make your stuff harder to search, but once the government has a court order or warrant for the info, they're entitled to all the hacking they need to extract the data. Stop and think for a minute about what you're proposing, that the government need to now get a second search warrant for the removal of encryption. That's absolutely ridiculous. If they seize a safe from your home, they don't need special permission to crack it open.
- ihsw 11y ago
  They don't need a search warrant. https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction Once it is in their possession, for whatever cheap and loose justification, they will open it. Your argument is under the assumption that they are not corrupt.
  - akie 11y ago
    'Corrupt' has a very specific meaning. It does not mean 'without morals', 'bad', or 'evil'. Whether or not the police or FBI will unlock this iPhone is most likely completely unrelated to whether or not they are corrupt.

matheweis 11y ago

... this also severely contradicts the narrative we were fed about "it's just this one phone, for, you know, TERRORISM".

einarvollset 11y ago
No it does not. Govt never claimed this. What it does is show that, the FBI will do exactly what the Chinese are currently most likely doing if need be.
- matheweis 11y ago
  You are correct that they did not explicitly say this, however I do believe they - through Director James Comey's statements, strongly implied this: The San Bernardino litigation isn't about trying to set a precedent or send any kind of message... We simply want the chance, with a search warrant, to try to guess the terrorist's passcode without the phone essentially self-destructing and without it taking a decade to guess correctly. That's it. We don't want to break anyone's encryption or set a master key loose on the land. https://www.lawfareblog.com/we-could-not-look-survivors-eye-if-we-did-not-follow-lead https://www.lawfareblog.com/we-could-not-look-survivors-eye-...
  - teacup50 11y ago
    The precedent of "search warrants" already existed. They weren't creating it.
- bediger4000 11y ago
  FBI Director James Comey claimed that unlocking this phone was really really about Terrorism: "So I hope folks will remember what terrorists did to innocent Americans at a San Bernardino office gathering and why the FBI simply must do all we can under the law to investigate that." (https://www.lawfareblog.com/we-could-not-look-survivors-eye-if-we-did-not-follow-lead https://www.lawfareblog.com/we-could-not-look-survivors-eye-...) It's possible, by some weird John Yoo-style contorted reading of the facts to say "FBI Director Comey said that, the US Government didn't say 'because terrorism'". That contorted reasoning would amount to lying by splitting hairs. Don't lie by splitting hairs.

hackuser 11y ago

Remember that the FBI said that if Apple provided a solution, it would not be used in other cases and that they were [Edit: not] going to use it as a precedent (IIRC the details).

marcoperaza 11y ago
>Remember that the FBI said that if Apple provided a solution, it would not be used in other cases and that they were going to use it as a precedent (IIRC the details). That's not what they said. What they said is that each particular case is about unlocking each particular phone. And mind you, these are phones that the government has every right to access if they can find a way, either because they have search warrants or are the legal owners (or have the permission of the legal owners) of the phone. There is nothing controversial about this. The government has used vulnerabilities to extract info from devices gathered during legal searches for a long time. If they seize a safe from your home, they don't need special permission to crack it open. The government still needs a search warrant or legal ownership of a device in order to perform a search. You're perfectly entitled to make your stuff harder to search, and they're entitled to all the hacking they need to extract the data.
- hackuser 11y ago
  > What they said is that each particular case is about unlocking each particular phone. The FBI may have said that, but it doesn't really address the issues substantively and I think they said much more: Remember Apple argued that a solution they provided for one phone would be used for others, and a court decision could be precedent for other cases. The FBI disagreed; I don't remember the details of what they said, however. > these are phones that the government has every right to access if they can find a way I agree, but that's not the issue here. The issue is the FBI's apparent attempt to deceive the public and the courts.
  - teacup50 11y ago
    You're seriously distorting the truth here, not the FBI. The FBI said Apple could maintain control over any tools they made. Apple said "oh noes, we can't ever make a master key [but don't look behind the curtain, where you'll find that we have a master key or three, which is why we can make one in the first place]" Then the FBI found an alternative solution that doesn't require Apple's assistance, making the whole damn conversation moot -- including whether they'd use Apple's hypothetical "master key" on other phones.

