Sen. McCain Unhappy Apple Turned Down His Invitation To Be Encryption Hearing Punching Bag

from the Sad! dept

Last Friday's hearing on encryption was hosted by the Senate Committee on Armed Services and a visibly-irritated John McCain. McCain is no fan of encryption and, apparently, no fan of Apple. Kieren McCarthy of The Register reports (and delivers a stellar headline).

Opening the Committee on Armed Services' hearing on cybersecurity this morning, McCain went out of his way to note that Cook has declined the senator's invitation to give testimony alongside three opponents of end-to-end encryption on the company's iPhone.

"I must note for the record that these were not our only invited guests," McCain said.

"This committee extended an invitation to Apple CEO Tim Cook to offer his perspective on these important issues. He declined. I hope he will reconsider in the future so that this committee can benefit from the widest possible variety of perspectives."

"Widest possible variety." The other three "guests" included noted encryption opponent Cyrus Vance, former Bush Homeland Security Advisor Ken Wainstein, and -- producing the only measured take on the issue -- former NSA deputy director Chris Inglis. So, the deck was stacked, and Apple likely felt its testimony would be largely undercut by having to defend itself against baseless assertions and wild allegations, like it did at the last hearing it attended.

Back in April, the "intelligence commander" of the Indiana State Police, Charles Cohen, suggested Apple had provided iOS source code to the Chinese -- something it wasn't willing to hand over to the US government. So, while attempting to speak about the issue at hand, Apple's reps had to address idiotic statements like these instead.

That's where I was going to conclude my comments. But I think I owe it to this committee to add one additional thought. And I want to be very clear on this: We have not provided source code to the Chinese government. We did not have a key 19 months ago that we threw away. We have not announced that we are going to apply passcode encryption to the next generation iCloud. I just want to be very clear on that because we heard three allegations. Those allegations have no merit.

Thanks, but no thanks. McCain and others attending the hearing pretend the encryption problem can be solved by "working together." But Manhattan DA Cyrus Vance used part of his testimony to basically accuse Apple of offering encryption-by-default just to spite the government. The others testifying didn't go quite as far as Vance did in portraying the company as the enemy of justice, but there was really nothing in it for Apple. There's no "working together" going on here, not if the committee offers three invitations to people opposed to encryption (or at least far more sympathetic to law enforcement's requests) but the only outsider asked to attend is one that spent the running time of the last hearing listening to ignorant statements and wild allegations.

Not having Apple to kick around obviously bothered McCain.

As the hearing progressed and McCain was faced with the fact that all three panelists were effectively saying the same thing, he grew increasingly frustrated at the failure of Cook to serve as a legislative punching bag and repeatedly referred to his absence.

His committee "has subpoena power" McCain grumpily noted, implying that he would compel Cook to attend a future kangaroo court. And at the end of the hearing, McCain still wouldn't let the matter drop and complained that it was "unacceptable" that Cook had failed to attend.

That's what passes for "working together" in Washington. Threats of forced attendance at upcoming hearings where tech representatives can be sat on one side and angrily glared at when not attempting to defend themselves from speculative assertions and allegations.

Filed Under: encryption, going dark, john mccain
Companies: apple

Cy Vance Still Arguing For Mandated Encryption Backdoors; Believes Third Party Doctrine Supports His Theory

from the a-bunch-of-bad-ideas,-all-wrapped-up-in-self-righteousness dept

The United States Senate Committee on Armed Services held a hearing about the coming darkness cellphone encryption Friday morning. There was almost no attempt made to address both sides of the issue, most likely because Senator John McCain -- who headed up the "discussion" -- has already made up his mind on how this problem should be handled.

Testimony -- all from government officials -- was presented, with Manhattan DA Cyrus Vance leading off. Vance's tune hasn't changed. Encryption is still (apparently) an insurmountable problem and the only "answer" runs directly through Congress. Vance spent most of his speaking time [PDF] criticizing Apple and suggesting its decision to provide encryption by default on its phones was done purely to spite him and the government.

Given Apple’s own statements about the security of iOS 7, shortly after Apple’s reengineering of its phones to prevent search warrant access by law enforcement, I asked it in a letter dated March 2015, whether there was a bona fide security reason to make its new operating system, iOS 8, warrant-proof. Apple chose not to answer me, but in March of this year, the House Judiciary Committee compelled Apple to answer the same question. That Committee asked Apple the following question, in writing, “Was the technology you possessed to decrypt these phones”—and the clear reference is iOS7 phones and their predecessors—“ever compromised?” Apple’s written response was: “The process Apple used to extract data from locked iPhones running iOS 7 or earlier operating systems was not, to our knowledge, compromised.” (Emphasis added.)

