9 ms·
Federal Court Says Dismantling a Phone to Install Firmware Isn't a 'Search'
- hn_acker 2y agoThe full title is: > Federal Court Says Dismantling A Phone To Install Firmware Isn’t A 'Search,' Even If Was Done To Facilitate A Search
- JohnFen 2y ago[flagged]
- deleted 2y ago[deleted]
- jerf 2y agoAs the article says, it is probably a reasonable ruling, because it isn't a search. What you have to watch out for is the legal two-step, where they do something like "install a firmware on the phone", which isn't a search, and then, oh gosh, the firmware just happened to sit there and flash all the contents of the phone on the screen because that's what the firmware does, we didn't actually search the phone, it just voluntarily dumped all its contents to the screen, so that wasn't a search either, so no search occurred.
- koolba 2y agoDoes that mean that wiping the firmware or Secure Enclave would not constitute destroying evidence? How about installing firmware that will wipe the Secure Enclave on boot? Especially if the secondary step of turning on the device is done by the seizing authorities.
- fwip 2y agoNo, the judge would not be okay with that. In the same way, shredding all your incriminating legal documents into a fun jigsaw puzzle for the cops to put together is also illegal.
- toast0 2y agoI mean, having firmware that securely wipes your phone in case it's used by an unauthorized party is a reasonable and desirable feature. It's not generally illegal to set that up. Same with destroying documents. Having a retention period and destroying documents which have PII and could be used for identity fraud is a good practice. It's not generally illegal to do that either. Where you get into trouble with the courts is when you have a specific obligation to retain or transfer information and you destroy it instead.
- wildzzz 2y agoIt is illegal to intentionally destroy something that you suspect could be evidence in a future criminal case against you. Say you operate an illegal drug network from a specific phone that you've intentionally setup to self-destruct at reboot. Both you and the cops know there is likely evidence on there that would implicate you. Then, if you either intentionally reboot the phone or maybe the battery dies while in police custody before they can access it and the phone is wiped, you could be liable for destruction of evidence. However, if it's just a standard smartphone and you accidentally drop it in the toilet, unintentionally destroying all evidence, you may not be liable. Basically, if you intentionally destroy evidence, either actively passively, you're liable. It is kind of a broad law and is difficult to prosecute in many cases. The cops have to know that you did the crime and prove that the evidence existed. If you murdered someone and made it look like a suicide, the cops would have to not only suspect you but also know that you left fingerprints and DNA behind that are no longer present.
- PeterisP 2y agoIntent makes all the difference in the eyes of law. If a jury of your peers decides that you configured that firmware to protect your data from thieves, then it is not a problem. But if a jury of your peers doesn't buy your assertion of that, and instead becomes convinced that you applied that (otherwise reasonable and legitimate) feature with the intent to destroy evidence of a crime so that it doesn't reach the court, then setting it up was a felony.
- LPisGood 2y agoThis makes sense, and I actually believe that it isn’t a search. It is definitely a _seizure_ though and I do wonder how often these two things are distinguished in law. How often do the police raid a place and confiscate filing cabinets but not look through them.
- rayiner 2y agoThe seizure was done pursuant to a warrant too. There’s an argument that, once the warrant extensions expired, keeping the device in police custody constituted a continuing seizure. But it doesn’t seem like the defendant made that argument (or at least the court didn’t address that argument)
- giantg2 2y agoUsually one has to petition/request the return of seized items. So it's not unusual that something is still held until requested. Usually instead of fixing what they have, they tend to destroy it.
- btilly 2y agoYou and I disagree on reasonableness. The government is here deliberately planning to take advantage of a seizure to damage someone's personal possessions. The right of that person to be secure in their possessions therefore should require a higher standard from the government than is required for mere temporary adverse possession after a seizure.
- rayiner 2y agoThe government had a warrant to seize the device. It got multiple warrant extensions trying to get into the device. They determined it needed a logic board replacement. The warrant extensions expired while that was being done. But the government got a warrant to then actually access the data. I fail to see how this doesn’t satisfy even a high standard of reasonableness.
- fitblipper 2y agoWhy do you feel that info is relevant? If my driver's license expired yesterday and then I get pulled over while I'm driving to the DMV today to get it renewed, should I not get a citation? Just because they had permission before and after their actions took place doesn't make it ok if they didn't have permission at the time of the action. To say otherwise seems to be begging for abuse of a loophole. I guess that's why they had to claim the action wasn't one a warrant was required for...