droithomme 11y ago

Fairly obvious that no actionable information is being discovered on these phones.

einarvollset 11y ago
How so?
- bediger4000 11y ago
  First, the San Bernadino shooters destroyed a lot of other computers/phones/disks - yet they left that iPhone unscathed (http://abcnews.go.com/US/san-bernardino-shooters-destroy-phones-hard-drives-sources/story?id=35570286 http://abcnews.go.com/US/san-bernardino-shooters-destroy-pho...). It was also a phone provided by Farook's employer. Unless Farook was a big dope, he used it for work stuff only. Since nobody got wind of the crimes before they happened, Farook was evidently Not a Dope. Third, the FBI has had access to iCloud backups from that device (http://www.latimes.com/business/la-fi-tn-apple-fbi-call-20160219-story.html http://www.latimes.com/business/la-fi-tn-apple-fbi-call-2016...), apparently the iCloud password was changed as part of accessing the backup data. The changed iCloud password is what caused the FBI to not be able to access the phone directly. So, I think we can be reasonably sure that no info of value will come off that phone. It's possible, but it seems unlikely.
  - einarvollset 11y ago
    So are you arguing that the police should not explore all reasonable sources of information when investigating a crime? You know, just sample a few and then if nothing comes up, just infer that everything is kosher?
    - bediger4000 11y ago
      Dude... you were the one that asked "How so?" in response to a statement that nothing of value would be recovered from the iPhone that the FBI was using as a means of creating a precedent. I gave you the "how so" reasons, I didn't say anything about not exploring reasonable sources of information. If FBI investigative time is a scarce resource, I would expect them to prioritize the sources of information, putting "less likely to yeild results" lower in the prioritized list. I would also expect them to stop investigating the material way down on the priority list if the material high on the priority list had yielded results.

molecule 11y ago

LA Times is reporting that the phone is an iPhone 6 > The FBI has agreed to help prosecutors gain access to an iPhone 6 and an iPod that might hold evidence in an Arkansas murder trial, just days after the agency managed to hack an iPhone linked to the San Bernardino terror attacks, a local prosecutor said Wednesday. http://www.latimes.com/local/lanow/la-me-ln-arkansas-fbi-phone-access-20160330-story.html http://www.latimes.com/local/lanow/la-me-ln-arkansas-fbi-pho...

Pwngea 11y ago
IIRC, didn't the unlock in the San Bernardino case use an exploit(s) specific to the 5C or something? Also IIRC the iPhone 6 has some sort of hardware-level protection against this.
- bobbles 11y ago
  The FBIs request to Apple was for a specific to that 5c device 'hack' but they never released the details of what they actually did to get into it
- plorg 11y ago
  Anything you may have heard is almost certainly speculation. It seems pretty likely that a particular Israeli company supplied the FBI with an exploit, but no one has said anything about that exploit being specific to the 5c. Even Apple does not seem to know what the exploit was, as they are pursuing legal options (or dropping hints to that effect) to compel the FBI to reveal it to them.
  - taspeotis 11y ago
    > no one has said anything about that exploit being specific to the 5c. Cellebrite describes [1] the solution as working for iOS 8.x on the following devices: > Cellebrite's unlocking capability supports the following devices: iPhone 4S / 5 / 5C, iPad 2 / 3G / 4G,iPad mini 1G, and iPod touch 5G running iOS 8 ... [1] http://www.cellebrite.com/Pages/cellebrite-solution-for-locked-apple-devices-running-ios-8x http://www.cellebrite.com/Pages/cellebrite-solution-for-lock...

dang 11y ago

Url changed from http://techcrunch.com/2016/03/30/sure-why-not-fbi-agrees-to-unlock-iphone-for-arkansas-prosecutor/ http://techcrunch.com/2016/03/30/sure-why-not-fbi-agrees-to-..., which is a knockoff of an AP story that they mention but never link to.

