We Read The DOJ's Latest Apple Filing To Highlight All Of Its Misleading Claims

from the uh,-that's-not-how-this-works dept

Support our crowdfunding campaign to help us keep covering stories like these!

The Justice Department has now filed its response to Apple's motion to vacate being forced to undermine the security features of Syed Farook's work iPhone. It's... quite a piece of work. The DOJ is pulling out all the stops in this one, and it seems to be going deeper and deeper into the ridiculous as it does so. Of course, it repeats many of the arguments in its earlier filings (both its original application for the All Writs Order as well as its Motion to Compel -- which even the judge told the DOJ she didn't think it should file). For example, it continues to assert that this should be judged on the "three factor test" that it made up from a Supreme Court decision that doesn't actually have a three factor test.

But the crux of the DOJ's argument is basically "how dare Apple make a warrant-proof phone" and thus it's Apple's fault that they haven't made it easy for the FBI to get what it wants. This argument is bonkers on many levels. Let's dig in:

By Apple’s own reckoning, the corporation—which grosses hundreds of billions of dollars a year—would need to set aside as few as six of its 100,000 employees for perhaps as little as two weeks. This burden, which is not unreasonable, is the direct result of Apple’s deliberate marketing decision to engineer its products so that the government cannot search them, even with a warrant.

This is a purposeful misrepresentation. The issue here is that the judge has made it clear that the key issue that she's concerned with is whether or not the request from the DOJ represents an "unreasonable burden" on Apple -- as the "burden" is the only actual test laid out in the US v. NY Telephone case the DOJ keeps pointing to. But Apple didn't present the time and manpower to show that it's the resources that are the unreasonable burden, but the potential impact on the safety and security of its customers. Focusing on the time is not the issue, but of course, the DOJ pretends it is.

Second, the DOJ's continued its ridiculous insistence that making your products safe and secure is a "deliberate marketing decision" -- which somehow makes it offensive in some way. Apple didn't engineer its products "so that the government cannot search them," it's so that your information is safe and secure from anyone, including criminals. You would think that law enforcement people in the FBI and DOJ would appreciate more secure devices that reduce crime. There was a time that they did. To sneeringly suggest that better protecting the public is nothing more than a "marketing decision" is ridiculous. Hell, even if it was a "marketing decision," a big part of the reason that "the market" wanted such features so badly was because the US government itself overstepped its bounds with mass surveillance.

The Court’s Order is modest. It applies to a single iPhone, and it allows Apple to decide the least burdensome means of complying. As Apple well knows, the Order does not compel it to unlock other iPhones or to give the government a universal “master key” or “back door.” It is a narrow, targeted order that will produce a narrow, targeted piece of software capable of running on just one iPhone, in the security of Apple’s corporate headquarters.

It has been explained -- at length -- by both Apple and various amicus briefs, how ridiculous this is. Everyone -- including the FBI -- has now admitted that this case is almost entirely about the precedent, and that a win for the DOJ will inevitably mean a long line of law local and federal law enforcement lining up outside Apple's headquarters in Cupertino with court orders in their hands, demanding that Apple help them crack into iPhones. That's a big deal. It also sets a precedent even beyond Apple, that companies can be forced to deliberately (1) weaken security on their devices and services and (2) lie to the public about it by "signing" the devices as legit.

The government and the community need to know what is on the terrorist’s phone, and the government needs Apple’s assistance to find out.

No it does not need to know and no it does not need Apple's assistance. Again, there is always evidence that is off-limits in criminal investigations, and there are ways in which the FBI can likely get into this particular phone.

Instead of complying, Apple attacked the All Writs Act as archaic, the Court’s Order as leading to a “police state,” and the FBI’s investigation as shoddy, while extolling itself as the primary guardian of Americans’ privacy.... Apple’s rhetoric is not only false, but also corrosive of the very institutions that are best able to safeguard our liberty and our rights: the courts, the Fourth Amendment, longstanding precedent and venerable laws, and the democratically elected branches of government.

Apple didn't attack the AWA as "archaic" so much as inapplicable in this situation. Once again, the DOJ is doing some serious misrepresentation in this filing (and we're just three paragraphs in).