- rayiner 2y agoIt’s relevant for the same reason it’s relevant in your driver’s license example. You drive somewhere while your license is valid. Then you replace the car battery, which has died. Then you renew your license, and drive somewhere else. Have you done anything wrong? No, because you need a license to drive the car, not to repair the car. Same thing here. The government needs a warrant to seize the device or search for information on the device. Does it need a warrant to repair a broken device that it has properly seized, before then getting a warrant to search the device?
- taneq 2y agoBreaking down the door of a house isn’t a search. Activating an autonomous drone in front of the house which then enters through the door of its own volition and records everything it sees in the house isn’t a search. And if I make a chomping motion in the air near a donut and it decides to enter my mouth while I’m chomping then I haven’t illegally taken a bite of the donut.
- zzo38computer 2y agoWhether or not it is a "search", it is trespassing, and they should make the constitution to protect against that too (I don't know whether or not it already means that or whether or not it is intended to mean that). Protecting against "unreasonable search and seizures" should also include protecting against trespassing.
- nyeah 2y agoI sense irony here, but I'm American so it's hard to be sure.
- taneq 2y agoI dunno if irony is exactly the right word (but that's a complex discussion and probably any call would be category-error-ish anyway) but I was aiming for a Simpsons reference. :D
- deleted 2y ago[deleted]
- ortusdux 2y agoI guess I can understand the argument that picking a lock does not count as a search, but the second you open the door...
- qup 2y agoLike removing the doorframe and putting in your own new door that doesn't lock, then walking inside
- tiahura 2y agois when they got the warrant
- ortusdux 2y agoI guess that is the question. If the police are confident that they will have a warrant in 30 minutes, can they have a locksmith unlock the door while they wait?
- BobaFloutist 2y agoI would say no, because the whole point of the warrant is to remove the police's judgement from the equation. If they're taking action based on their expectation that they'll get it, that's kind of an end-run around the stated purpose.
- deleted 2y ago[deleted]
- thayne 2y agoWhat if picking the lock damages the lock?
- yencabulator 2y agoYeah. It might not be a search, but it's something, and the logical question is to ask under what authority can that be done.
- gnfargbl 2y agoAh, but standard firmware doesn't do that; the agency performing the action would need to have developed custom firmware which "just happened" to show the information when installed. Courts tend to see through those kinds of shams.
- wbl 2y agoNo that would be a search. Judges really don't like having these games played.
- mouse_ 2y ago[flagged]
- deleted 2y ago[deleted]
- mindslight 2y agoIndependent of the legal nuance being worked out here, it is quite fucked up that the government can just demolish your entire digital infrastructure and then keep the pieces indefinitely. Imagine if they applied the same standard to your dwelling itself. "Sorry you can't live here for the next few years because a crime might have been committed. Go buy another house. Or not, we don't care".
- readthenotes1 2y agoMaybe you haven't heard of civil forfeiture? https://en.m.wikipedia.org/wiki/Civil_forfeiture_in_the_United_States https://en.m.wikipedia.org/wiki/Civil_forfeiture_in_the_Unit...
- mindslight 2y agoI don't know why you would think that might be a possibility given the venue we are on. Government has also demolished people's actual homes in the course of "crime fighting" and then refused to pay/fix them as well (that notorious case in Colorado comes to mind). But surely you can see there is still a distinction between things that happen infrequently, often with limited scope, or still at least with some semblance of a legal process, and what happens routinely to people accused of "digital crimes". It should go without saying that I think all of these dynamics are terrible, and in dire need of reform. But at least civil forfeiture and "qualified" (née sovereign) immunity are getting talked about, while the totalitarian approach to personal digital infrastructure isn't getting so much attention.
- sidewndr46 2y agoWhat'd really be a shame is if the police could just show up one day and blow up your house. And then just leave https://www.denverpost.com/2020/03/11/colorado-swat-house-destroyed-supreme-court/ https://www.denverpost.com/2020/03/11/colorado-swat-house-de...
- mindslight 2y agoI don't get the point to this reflexive whataboutism. Yes, that dynamic exists and it is bad too. (I referenced that event in a follow up comment, thanks for providing a specific link) And at least that event had some condemnation in the media, as opposed to the routine destruction of digital personal lives escaping criticism even on techdirt.