free2rhyme214 11y ago

I'm glad I have an iPhone 6. Anything without touchID is now insecure thanks to the FBI. It sounds like Apple knew this would happen which is why they recently hired a Signal developer: http://techcrunch.com/2016/02/25/apple-hires-developer-behind-signal-edward-snowdens-favorite-secure-chat-app/ http://techcrunch.com/2016/02/25/apple-hires-developer-behin...

perfectstorm 11y ago
"The FBI has agreed to help prosecutors gain access to an iPhone 6 and an iPod..." So yea, it's an iPhone 6. http://www.latimes.com/local/lanow/la-me-ln-arkansas-fbi-phone-access-20160330-story.html http://www.latimes.com/local/lanow/la-me-ln-arkansas-fbi-pho...
- free2rhyme214 11y ago
  Makes me think ABC omitted that on purpose :(
- x0054 11y ago
  If you use your iPhone 6 WITH touch ID, that is, you actually use touch id to unlock it, it makes it all the more easy for them to unlock it. They can not compel you to provide a password, as of yet, but they can compel you to provide a finger print, and they would probably have a fingerprint of yours anyway, as that is a standard procedure during booking. If you (for some reason) are concerned about FBI having access to your phone, do not use touch ID.
  - dublinben 11y ago
    On the other hand, using Touch ID allows you to have a much longer/stronger passphrase, since you don't have to enter it as often.
    - x0054 11y ago
      This is why I use a jailbrake tweak that let's me draw a passcode after initial unlock, but requires a full alphanumeric password on reboot or after 5 ties. I have no clue why Apple has yet to incorporate that feature directly in the OS. Not sure if the fact that the phone being jailbroken is a further vulnerability, but to be honest, I don't really worry about FBI, as much as I am concerned about loosing my phone and having someone find it and open it.

usaphp 11y ago

Serious question: how is this "unlocking iPhone case", any different from what fbi and other agencies used to do for a while when they seize computers for example, or a locked safe? They also "unlocked" those devices after they got a warrant, what makes this "iPhone case" any different? If they have a warrant - and a way to unlock the device - what is the reason of all this buzz around it?

deleted 11y ago
[deleted]
einarvollset 11y ago
I think because Apple decided, after the Snowden illegal wiretapping stories, to grandstand for PR purposes. And many tech writers took that bait.
- Gustomaximus 11y ago
  That's really not a fair summary of the situation. Apple took a stand, rightly in my view, to dig their heels in under the request to make a permanent back door for FBI (and likely other groups) usage. There is a massive difference.
  - einarvollset 11y ago
    I respect that view. Here's where I disagree: I think Apple taking a similar stand for the illegal wiretapping makes sense (giant open door, no court oversight), but not for this case (could be clean roomed, court oversight)
    - swyman 11y ago
      Is a company that makes safes legally required to have a master key or to create a master key even when they don't want to? The question is whether or not a 3rd party can be compelled to create something which does not exist in order to aid in the execution of a search warrant. I think it's pretty clear based on prior All Writs Act precedent[1] that Apple should not be required to produce new software code for cases like this. [1] https://en.wikipedia.org/wiki/United_States_v._New_York_Telephone_Co.#Opinion_of_the_Court https://en.wikipedia.org/wiki/United_States_v._New_York_Tele...

_l3es 11y ago

This is a blatant violation of https://www.law.cornell.edu/uscode/text/18/2511 https://www.law.cornell.edu/uscode/text/18/2511 which prohibit direct interception of communications, 4th amendment/UN rights to privacy and encryption http://www.ohchr.org/EN/Issues/FreedomOpinion/Pages/CallForSubmission.aspx http://www.ohchr.org/EN/Issues/FreedomOpinion/Pages/CallForS... extending to personal devices, and circumventing 5th amendment rights of compelled decryption.

einarvollset 11y ago
Unlikely, because they have a valid search warrant.
DannyBee 11y ago
Errr, it's pretty much none of those things :) (ie they have a valid search warrant, the fifth amendment does not protect you here under any current caselaw, etc)
- profmonocle 11y ago
  > the fifth amendment does not protect you here under any current caselaw I can't see even a speculative 5th amendment argument. If they can crack your phone without your cooperation, how could they possibly be forcing you to incriminate yourself?
_l3es 11y ago
Edit, guess I didn't do my research on the scope of what a warrant allows to be done.