This case—like the three-factor Supreme Court test on which it must be decided—is about specific facts, not broad generalities. Here, Apple deliberately raised technological barriers that now stand between a lawful warrant and an iPhone containing evidence related to the terrorist mass murder of 14 Americans. Apple alone can remove those barriers so that the FBI can search the phone, and it can do so without undue burden. Under those specific circumstances, Apple can be compelled to give aid. That is not lawless tyranny. Rather, it is ordered liberty vindicating the rule of law. This Court can, and should, stand by the Order. Apple can, and should, comply with it.

Three factors! Drink! And, yes, Apple put in place these "barriers," but not as barriers to the government, but as security for everyone -- and there's a very big question, which the DOJ so desperately wishes to avoid with the mumble jumble above, which is whether or not a company can be forced to purposely write and sign code that deliberately undermines security features.

In deciding New York Telephone, the Supreme Court directly confronted and expressly rejected the policy arguments Apple raises now. Like Apple, the telephone company argued: that Congress had not given courts the power to issue such an order in its prior legislation; that the AWA could not be read so broadly; that it was for Congress to decide whether to provide such authority; and that relying on the AWA was a dangerous step down a slippery slope ending in arbitrary police powers.

Once again, the DOJ is misrepresenting the issues at play both in this case and in NY Telephone. In that case, a key part of the SCOTUS decision was based on the fact that NY Telephone was a public utility and therefore had certain responsibilities. That's not true of Apple. The DOJ also misrepresents the Congressional situation, which is different here, in that Congress did pass a specific law in this area, CALEA, which explicitly says that Apple need not help in this situation. The All Writs Act is a "gap filling" law, for when Congress has not spoken. But on this issue, it has.

The Supreme Court’s approach to the AWA does not create an unlimited source of judicial power, as Apple contends. The Act is self-limiting because it can only be invoked in aid of a court’s jurisdiction. Here, that jurisdiction rests on a lawful warrant, issued by a neutral magistrate pursuant to Rule 41. And New York Telephone provides a further safeguard, not through bright-line rules but rather through three factors courts must consider before exercising their discretion: (1) how far removed a party is from the investigative need; (2) how unreasonable a burden would be placed on that party; and (3) how necessary the party’s assistance is to the government. This three-factor analysis respects Congress’s mandate that the Act be flexible and adaptable, while eliminating the concern that random citizens will be forcibly deputized.

Three factors! Drink!

The DOJ insists that even with CALEA not saying it can do this, that doesn't matter, because CALEA is all about what companies can be forced to do prior to a warrant, not after.

CALEA, passed in 1994, does not “meticulously,” “intricately,” or “specifically” address when a court may order a smartphone manufacturer to remove barriers to accessing stored data on a particular smartphone. Rather, it governs what steps telecommunications carriers involved in transmission and switching must take in advance of court orders to ensure their systems can isolate information to allow for the real-time interception of network communications

But of course, under that interpretation, then the All Writs Act grants tremendous powers -- exactly the kinds of powers the DOJ insists elsewhere in this brief that isn't at issue in this case. I don't see how the DOJ can have it both ways.

As Apple recognizes, this Court must consider three equitable factors: (1) how “far removed” Apple is “from the underlying controversy”; (2) how “unreasonable [a] burden” the Order would place on Apple; and (3) how “necessary” its assistance is to searching Farook’s iPhone.

Three factors! Drink!

Apple is not so far removed from the underlying controversy that it should be excused from assisting in the execution of the search warrant. In New York Telephone, the phone company was sufficiently close to the controversy because the criminals used its phone lines. See 434 U.S. at 174. The Court did not require that the phone company know criminals were using its phone lines, or that it be involved in the crime. See id. Here, as a neutral magistrate found, there is probable cause to believe that Farook’s iPhone contains evidence related to his crimes. That alone would be sufficient proximity under the AWA and New York Telephone, even if Apple did not also own and control the software on Farook’s iPhone.

But again, under such an interpretation, the AWA can be used to force basically any tech company to figure out ways to spy on users if the FBI comes calling and gets a magistrate judge to rubber stamp an order. That's... crazy. Just because they use your technology does not mean that you're somehow legally on the hook for helping the FBI investigate their usage.