Apple’s answer to this crucial question shows what we have long suspected: That Apple’s method of data extraction under iOS 7 posed no documented security problems. That being so, then there should be no unreasonable security risk going forward if we return to the procedure where court-ordered warrants can be honored by extracting responsive data off of smartphones.

In Vance's view, encryption protocols should not be altered until they've been compromised -- a view that aligns nicely with his presumption that the government should always have access to phone contents but runs counter to good security practices. Vance wants Apple to go back to holding the encryption keys and be on hand to unlock the door whenever the government asks.

Vance is still pushing his "encryption is a godsend to criminals" narrative -- based on little more than same single recorded prison phone call he referenced months ago. Vance may have a pile of cellphones law enforcement can't break into, but that hardly suggests a majority of criminals are gravitating towards encrypted services. The rise in the number of encrypted communications methods will benefit some criminals, but even high-profile terrorist attacks have been coordinated and planned using methods still open to interception and investigation.

The solution is legislation, according to the DA. Vance provides a list of prior legislation crafted to aid law enforcement as support for his theory the government should be allowed access to phone contents. However, his list covers only records collected and stored by third parties -- not the content and communications he's seeking access to.

Federal regulation is already important in the communications industry. When telephone companies went from using copper wires to using fiber optics and digital signals, the police could no longer use their old techniques of executing wiretap orders, and so Congress passed the Communications Assistance for Law Enforcement Act (CALEA), mandating that telecom providers build into their systems mechanisms for law enforcement to install court-ordered wiretaps. CALEA has worked. It has saved lives, and it has withstood Constitutional challenge. It has not stifled innovation, as its opponents feared…

[...]

Here are a few other examples: DEA regulations require all U.S. pharmacies to maintain paper and electronic prescriptions bearing the name of the patient and prescriber, drugs dispensed, and dates filled. FTC regulations require any business that checks a customer’s identification to maintain and provide victims and law enforcement with transaction records relating to identity theft. State regulations require private schools to maintain student data records, including records of attendance and suspected child abuse. I could go on.

The point is that companies in nearly every industry are required by law to maintain voluminous customer records and produce criminal evidence when they receive a court order. When your introduction of goods and services into the stream of commerce overlaps with public safety, this is the price of doing business in the United States.

In other words: the government should have access to iPhone contents because it has access to other stuff. It's a clumsy comparison at best. At worst, it's a blueprint for unprecedented government intrusion. Vance may be trying to demonstrate that the government has historically had access to a wealth of information thanks to regulators and the Third Party Doctrine and should continue to be granted access, but this inept analogy is worse than apples-to-oranges. Connecting Vance's dots suggests he views personal data and communications as just another set of records "collected" by cellphone providers. He may not openly suggest these are nothing more than "third party" records, but he obviously believes private corporations "owe" this sort of access to the government.

Vance says he doesn't want a legislated encryption backdoor, but his solution is basically a legislated encryption backdoor.

My Office’s proposed solution is to enact a federal statute providing that data on any smartphone made or sold in the United States must be accessible—not by law enforcement, but by the maker of the smartphone’s operating system—when the company is served with a valid search warrant. And if a person or entity such as Apple offers encryption software, it has to have the ability to provide data in response to a judicial order.

The backdoor may be located at the company's headquarters, but it's a backdoor all the same.

His testimony also suggests more legislation might be needed to further subvert encryption. Like James Comey, Vance suggests harder nerding will make the impossible possible.

This solution is limited to data at rest on smartphones. It would not affect encryption of data in motion. I cannot at this time offer a technical fix to address data in motion. I am confident, however, that engineers from industry and government, working together in good faith, can find one.

"Good faith." That's hilarous. The only time law enforcement is interested in a "good faith" discussion is when it's trying to salvage an illegal search.

Vance -- like Comey -- believes all concessions must come from the private sector. That's how he defines "working together." He's also concerned a 12-month study from a Congressional committee won't address the issue fast enough.

Twelve months of taking testimony resulting in non-binding recommendations in a report will not adequately address the urgency of the problem that local law enforcement faces. Time is not a luxury that local law enforcement, crime victims, or communities can afford.

With a nod to civil liberties:

Our laws require speedy trials. Victims require justice. And criminals must be held accountable before they can reoffend.