marcoperaza 11y ago

Put down the pitchforks people. This is standard operating procedure and you're not gonna win any arguments opposing it. If the government gets a search warrant for the contents of a safe in your home, they're perfectly entitled to crack it open with whatever techniques they discover. The now-moot case against Apple was about whether they can compel the safe-maker's assistance, which is a very different issue. This is the protection against search and seizure that you're entitled to within the US: >The right of the people to be secure in their persons, houses, papers, and effects,[a] against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

spacehome 11y ago

"just this one phone"

cmurf 11y ago

How does the prosecution prove the plaintext came from defendants' devices? When DNA is used as evidence not only is there chain of custody rules for biological material, but the details of DNA extraction and comparison are openly documented. You don't just have someone claim something is a match, there's proof.

forgotpwtomain 11y ago
They might just be planning to use the information learned from this to assist in the prosecution without providing it as evidence? For example they could subpoena those involved in the imessage conversations or find other criminal leads?
- mattlutze 11y ago
  If the information is used to build a case against a particular person, my non-lawyer understanding is that it becomes evidence. Or rather, if one of those leads ends up being complicit in the charges, you have to prove as the prosecution how you came to that conclusion. You can't just say "we started investigations, then magic, then we interviewed this guy and figured it out." Historically, when the FBI or some other organization helps but doesn't want to be named as part of the process (to protect their secret methods of accessing or collecting information), prosecutors will do something called "parallel construction," in which they build an alternative timeline to how they could have come by the information that led to the new interviews. It's interesting that in this case, with the FBI publicly acting in support, they're giving up the ghost on that and opening themselves to perhaps being called for testimony. I'm curious how they'd use state secrets protections to get around having to explain their process, and whether a local/appellate/superior court justice(s) would allow it.
  - venomsnake 11y ago
    My non-lawyer reads it differently - the poisonous tree fruit is when you infringe on someone's rights. If you obtain information that is not reliable, you can act on it (and convince judge to give you warrants) just probably not use it in real trial. I also think it depends if you want more information for the current suspect or you are on a fishing expedition

rcthompson 11y ago

I don't really have a too much of a problem with them unlocking individual phones. I have a problem with them asking for the master key to all phones, which is what they were doing in the San Bernardino case.

nitrogen 11y ago
But this request also shows that unlocking was never about just that one phone.

sschueller 11y ago

Can apple sue to get the FBI or that Israeli firm that unlocked the San Bernardino phone to find out how they are unlocking these phones?

roel_v 11y ago
Anyone can sue for anything anytime, but there is no way they'll ever get to compel the FBI to do so, no.

x0054 11y ago

Are there any good articles on the difference between iPhone 5, 5c, 6, and 6c in terms of security? Also, has anyone covered why NAND Flash clone attack vector would not work? I had many people tell me that is definitely, for sure, certainly would not work, and yet no one I spoke with could explain exactly why that was the case.

ghshephard 11y ago
Good (excellent) article on IOS security: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf See Page 12 on advantage of A7 or higher processor, but, in particular: "On devices with an A7 or later A-series processor, the delays are enforced by the Secure Enclave. If the device is restarted during a timed delay, the delay is still enforced, with the timer starting over for the current period. " The question still outstanding, is whether the Secure Enclave can be modified, and also, whether it can be modified without a passcode.
- venomsnake 11y ago
  And where does Secure Enclave store the counter? Does it have flash inside the processor? Otherwise - just unplug and replug the battery Edit: Any device that is nand cloned will not be using apple power anyway. And we have all kinds of low temperature, low voltage bit flip attacks anyway.
  - x0054 11y ago
    The Secure Enclave does have it's own flash, it apparently even has it's own OS. What do you mean by bit flip attack? I am actually really interested in how it would be possible.
    - andyjohnson0 11y ago
      A bit flipping attack is where a change to the cyphertext results in a predictable change to the (decrypted) plaintext [1]. Re venomsnake's comment, I'm not sure how this applies to the secure enclave though, or the relevance of low temperatures. https://en.wikipedia.org/wiki/Bit-flipping_attack https://en.wikipedia.org/wiki/Bit-flipping_attack

roel_v 11y ago

I'm pretty sure there are quite a few FBI people chuckling these days about how all of this turned out for Apple :)

x0054 11y ago

Apple SHOULD NOT demand to find out how the FBI did it because it would expose them to discovery requests in future court cases where they would have to tell other people (read China / Russia) how to do it. For now they have plausible deniability and they have plenty of talent to figure out how it was done, or if all else fails, they can pay that same security firm to tell them under cover of an NDA.