As Apple’s business model and its representations to its investors and customers make clear, Apple intentionally and for commercial advantage retains exclusive control over the software that can be used on iPhones, giving it monopoly-like control over the means of distributing software to the phones. As detailed below, Apple does so by: (1) firmly controlling iPhones’ operating systems and first-party software; (2) carefully managing and vetting third-party software before authenticating it for use on iPhones; and (3) continually receiving information from devices running its licensed software and its proprietary services, and retaining continued access to data from those devices about how its customers are using them. Having established suzerainty over its users’ phones—and control over the precise features of the phones necessary for unlocking them—Apple cannot now pretend to be a bystander, watching this investigation from afar.

This is kind of an incredible argument when you think about it: because Apple makes sure that its devices have updated software to keep it safe from vulnerabilities, that means that Apple is somehow connected to any use of the phone and responsible for helping the FBI crack into the phone. Does the FBI really want to encourage companies to stop offering any follow on support for software? Because that's the argument they're making here.

Thus, by its own design, Apple remains close to its iPhones through careful management and constant vigil over what software is on an iPhone and how that software is used. Indeed, Apple is much less “removed from the controversy”—in this case, the government’s inability to search Farook’s iPhone—than was the New York Telephone company because that company did not deliberately place its phone lines to prevent inconspicuous government access.... Here, Apple has deliberately used its control over its software to block law-enforcement requests for access to the contents of its devices, and it has advertised that feature to sell its products.

This argument is particularly maddening: basically continuing the ridiculous line of thinking that protecting user privacy is some sort of deliberate marketing strategy against the government, rather than in favor of protecting customers' own security and privacy.

And then we get even more maddening. In discussing the "burden" the DOJ literally tries to argue that if there is a burden, it's Apple's fault for designing a system so secure.

Apple is one of the richest and most tech-savvy companies in the world, and it is more than able to comply with the AWA order. Indeed, it concedes it can do so with relatively little effort. Even this modest burden is largely a result of Apple’s own decision to design and market a nearly warrant-proof phone.

This is monumentally misleading. The whole DOJ premise is that Apple deliberately is trying to interfere with legal investigations. But that's bonkers. Apple is just trying to build a secure phone for its users -- and a natural and unavoidable consequence of that is that it makes it more difficult for law enforcement to get access to that info. But that's because the whole point of such security is to make it more difficult for everyone who is not the phone's owner to get access, because that's how you protect them.

The DOJ is so vain it thinks Apple's security is all about them.

Then we get back to the lying:

Apple’s primary argument regarding undue burden appears to be that it should not be required to write any amount of code to assist the government.

Not really. Its primary argument is that the burden is in writing any amount of code that undermines the safety and security of its customers. That last part is kind of the important part. No wonder the DOJ ignores it.

Apple asserts that it would take six to ten employees two to four weeks to develop new code in order to carry out the Court’s Order.... Even taking Apple at its word, this is not an undue burden, especially given Apple’s vast resources and the government’s willingness to find reasonable compromises and provide reasonable reimbursement.

Apple is a Fortune 5 corporation with tremendous power and means: it has more than 100,000 full-time-equivalent employees and had an annual income of over $200 billion dollars in fiscal year 2015—more than the operating budget for California.... Indeed, Apple’s revenues exceed the nominal GDPs of two thirds of the world’s nations. To build the ordered software, no more than ten employees would be required to work for no more than four weeks, perhaps as little as two weeks.

Again, this is misleading (sense a theme?). First, as noted above, the "burden" is not so much in the time or engineers allotted to this issue. Second, even if we accept the DOJ's assertions here, it's misleading. The Apple filing noted that it would take that much effort just to create the initial code and to test it, but then noted -- quite rightly -- that if in the testing any problems arose, as they almost certainly would, it would need to basically redo the process. Part of the point, which can slip by non-technical people who have no experience developing and deploying code, is that this process could take a long, long time, and involve a lot of effort before it's actually safe to use on the actual phone.

Next up, the DOJ continues to insist that there can't possibly be any danger in creating this code, because Apple surely knows how to guard it, and further, that even if the code got out, that it wouldn't matter because it's asking for code that will only run on the Farook phone.

Next, contrary to Apple’s stated fears, there is no reason to think that the code Apple writes in compliance with the Order will ever leave Apple’s possession. Nothing in the Order requires Apple to provide that code to the government or to explain to the government how it works. And Apple has shown it is amply capable of protecting code that could compromise its security. For example, Apple currently protects (1) the source code to iOS and other core Apple software and (2) Apple’s electronic signature, which as described above allows software to be run on Apple hardware.... Those —which the government has not requested—are the keys to the kingdom. If Apple can guard them, it can guard this.