I would think that if you don't have the evidence -- if it's on phones that can't be broken into -- you just don't have the evidence. I sincerely hope people aren't being locked up until Congress creates the backdoor Vance is looking for. Of course, we know that is happening, but hopefully not on the scale Vance suggests with his list of police-resistant devices still being held by law enforcement agencies (who assume they contain evidence of criminal activity).

The end result of the encryption study can't be determined at this point. But given the nature of this committee -- and its decision to only present one side of the issue -- it appears its greatest purpose may be nothing more than buying time until backdoor/ban legislation is reintroduced.

Vance's side hasn't budged an inch. While deference is continually paid to the "smart people" at tech companies, it's only done so under the assumption that they're just holding out on the government. The solution Vance, et al want is supposedly possible, even if it isn't. Any arguments to the contrary are continually treated as deliberate antagonism, rather than basic facts. Backdoored encryption -- no matter who holds the keys -- is a security problem. And it's not going to go away, no matter how many times the same arguments are repeated.

Filed Under: cy vance, cyrus vance, encryption, going dark, john mccain, manhattan da
Companies: apple

Apple's IP Lawyers May Force YouTube MacBook Repair Videos Offline Over Schematic

from the still-keeping-that-on-the-down-low dept

It's no secret that Apple does not want you to monkey around with your device's innards or to take it anywhere but to its own stores for repairs. The company has continually screwed around with the screws that keep its hardware together in an effort to prevent DIYers and non-Apple-approved repair shops from opening its devices.

Now, Apple can't legally prevent anyone from utilizing third parties for repairs, as explained in this Motherboard article by Jason Koebler. A 40-year-old piece of legislation states companies can't void warranties simply because the devices have been opened.

What almost no one knows is that these stickers and clauses are illegal under a federal law passed in 1975 called the Magnuson-Moss Warranty Act.

To be clear, federal law says you can open your electronics without voiding the warranty, regardless of what the language of that warranty says.

Apple (far from the only offender) maneuvers around this by hinting heavily that you're fucked if you choose to let anyone but an approved Apple tech crack open your iPhone.

Apple’s iPhone warranty is less explicit, but has this message in bold: "Important: Do not open the Apple Product. Opening the Apple Product may cause damage that is not covered by this Warranty. Only Apple or an AASP should perform service on this Apple Product." Apple is also known to refuse to service phones that have been opened by their owners or by third party repair professionals.

"May" and "should" are Apple's hedges against federal law. Apple figures this is enough to discourage people from doing repairs themselves or letting others do it for them. The letter of the law is respected. The spirit of the law, however, is subjected to a series of mean-spirited subtweets.

Apple further funnels repairwork to its own techs by refusing to release schematics and other repair-related info. Various "right to repair" bills are seeking to open up these walled repair gardens, but these have faced heavy opposition from several companies -- the same ones that periodically petition the Library of Congress to make repairs/modifications of their products illegal under the DMCA.

So, it's hardly a surprise that an "unauthorized" repairman would post a video hinting that he's facing legal threats from Apple for showing people how to fix their own MacBooks. (via Slashdot)

Louis Rossmann’s YouTube channel has been an invaluable source of detailed tutorials for DIY repairs, some of them detailing how to perform component replacements rather than the whole-board approach typically taken by Apple Stores. But in a somewhat vague video posted last night, Rossmann indicates that they may be about to disappear.

While Rossmann doesn’t say so explicitly, he implies that he has received a takedown notice for his videos, and Reddit is speculating that Apple may be behind it. It’s unclear what might form the basis of any takedown notice, though Rossmann does express strong views on Apple’s approach to repairs, and some of the videos do include Apple schematics. We’ve reached out to Apple and will update with any response.

The video is indeed cryptic. Rossmann points out that videos can be downloaded and hints that his channel may not be live for long. He also alludes to "being strong" and ready for a long fight, while noting all of his videos may soon be deleted.

The hints dropped here were enough that Game Revolution ran with the story, but subsequently deleted it when Rossmann provided more information. 9-to-5 Mac, however, kept its story live and updated it with Rossmann's comments. Apple isn't going to sue Rossmann or somehow shut down his YouTube account.

Louis Rossmann has posted a follow-up video in which he says that he has been contacted by IP lawyers acting for Apple but is not currently being faced with a lawsuit. He said there is an issue with a schematic, but Apple is said to like the channel.

Rossmann also says the conversation was "friendly" and that Apple's concern with the schematic was "understandable," but notes that it's a holiday weekend and he likely won't know anything more about the company's plans until Monday.