- btilly 2y agoWhat happens if we take this as precedent? Dismantling a safe to facilitate a search, isn't a search. So it's allowed, even if the safe is left damaged. Tearing a house apart to facilitate a search, isn't a search. So it's allowed, even if the house is left damaged. Disassembling a car to facilitate a search, isn't a search. So it's allowed, even if the car never runs the same later. Meanwhile you'll find me in the corner that reads the 4th Amendment as follows: The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. I think that if the result of a seizure is the potential permanent damage of my property, then my right to be secure in my possessions should be defended by demanding a higher standard from the government than that required for a mere temporary possession after a seizure. That principle applies just as much to electronics as it does to any physical item.
- deleted 2y ago[deleted]
- modernpacifist 2y ago> The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. If they have a search warrant then a judge has, from a legal perspective, determined that the request/search is reasonable. So while you have the right to secure against unreasonable cases I think it is a reasonable trade off that those security mechanisms/processes/etc should either be removed by yourself or you should expect them to be removed for you.
- sidewndr46 2y agoI don't know what fantasy world you live in but the police don't ask you to remove your security mechanisms yourself. Your likely to catch a charge for destruction of evidence if you do that along with a bunch of other related charges
- rayiner 2y agoThe article’s headline is rather misleading (I assume unintentionally), because it omits that the actual seizure and data access was done pursuant to warrants. Only the repair and firmware update was performed during a donut hole when one warrant had expired before another was granted. Here, the government obtained multiple, time-limited warrants to search the device, but was unable to get into it. They sent it to be repaired. After the warrant extension expired, the repair guy fixed it and updated the firmware. (The record doesn’t say what version the firmware was, but it seems like it was standard firmware, not some special forensic firmware.) The next day, the government again obtained a warrant. Only after doing so did the government perform the search. In this unusual situation, it’s reasonable to conclude that the device repair wasn’t a search. The seizure and the data access were both performed pursuant to a warrant. The only part that wasn’t covered by the warrant was just fixing the device in a seemingly conventional way to get it working again. Original decision here, pages 3-4 has the relevant facts: https://s3.documentcloud.org/documents/25423841/no-disassemble.pdf https://s3.documentcloud.org/documents/25423841/no-disassemb...
- chefandy 2y agoI agree that most readers won’t really ‘get it’ by reading the headline, and appreciate your useful addition so we all can get some context without the click, but in defense of the author, I think writing layperson-accessible headlines for technical legal articles is often impossible. Having attempted to make interfaces and applications that made raw legal data useful for laypeople, including with NN summaries and such, if there’s a meaningfully better solution, I sure couldn’t find it after a few years of work. For the same reason reading case law doesn’t effectively help laypeople represent themselves in court, you need context and background knowledge to make sense of legal concepts. (If you’ve ever seen an overconfident ‘sovereign citizen’ cite opinions in court while representing themself, you’ve seen why. And while most are obviously under-educated for the task, they’re probably not unintelligent and they clearly put a lot of effort into it.) To people used to reading legal texts and familiar with the trajectory of decisions in this space, the headline makes sense, and I think that’s probably the best you can do. Trying to construct a headline that’s representative while also giving laypeople the background and context they need to make sense of the topic becomes way too long to be a headline long before it accomplishes it’s goal.
- Pxtl 2y agoSo if the government bugs your car and home but doesn't turn the bug on, is that a search?
- Clubber 2y agoYes and I believe if you remove it, they can charge you with theft.
- rolph 2y ago[0] Is It Considered Theft if You Remove a Law Enforcement G.P.S. Tracking Device from Your Automobile?[2020] https://www.wimmercriminaldefense.com/is-it-considered-theft-if-you-remove-a-law-enforcement-g-p-s-tracking-device-from-your-automobile/ https://www.wimmercriminaldefense.com/is-it-considered-theft...
- ezfe 2y agoNo, and there's actually an analogy: phone taps. The "bug" is already installed, they just need the warrant to turn it on.