But, again, that leaves out the reality of testing this particular code and how that makes it much more likely the code will get out. This argument was presented in the amicus brief filed by iPhone forensics and security experts.

Next up, the DOJ totally misrepresents Apple's current assistance to government requests for information from the Chinese government. The DOJ is trying to argue, misleadingly, that Apple has no problem doing the same stuff for China, so that its worries about this case, creating a precedent for authoritarian regimes, is nonsense. But it's the DOJ's argument that's truly nonsense:

Apple suggests that, as a practical matter, it will cease to resist foreign governments’ efforts to obtain information on iPhone users if this Court rules against it. It offers no evidence for this proposition, and the evidence in the public record raises questions whether it is even resisting foreign governments now. For example, according to Apple’s own data, China demanded information from Apple regarding over 4,000 iPhones in the first half of 2015, and Apple produced data 74% of the time.... Apple appears to have made special accommodations in China as well: for example, moving Chinese user data to Chinese government servers, and installing a different WiFi protocol for Chinese iPhones.... Such accommodations provide Apple with access to a huge, and growing, market.... This Court’s Order changes neither the carrots nor the sticks that foreign governments can use on Apple. Thus, it does not follow that if America forgoes Apple’s assistance in this terrorism investigation, Apple will refuse to comply with the demands of foreign governments. Nor does it follow that if the Court stands by its Order, Apple must yield to foreign demands, made in different circumstances without the safeguards of American law.

What the DOJ is referring to here is Apple's latest transparency report in which it notes that it complied with 74% of government requests for information from China. You can see it here: But again, Apple has always been willing to respond to legitimate government requests for information that it has access to. That's why that same chart shows that it complied with 81% of US requests as well. But that says absolutely nothing about the requirement to build a special system to hack in and access data that it does not currently have access to.

The rest of the China stuff, about servers and WAPI, is just the DOJ picking up on Stewart Baker's conspiracy theory that he posted a few weeks back. Lots of countries (stupidly) demand local storage, not necessarily because of surveillance reasons, but because they think it's good for their economy. And the reason Apple used WAPI was because that was the standard used in China for WiFi-like wireless. And as for the idea that Apple magically gave access to the Chinese, that makes no sense, given that Apple then had to fight a man in the middle attack against iCloud in China that was claimed to have originated from the Chinese government. If Apple gave it access, why would the government need to run a MiTM attack? The whole argument makes no sense.

In the first half of 2015 alone, Apple handled 27,000 “device requests”—often covering multiple devices—and provided data approximately 60% of the time.... If Apple can provide data from thousands of iPhones and Apple users to China and other countries, it can comply with the AWA in America. (Id.) This is not speculation because, in fact, Apple complied for years with American court orders to extract data from passcode-locked iPhones, dedicating infrastructure and personnel in order to do so.

Again that's different. That's about supplying the info that Apple had access to and not about writing code to undermine security features. Apples and oranges.

Finally, the DOJ mocks Apple's constitutional arguments on the First and Fifth Amendments.

Apple’s claim is particularly weak because it does not involve a person being compelled to speak publicly, but a for-profit corporation being asked to modify commercial software that will be seen only by Apple. There is reason to doubt that functional programming is even entitled to traditional speech protections....

To the extent Apple’s software includes expressive elements—such as variable names and comments—the Order permits Apple to express whatever it wants, so long as the software functions.

We're not "compelling" you to say this exactly, we're letting you say whatever you want... so long as it does what we want it to. That still seems like compelled speech, no?

Apple lastly asserts that the Order violates its Fifth Amendment right to due process. Apple is currently availing itself of the considerable process our legal system provides, and it is ludicrous to describe the government’s actions here as “arbitrary.”

Once again, it appears that many of the DOJ's arguments here are misleading in the extreme. Apple's response is due next week, and I imagine it will be quite a read as well.

Support our crowdfunding campaign to help us keep covering stories like these!