This is better behavior than one would expect from Apple, considering its history of making repair/DIY-unfriendly devices. But it also shows Apple is still interested in limiting the amount of repair-related information the public has access to. If it's trying to keep him from displaying a schematic or using that info to help people repair their own devices, then its legal muscle will achieve the same end, without the collateral PR damage that would come from kicking an "unauthorized" repairman off the internet.

Filed Under: intellectual property, repairs, schematics, warranties
Companies: apple, youtube

Beijing Regulators Block Sales Of iPhones, Claiming The Design Is Too Close To Chinese Company's Phone

from the live-by-rounded-corners,-die-by-rounded-corners dept

This one was so easy to predict. For the past couple of decades, completely clueless US politicians and bureaucrats (and tech company execs) have been screaming about how China "doesn't respect" our intellectual property. They demanded that China "get more serious" about patents and respecting IP. And for nearly a decade we've been warning those people to be careful what you wish for. Because, now China has massively ramped up its patent system, often by using odd incentives, but rather than helping American companies that demanded it, pretty much every patent lawsuit in China has been about a Chinese company punishing or blocking foreign competition. This is because the Chinese aren't stupid. It's a country that has thrived on protectionism, despite global efforts to "open up trade," and here it realized that the West was handing them the perfect trade barrier: one that let them say they were doing what the West wanted, while giving it the perfect excuse to block out foreign competition.

So, while clueless US and European IP bureaucrats celebrated China issuing so many patents, they totally missed that they'd actually given away everything.

And, now you get stories like this: Apple has been banned from selling the iPhone 6 or iPhone 6s in Beijing, because of patent infringement. Regulators found that the design was too similar to the design of a Chinese firm's phone.

Apple Inc. violated the design patents of a Chinese device maker and may have to halt sales of its latest iPhones in Beijing, the city’s intellectual property authority ruled, handing the U.S. company its latest setback in a pivotal market.

The iPhone 6 and iPhone 6 Plus infringe on Shenzhen Baili’s patent rights because of similarities to its 100C phone, the Beijing Intellectual Property Office wrote in its decision.

Live by rounded corner patents, die by rounded corner patents.

Many are speculating that Apple's recent $1 billion investment in the Chinese Uber clone Didi was in part to help deal with attacks like this. Basically every American company that wants to sell products in China ends up investing in Chinese companies for this kind of purpose. But, once again, just as we've been saying for years, the Chinese, unlike many in the West, absolutely recognize what patents are: a trade barrier, and they must love the fact that the US keeps asking them to build more trade barriers.

Until US patent officials finally understand that patents are not about innovation, but are really about restraints on trade, innovation and competition, we're only going to see more and more stories like this.

Filed Under: china, foreign competition, iphone, patents, protectionism, rounded corners
Companies: apple, shenzen baili

Apple, Arbiters Of Art, Say Game About Surviving The Gaza Strip Isn't A Game, Even Though It Is

from the art-thou-kidding? dept

Search for stories about Apple's App Store in the Techdirt archives and you will quickly notice a theme. That theme is that Apple routinely appoints itself as the arbiter of artistic quality and morality when it comes to content within the app store, particularly gaming content, and that its application of these standards swings like some kind of absurd pendulum. Ban a game over here for telling a bible story that includes violence against children, but allow the actual bible to be sold as well. React to the South Carolina massacre by pulling down games about the Civil War because they include images of the Confederate flag. Reject a wargaming simulation, then approve it, and nobody knows how the company might decide to react tomorrow. You often hear that stability breeds a good ground for business, whereas Apple runs its App Store like some kind of experiment in chaos.

And in order to apply its standards in a way that apparently makes the folks at Apple feel all warm and fuzzy inside, it occasionally has to truly lower its explanations to absurd levels of outright lying. For instance, Apple recently disallowed a game about surviving on the Gaza Strip in its store, claiming it wasn't a game at all, but a news publication, even though the briefest review of the app reveals that it's obviously a game.

A game about the Palestine/Israel conflict, Liyla and The Shadows of War, has proved too political for Apple. The technology giant ordered the developer, Rasheed Abueideh, to remove Liyla from the games section of its iTunes app store, claiming it isn't a game and should sit in the news section.

The real question is, is Liyla and The Shadows of War a game? I played it last night, as Liyla is available from Google Play. It's a short platformer with a powerful message and stunning graphics.

The writer goes on from there to describe the plot, the inclusion of reactions to real life events, the graphical elements of the game, and the, well, gameplay. Because it's a game. You have to play to get either a win or lose scenario, there are choices to be made, puzzles to be solved, and stages to complete. It's a platformer, like Mario Bros..