- rangestransform 2y agowe found out that "lawful" intercept is a lie recently, and it left a gaping hole in our infrastructure can we please encrypt everything and turn off government access for all communications now
- yapyap 2y agoFederal court is stupid,
- deleted 2y ago[deleted]
- throwawaycities 2y agoThis will be great legal precedent for the courts to extend to implanting neuralink style chips in your brain - although a neuralink chip may facilitate a future search and seizures (pun intended), the installation of the chip itself is neither a search nor a seizure; therefore, the 4th Amendment does not apply
- deleted 2y ago[deleted]
- WaitWaitWha 2y agoCouple of notes on this: 52 devices could mean a phone, a tablet, and 50 USBs, SD cards, and such. The problem with loading firmware to permit is the potential damage to the evidence and the potential to imply that the evidence was planted. The vast majority of the cell phone hacking involves loading material into at least into memory and often modify the boot load sequence. This is how all that I worked with (e.g., Cellebrite, Magnet, MSAB, Oxygen, AccessData) function. damage: I have toasted devices by hooking them up to forensic tools, mobile phones and more. planted evidence: There have been several challenges to this (I think US v. Ganias), and let's not forget the Casey Anthony trial where they argued that the forensic tool CacheBack reliability. Not surprisingly, F/LOSS tools are better defense for this than black-box commercial ones. The more complex the evidence collection, the more likely damage can occur, or planted evidence can be argued.
- julianeon 2y agoIt seems like the writing is on the wall. There will be some Official Ruling that you can't do this (probably antiquated 20th century) thing because that constitutes an Unlawful Search or whatever. Thank you to the Constitution for protecting our freedoms, etc. Meanwhile, there will be a much more powerful way to achieve that goal using a smartphone, which is 100x more subtle and effective, which will be legal because technically it doesn't cross the big red line. There will be some arcane logic here that only a lawyer could love, but it will amount to 20th century technique = banned, 21st century cellphone technique = fine. So everyone will do that. It'll just get more pronounced over time.
- deleted 2y ago[deleted]
- renecito 2y agoI'd guess that's the criteria to make government mandated backdoors legal.
- yieldcrv 2y agonah, appeal. reviving it involved modifying someone’s personal property. I like that this is in the 9th circuit so I think the defendant and this country’s subjects will get a favorable ruling people ask me how much I want to make: enough to take any cases through federal appeals court
- singleshot_ 2y agoAnalogize to those cases where they seize an inoperative gun and then go to certain, specific lengths to make the gun operate before charging the possessor with possession of a (potentially) operative gun. Distinguishable because it’s not a search. Can you draw a rule from this?
- yieldcrv 2y agoI would argue that what theyre doing is outside of the scope of the warrant they already used, and also possible that the defendant asked the wrong question for this challenge And that those other cases should have been challenged too, if they weren’t I’ve seen too many things that were either difficult to challenge or only affected people too poor to challenge, to just accept a common practice because its common. I will accept prior case law from federal appeals courts though I feel like there should be a limitation on government power here either way as they changed the circuitry and firmware. they should at least give more information about the firmware, for mounting a defense we should have information about the firmware itself
- dhx 2y agoIs this ruling effectively that it's irrelevant whether or not a warrant existed to modify the iPhone 6 because in this case, there is no loss to the claimant from that modification having been made? How much would an old second hand broken iPhone 6 that needs repair sell for? ... not much. Yet the repair carried out has seemingly significantly increased the value of the iPhone 6. The only argument that otherwise comes to mind is an iPhone 6 with an old and very specific version of firmware could be more valuable due to rarity and people are transacting them for $20,000 on eBay because of that firmware version's ability to be rooted. Yet an eBay confirms this is seemingly not the case. Perhaps though there is a non-insignificant cost to buying and selling 20 or 50 iPhone 6's off eBay before finding one with an old enough firmware version installed?
- Sparkyte 2y agoIt isn't, but it should be illegal to repair or modify something you do not own without the consent of the owner. You wouldn't rent an apartment only to put 10k renovations into it? I mean lets be real that is practically illegal.
- radicaldreamer 2y agoThis was an iPhone 6, so I assume that the logic board change enabled brute force passcode searches. This was fixed in a subsequent update to the secure enclave, so this is less likely to work on the latest devices.
- sharpshadow 2y agoMaybe Apple was right after all with their iPhone refusing any replacement parts.
- ReptileMan 2y agoFair game. The government shouldn't be able to force you to unlock a device. Even with fingerprint or face. But it is totally ok to get inside any way they can.
- 015a 2y agoUnrelated to the ruling: Why is the Department of Homeland Security investigating and pursuing a CSAM case in the first place? Isn't that more FBI's jurisdiction?
- K0balt 2y agoSo they figured out that they needed different firmware with a zero day they had access to, so they contrived a way to get the firmware on there? That seems like maybe not a search? Idk. If a search warrant includes destruction to obtain information, seems like this would fly.