nobodyshere 11y ago
Nope. It could be one of many security flaws that are unknown. And you can't be sure which one they used.
- x0054 11y ago
  But the problem still remains, if it's well publicized that they were told about the hack, next time they are compelled by the court they will have to tell everyone what FBI told them.
kingosticks 11y ago
'If all else fails' they would have to write the security firm a blank cheque. I know Apple have a lot of money but the fee would likely be astronomical. Unless, of course, Apple wanted an ongoing contract with the firm to dig out vulnerabilities (on top of whatever they already do). I wonder if that sort of relationship would be economical for both parties.
talmand 11y ago
If it is discovered that Apple knows about the exploit, regardless of how they know about it, then they can be compelled to reveal it in court. An NDA does not give one a pass on testifying in a court of law. It is in Apple's best interest to find out what the exploit is, how long it's been out there, and fix it instead of playing legal games. Such an exploit in the wild is a security concern for every person who owns that phone, not just criminals. There is no telling how many people are out there accessing privileged information in the private and government sectors with that phone. It is a concern covering criminal activity all the way to foreign government spying. As a bonus, if it's an exploit that's been known from before the FBI's claim that only Apple can help them breach the phone, then we know the FBI was full of it. The FBI has been known to use questionable tactics before and backed out of cases that weren't going their way to avoid revealing those questionable tactics. This whole iPhone thing reeks of this.

jerianasmith 11y ago

Glad to learn that. I am sure it is gong to be a welcome step.

hellofunk 11y ago

I wonder what they are all thinking over Apple HQ about this... I suspect it is some variant of "Ok, now how to make these phones even more secure?"

pbhjpbhj 11y ago
>"Ok, now how to make these phones even more secure?" Or more likely how to _market_ the next round of phones as being more secure and whether claiming the upgrade is essential for businesses ("our old phones are all broken now, you must upgrade") will lead to a gross increase in profits or not.

Mtinie 11y ago

...and now it begins.* * Officially, because presumably it's been going on for a long time but not publicly discussed to the degree that it is being discussed now.

arthurgibson 11y ago

"Drexler and Staton have both pleaded not guilty to capital murder, aggravated robbery and other charges in the deaths of the c, who were both 66." Is it just acceptable at this point to publish AP content with typos?

spacehome 11y ago
Would you pay more money for a proofread article? Would you pay anything at all for online journalism?

merpnderp 11y ago

So if the FBI is just going to have the Israeli company Cellebrite unlock the phone, why couldn't Conway prosecutor's office do this directly? And given the number of public articles of opinion offered to the FBI on how trivial it was to unlock 5c and previous iPhones, and the number of companies offering unlocking them as a service, is the FBI just incredibly slow at setting a standard forensic process, or is there some other reason these phones aren't being unlocked?

cboppert 11y ago
Are there legal precedents which allow courts to employ international help for state cases? Is that legal? Are there issues? Maybe it's a financial thing? What's the cost of using one of these outside companies like Cellebrite? I read that there was a chip replication process in play which meant even if the security mechanisms wiped the chip after X attempts you'd just have more chips ready with the same exact image to try, thus negating the issue. That sounds expensive. But I'm not sure. Can a state prosecutor afford that? And in the end, I might be totally wrong on a ton of this.

mizchief2 11y ago

I don't have a problem with law-enforcement getting a warrant for an individual's device and then using whatever means available to get information off of that device. It's the warrantless or use of general warrants to justify mass surveillance that I have an issue with.

godgod 11y ago

Further proof that the FBI was lying when it claimed that the hack they were pushing apple to create was just all just bull.