So, why the ban and the lies to support it? Well, one can understand that the Middle East conflict and the ongoing crisis between the Palestinians and the Israelis is among the most touchy of subjects. For a company that wants to keep its brand and its App Store squeaky clean, at least in its own mind, one can imagine that this kind of thing is something Apple wouldn't want to touch. But, misguided as this already is, it becomes all the more so when it can't even bother to stay consistent on the matter. The App Store has available for purchase, for instance, Israeli Heroes, which appears to be an Angry Birds clone in which you lob missiles at bombs that reside under a crescent moon and oh my god, I think I'm about to have an embolism, because come on.

As always, in the midst of this nonsense, the game is available for Android devices, because that garden has no wall around it.

For once, the phrase 'relax, it's just a game' seems apt. Apple take note. Liyla and The Shadows of War is available for Android on Google Play – it's free, it's short and it's definitely a game worth playing.

We've said it before, but we'll say it again: it'd be best if Apple would get out of the art critique business. They're not very good at it.

Filed Under: app store, censorship, games, gaza strip, itunes, video games, walled garden
Companies: apple

Senators Burr & Feinstein Write Ridiculous Ignorant Op-Ed To Go With Their Ridiculous Ignorant Bill

from the learn-something-people dept

Senators Richard Burr and Dianne Feinstein are not giving up that quickly on their ridiculous and technically ignorant plan to outlaw real encryption. The two have now penned an op-ed in the WSJ that lays out all the same talking points they've laid out before, without adding anything new. Instead, it just continues to make statements that show how incredibly ignorant they are. The piece is called Encryption Without Tears (and may be paywalled, though by now everyone knows how to get around that), which already doesn't make any sense. What they're pushing for is ending basic encryption, which will lead to many, many tears.

It starts out with their standard ridiculous line, pretending that because a company builds end-to-end encryption, it's acting "above the law."

In an increasingly digital world, strong encryption of devices is needed to prevent criminal misuse of data. But technological innovation must not mean placing individuals or companies above the law.

People have gone over this time and time again: this is not about anyone being "above the law." It's about whether or not companies can be forced to directly undermine the safety and security of their products (and the public). A paper shredder can destroy evidence. A paper shredder maker is not "above the law" when it decides not to build a system for piecing back together the shreds.

And speaking of "above the law" I still don't see Feinstein or Burr commenting on the FBI/DOJ announcing that it will ignore a court order to reveal how it hacked into computers over Tor. That is being above the law. That involves a situation where a court has asked for information that the FBI absolutely has. The FBI is just saying "nope." If Burr and Feinstein are really worried about being "above the law," shouldn't they worry about this situation?

Over the past year the two of us have explored the challenges associated with criminal and terrorist use of encrypted communications. Two examples illustrate why the status quo is unacceptable.

I love this. They give two examples that have been rolled out a bunch in the last few weeks. The attack in Garland, Texas, where the attackers supposedly exchanged some messages with potential ISIS people, and the case of Brittney Mills, who was tragically murdered, and whose case hasn't been solved. Mills had her smartphone, but no one can get into it. Of course, it took nearly two years of fretting before law enforcement could dig up these two cases, and neither make a very strong argument for why we need to undermine all encryption.

It's a simple fact that law enforcement never gets to have all of the evidence. In many, many, many criminal scenarios, that's just the reality. People destroy evidence, or law enforcement doesn't find it or law enforcement just doesn't understand it. That's not the end of the world. This is why we have police detectives, who are supposed to piece together whatever evidence they do have and build a picture for a case. Burr and Feinstein are acting like in the past, law enforcement immediately was handed all evidence. That's never been the way it works. Yes, law enforcement doesn't get access to some information. That's how it works.

You don't go and undermine the very basis of computer security just because law enforcement can't find a few pieces of evidence.

Our draft bill wouldn’t impose a one-size-fits-all solution on all covered entities, which include device manufacturers, software developers and electronic-communications services. The proposal doesn’t define the technological solutions or tell businesses how to solve the problem.

This is also misleading. The bill requires an end to real encryption. That's it. Real encryption means that only one person has the key. This is what Burr and Feinstein don't seem to get. They seem to think it's trivial to leave a key with Apple or whoever. But as basically every crypto expert has explained, it is not. Doing so creates a vulnerability... and worse, it's a vulnerability that cannot be patched. That's hellishly dangerous. Sure, the bill doesn't tell them exactly how to do this, but it does make it clear: you cannot offer real encryption, you can only offer something that can be hacked. That's a problem.