Filed Under: all writs act, china, doj, encryption, fbi
Companies: apple

Apple Engineering VP: The FBI Wants Us To Make Everyone Less Safe

from the that's-a-problem dept

As so many have tried to frame the Apple v. FBI fight as one of "privacy v. security," the fact is that it's really about security v. security, where it really comes down to what are you more afraid of: the off-chance that someone will secretly plan a terrorist attack on an encrypted iPhone, or the much more likely issue with millions of phones being stolen or hacked into by criminals looking to swipe your private information. Apple's VP of software engineering, Craig Federighi, had now taken to the pages of the Washington Post to try to highlight this issue, and explain that the FBI and DOJ are really trying to make everyone a lot less safe.

But the threat to our personal information is just the tip of the iceberg. Your phone is more than a personal device. In today’s mobile, networked world, it’s part of the security perimeter that protects your family and co-workers. Our nation’s vital infrastructure -- such as power grids and transportation hubs -- becomes more vulnerable when individual devices get hacked. Criminals and terrorists who want to infiltrate systems and disrupt sensitive networks may start their attacks through access to just one person’s smartphone.

And he also has a good response to those, like Manhattan DA Cyrus Vance, who insist that they just want Apple "to go back" to the way they had security on phones prior to iOS 8. In other words, make everyone less secure. Their argument is that if that was okay a few years ago, why isn't it okay now. And the answer is that security holes are found over time and they make systems less and less secure. So taking a step back is not just like going back a couple of years, but much, much worse, because now lots of people know how to get past the security features:

Of course, despite our best efforts, nothing is 100 percent secure. Humans are fallible. Our engineers write millions of lines of code, and even the very best can make mistakes. A mistake can become a point of weakness, something for attackers to exploit. Identifying and fixing those problems are critical parts of our mission to keep customers safe. Doing anything to hamper that mission would be a serious mistake.

That’s why it’s so disappointing that the FBI, Justice Department and others in law enforcement are pressing us to turn back the clock to a less-secure time and less-secure technologies. They have suggested that the safeguards of iOS 7 were good enough and that we should simply go back to the security standards of 2013. But the security of iOS 7, while cutting-edge at the time, has since been breached by hackers. What’s worse, some of their methods have been productized and are now available for sale to attackers who are less skilled but often more malicious.

And, as he notes, the FBI's demands in the San Bernardino case are akin to doing the same thing to the security of iOS 8: creating a vulnerability that will almost certainly "spread around the world in the blink of an eye." It's a good, straightforward piece explaining why the FBI and DOJ's demands are so dangerous here.

Filed Under: craig federighi, encryption, protection, security
Companies: apple

GCHQ Boss Says Tech Companies, Government Should Work Together To Give The Government What It Wants

from the putting-the-'I'-back-in-'team' dept

The head of GCHQ has decided to make some belated overtures to the tech companies intelligence agencies have alienated over the past few years. With the UK's ever-evolving Investigatory Powers Act hanging around like an unwanted, hungover and extremely nosy houseguest, GCHQ Director Robert Hannigan says it's time for the government and tech companies to work together for the mutual betterment of both to give government agencies the access they're stopping just short of legislating into existence.

He starts by stating he doesn't want to ban encryption or demand backdoors…

“It should be possible for technical experts to sit down together and work out solutions,” he said. “I am not in favor of banning encryption. Nor am I asking for mandatory back doors. …

...before stating that backdoors would be a wonderful thing. They just might need to undergo rebranding.

"Not everything is a back door, still less a door which can be exploited outside a legal framework."

OH. You want those kinds of backdoors: the ones that can only be solely exploited within a legal framework. Sorry, we're fresh out. It's not that tech companies don't want to help, but even "technical experts" can't craft an exploitable "not a backdoor" that can only be exploited by whoever the government decides should be able to exploit it. ("Working together" or not, it will be the government that determines access, rather than the technical experts at tech companies who designed it.)

So, Hannigan doesn't want a backdoor. He wants another set of keys for the front door and is requesting that all parties work together to decide whether this set should be left in the mailbox or under the welcome mat. This skewed view likely comes from Hannigan's assumption that the many years of tech compnany cooperation intelligence and law enforcement agencies have enjoyed comes from a deep well of heartfelt goodwill, rather than numerous laws compelling them to do so.

Nonetheless, Hannigan—making just his second appearance in a public forum since taking the helm of GCHQ in 2014—said tech companies should work more closely with governments to try to come up with ways to give law enforcement what it wants. “The perception that there is nothing but conflict between governments and the tech industry is a caricature,” he said in his speech. “In reality, companies are routinely providing help within the law, and I want to acknowledge that today.”