We want to provide businesses with full discretion to decide how best to design and build systems that maintain data security while at the same time complying with court orders.

We want to provide businesses with full discretion to decide how best to travel back in time, in order to prevent crimes.

Seriously: this is basically the same thing that Burr and Feinstein are saying here. They're asking for something that's impossible, and acting like it's a routine suggestion. If they need to comply with these All Writs Act style orders, they cannot build systems that maintain data security. That's a fact. It's mind-boggling that Burr and Feinstein still can't understand this.

Critics in the industry suggest that providing access to encrypted data will weaken their systems. But these same companies, for business purposes, already maintain and have access to vast amounts of encrypted personal information, such as credit-card numbers, bank-account information and purchase histories.

Argh. This paragraph shows that whatever poor staffer Burr and Feinstein assigned to write this drivel doesn't understand even the first thing about what he or she is talking about. Storing encrypted passwords, credit card info, bank account info, etc. is a totally different thing. Those are encrypted to keep them safe, and part of the reason they're encrypted is so that even those companies cannot reveal them. This point is making the opposite point of what Burr and Feinstein think. Companies encrypt passwords and credit card info and the like so that they're not storing the plaintext info, and there's no easy way for anyone to get that info. This protects user data, and the companies cannot actually provide the plaintext. They're comparing hashes. That's what keeps it safe.

If we received a court order demanding our users' passwords, we couldn't provide them. Because they're encrypted. We don't know our users' passwords and can't give them to you. When someone logs in to our website, we can compare a hash of their password to our hashed version and then if they match, we let them in. But we don't know what their password is. So this is a terrible example that actually goes against what Burr and Feinstein are saying. Those encrypted stores of information would be illegal under this bill!

We are not asking companies to provide law enforcement with unfettered access to encrypted data. We aren’t even asking companies to tell the government how they gain access to this encrypted data. All we are doing is asking companies to find a way to keep their data secure while also cooperating with law enforcement in terrorism and criminal investigations.

Again, that last line is impossible. They're asking the impossible -- and in the process, making everyone less safe. The only way to provide such info to law enforcement is to no longer keep the data truly secure. And the big concern is not unfettered access for law enforcement, but rather whatever this backdoor means for those with malicious intent, who will be very, very, very focused on finding these vulnerabilities and exploiting them.

President Obama said earlier this year, “You cannot take an absolutist view on this.” We agree—and believe that strong data security and compliance with the justice system don’t have to be mutually exclusive.

Because you don't know what you're talking about.

American technology companies have done some amazing things that are the envy of the world. We think that finding a way to achieve both goals simultaneously is not beyond their capabilities.

So, in the end, despite basically every cryptography expert telling them this is impossible, Burr and Feinstein come back with "NERD HARDER, NERDS!"

Filed Under: above the law, dianne feinstein, doj, encryption, fbi, going dark, richard burr
Companies: apple

FBI Spent $1.3 Million To Not Even Learn The Details Of The iPhone Hack... So Now It Says It Can't Tell Apple

from the wtf dept

Once the DOJ told the court in San Bernardino that it had succeeded in hacking into the iPhone of Syed Farook, the big question people asked is whether or not the FBI would then tell Apple about the vulnerability. After all, the administration set up the so-called "Vulnerabilities Equities Policy" (VEP) with the idea of sharing most vulnerabilities it discovers with companies. The White House directly stated:

One thing is clear: This administration takes seriously its commitment to an open and interoperable, secure and reliable Internet, and in the majority of cases, responsibly disclosing a newly discovered vulnerability is clearly in the national interest. This has been and continues to be the case.

This spring, we re-invigorated our efforts to implement existing policy with respect to disclosing vulnerabilities – so that everyone can have confidence in the integrity of the process we use to make these decisions. We rely on the Internet and connected systems for much of our daily lives. Our economy would not function without them. Our ability to project power abroad would be crippled if we could not depend on them. For these reasons, disclosing vulnerabilities usually makes sense. We need these systems to be secure as much as, if not more so, than everyone else.

Of course, there's a big "but" there -- and it's that there's an "exception" for law enforcement. Last fall, after (yet another) big legal fight, the good folks over at the EFF finally got access to the VEP details and you can now read a (heavily redacted) version.

Still, one could make a strong case that this vulnerability should be disclosed... even if almost no one expected it to be. Amusingly, just a few days ago, Apple revealed that the FBI used the VEP to disclose a vulnerability for the very first time, on April 14th, just as everyone was arguing about this. Of course, the flaw it revealed was not about hacking into the iPhone, and was actually about a flaw that Apple had discovered and fixed... nine months ago. But, again, if this is the very first time the FBI has disclosed something to Apple, it certainly suggests that the VEP process generally means nothing gets disclosed. In fact, the timing of this really suggests that someone in the DOJ recently flipped out and realized that there's now going to be scrutiny on the VEP, so they might as well disclose something. Thus, they found an old bug that had already been patched and "revealed" it.

Either way, things got stranger a couple of days later, when the FBI -- which had already admitted to paying over $1 million to access Farook's iPhone, said that, for all that money, the people it hired never explained the vulnerability. They just opened the phone. Really.

“The F.B.I. purchased the method from an outside party so that we could unlock the San Bernardino device,” Amy S. Hess, executive assistant director for science and technology, said in a statement.

“We did not, however, purchase the rights to technical details about how the method functions, or the nature and extent of any vulnerability upon which the method may rely in order to operate. As a result, currently we do not have enough technical information about any vulnerability that would permit any meaningful review” by the White House examiners, she said.

Now, some are arguing that this suggests absolutely terrible bargaining on the side of the DOJ/FBI. But, another interpretation is that it's how the DOJ knew that it wouldn't have to reveal the flaw to Apple. Of course, this might also explain why the DOJ at one point appeared to claim that the hack in question only worked for Farook's phone. They later claimed that was a misstatement, and it really meant that it only applied to that iPhone configuration. But, if the FBI never actually got the details, then in some sense they'd be right that for the FBI the crack only worked for that one phone. And if they wanted to do it on another phone, they'd have to shell out another ~$1 million or so...

Filed Under: doj, encryption, fbi, going dark, vep, vulnerabilities, vulnerabilities equity policy
Companies: apple

Even The Surveillance-Loving Wall Street Journal Is Bashing The FBI For Its War With Apple

from the didn't-see-that-one-coming dept

The Wall Street Journal has been a reliably pro-surveillance voice over the years, calling Snowden a "sociopath" while calling for even less NSA oversight, making up bizarre conspiracy theories, and fighting back against any surveillance reform. It even once argued that the tech industry should put backdoors into its encryption to better help the surveillance state.

That's what makes its recent editorial, The Encryption Farce (possibly behind a paywall, though the version I just opened showed up fine), so remarkable. It completely bashes the FBI over its attempts to force Apple to build a backdoor into its encryption -- though mainly because of the ridiculous fact that in the two most high profile cases, the DOJ magically got into the phones just as the cases got serious. The WSJ editorial doesn't pull any punches, asking what the hell is going on at the Justice Department:

If history repeats itself first as tragedy and then as farce, what does the FBI have in store next for its encryption war with Apple? After withdrawing its demands in San Bernardino and then reopening hostilities with a drug prosecution in Brooklyn, the G-men abruptly dumped the second case over the weekend too. Is anyone in charge at the Justice Department, or are junior prosecutors running the joint?

The editorial goes on to mock the FBI's claim that these cases are all about getting into just that phone, and notes that constantly finding ways in at the last minute are destroying the FBI's credibility.

This second immaculate conception in as many months further undermines the FBI’s credibility about its technological capabilities. Judges ought to exercise far more scrutiny in future decryption cases even as Mr. Comey continues to pose as helpless.

It goes on to suggest that the FBI stop bringing these cases, and that the President and the DOJ should put an end to this ridiculous attack on encryption:

Yet forgive us if this “conversation” now seems more like a Jim Comey monologue. The debate might start to be productive if the FBI Director would stop trying to use the courts as an ad hoc policy tool and promised not to bring any more cases like the one in Brooklyn.

Meanwhile, the White House has taken the profile-in-courage stand of refusing to endorse or oppose any encryption bill that Congress may propose. If the Obama team won’t start adjusting to the technological realities of strong and legal encryption, they could at least exercise some adult supervision at Main Justice.

On its own, such an editorial might not seem like a huge deal, but coming from the Wall Street Journal -- a source that has previously championed much greater surveillance and even supported backdoors -- it's a surprising shift. And it shows just how badly the DOJ and FBI miscalculated in their attempts to use the courts to get their desired results in breaking encryption.

Filed Under: all writs act, doj, encryption, fbi
Companies: apple, wall street journal

DOJ Drops Other Big Case Over iPhone Encryption After Defendant Suddenly Remembers His Passcode

from the wait,-what? dept

While so much of the attention had been focused on the case in San Bernardino, where the DOJ was looking to get into Syed Farook's iPhone, we've pointed out that perhaps the more interesting case was the parallel one in NY (which actually started last October), where the magistrate judge James Orenstein rejected the DOJ's use of the All Writs Act to try to force Apple to help unlock the iPhone of Jun Feng, a guy who had already pled guilty on drug charges, but who insisted he did not recall his passcode.

There were some oddities in the case. Feng had pled guilty and there was some issue over whether or not there was still a need to get into the iPhone. The DOJ insisted yes, because Feng's iPhone might provide necessary evidence to find others involved in the drug ring. The other oddity: Feng's iPhone was running iOS7. While the device itself was a newer model iPhone than the one in the Farook case, it still has an older operating system, where it was known that Apple (and others) could easily get in. So it made no sense that the FBI couldn't get into this phone. In fact, Apple's latest filing in the case, just over a week ago was basically along those lines, noting that the DOJ claimed Apple's assistance was "necessary," but that seemed unlikely.

And... late on Friday, the DOJ did the exact same "run away!" move it did in the Farook case, telling the judge that it had suddenly been given the passcode, so there was no need to move forward with the case at all.

The government respectfully submits this letter to update the Court and the parties. Yesterday evening, an individual provided the passcode to the iPhone at issue in this case. Late last night, the government used that passcode by hand and gained access to the iPhone. Accordingly, the government no longer needs Apple’s assistance to unlock the iPhone, and withdraws its application.

According to a (paywalled) WSJ article, Feng, who has been waiting for his sentencing, and thinking that his case was otherwise over, only just found out that there was this big fuss around his own case... and told the DOJ he miraculously remembered the passcode. Hallelujah. A miracle... and the DOJ was magically saved from a precedent it didn't want.

The Wall Street Journal reported last week that Mr. Feng only recently learned his phone had become an issue in a high-stakes legal fight between prosecutors and Apple. Mr. Feng, who has pleaded guilty and is due to be sentenced in the coming weeks, is the one who provided the passcode to investigators, according to people familiar with the matter.

Of course, it's worth noting, however that while this particular case may be effectively over, it's not that great for the DOJ, in that no one got to officially review magistrate judge James Orenstein's fairly epic smackdown of the DOJ earlier in the case. That, of course, has no value as a precedent, but that doesn't mean it won't be quoted or pointed to in other, similar cases.

On the flip side, of course, there's the argument that every time the case starts looking bad for the DOJ, they miraculously get into the phone in question. At the very least, this ought to raise questions about why the DOJ keeps insisting that it needs Apple's help... But the fact is these cases are going to keep coming.

Filed Under: all writs act, doj, encryption, going dark, iphone, jun feng, passcode
Companies: apple

FBI Allegedly Paid More Than $1 Million To Get Into Encrypted iPhone... And To Avoid Setting Legal Precedent It Didn't Like

from the just-saying dept

On Thursday, FBI Director James Comey suggested that the FBI paid over a million dollars to a group of hackers who helped it get into Syed Farook's encrypted work iPhone. Of course, just as pretty much everyone predicted, the FBI found nothing of value on the iPhone. This was hardly a surprise. It was a case where we already know who did it, and that they were already dead. We also know that they destroyed their two personal iPhones, leaving open the question why anyone would think there was anything valuable on the work iPhone.

Specifically, Comey said that buying the exploit from this group cost the FBI "more than I will make in the remainder of this job, which is seven years and four months, for sure." Comey makes $185,100 per year at his job, implying that buying the exploit cost at least $1.3 million or so.

This has, understandably caused some to ask how it could possibly be worth it to pay so much money for an exploit that everyone must have known was worthless.

It would have been more responsible to give the FBI’s slush fund over to the victims’ families than to pursue such an obvious non-lead.

— Jonathan Zdziarski (@JZdziarski) April 21, 2016

Things that would've better served the American public with $1.3M than Comey's goose chase: Mental health funding.

— Jonathan Zdziarski (@JZdziarski) April 21, 2016

Of course, that is taking a slightly narrow view on things, considering that many people believe, strongly, that the FBI's motive here was really to extricate itself from the legal dispute over the phone that had the very strong potential of ending with a bad precedent for the FBI and the DOJ. When looked at through that lens, $1.3 million or whatever seems like very little money to pay...

Filed Under: doj, fbi, hack, iphone, james comey, precedent, syed farook
Companies: apple