It may have been less of a caricature pre-2013, but it was never simply about tech companies giving the government whatever it wanted whenever it asked for it. That's why the world's intelligence agencies are hoarding exploits, buying malware from shady merchants, and intercepting hardware shipments to add their own backdoors.

And so, yet another request goes out for cooperation in the ongoing search for an intelligence/law enforcement unicorn while War's "Why Can't We Be Friends?" plays in the background. Nothing's going to move forward until officials like Hannigan admit the thing they want (a safe backdoor) isn't something they can actually have -- at least not without a lot of collateral damage. If they can at least be honest enough to state they want it no matter how many problems it causes elsewhere, then maybe they'll be ready to move to the next level of discussion -- even if the "next level" means the discussion has reached its logical endpoint.

Filed Under: backdoors, encryption, gchq, robert hannigan, uk
Companies: apple

Apple Might Be Forced To Reveal & Share iPhone Unlocking Code Widely

from the not-so-easy dept

Among the many questions swirling around the challenge to U.S. Magistrate Judge Sheri Pym's Order that Apple create software to bypass the iPhone passcode screen, a matter of paramount public interest may have been overlooked: Even if the government prevails in compelling Apple to bypass these iPhone security features: (A) evidence for use in a criminal trial obtained in this way will be challenged under the Daubert standard (described below) and the evidence may be held to be inadmissible at trial; and (B) the Daubert challenge may require disclosure of Apple's iPhone unlocking software to a number of third parties who would require access to it in order to bring the Daubert challenge and who may not secure the new software adequately. To state that neither consequence would be in the public interest would be an understatement in the extreme.

The Daubert challenge would arise because any proffered evidence from the subject iPhone would have been obtained by methodology utilizing software that had never been used before to obtain evidence in a criminal trial. The Supreme Court, in Daubert v. Merrill-Dow Pharmaceutical-Dow Pharmaceuticals, Inc., held that new methodologies from which proffered evidence is derived must, when challenged, be substantiated by expert scientific testimony in order to be admissible. In Daubert, the court stated that the criteria that must be utilized when faced with a defense challenge to scientific testimony and evidence are:

1. Can the methodology used to reach the expert's conclusion (the new software here) be tested and verified?
2. Have the methodology and software been peer-reviewed and has the review been published in a peer-reviewed journal?
3. Do the techniques used to reach the conclusion (here, to obtain the evidence) have an ascertainable error rate?
4. Has the methodology used to generate the conclusion (the evidence) been generally accepted by the relevant scientific community?

Under the Daubert standards, introduction of evidence from the iPhone, electronic communications and data stored in the phone, would require the testimony of an expert witness to, among other things:

• establish the integrity of the data (and its reliability) throughout the chain of custody;
• explain whether any person or software could modify the data coming off of the phone;
• verify that the data that came off the phone as delivered by Apple and held by law enforcement was the data that had originally been on the phone;
• explain the technical measures, such as the digital signatures attached to the data, used ensure that no tampering has occurred and their likely error rates.

Such an expert would, in preparation for his or her testimony, require access to and examination of the software, as it is inconceivable that defense counsel would simply accept the testimony of the Apple personnel without also demanding that their own, third-party, experts have access to the code.

In addition, defense counsel would undoubtedly demand the right for their own third-party experts to have access not only to the source code, but to further demand the right to simulate the testing environment and run this code on their own systems in order to confirm the veracity of evidence. This could easily compromise the security of the new unlocking code, as argued by in the amicus brief filed with Judge Pym by Jennifer Granick and Riana Pfefferkorn from Stanford's Center for Internet and Society (also covered previously by Techdirt):

There is also a danger that the Custom Code will be lost or stolen. The more often Apple must use the forensic capability this Court is ordering it to create, the more people have to have access to it. The more people who have access to the Custom Code, the more likely it will leak. The software will be valuable to anyone eager to bypass security measures on one of the most secure smartphones on the market. The incentive to steal the Custom Code is huge. The Custom Code would be invaluable to identity thieves, blackmailers, and those engaged in corporate espionage and intellectual property theft, to name a few. 

Ms. Granick and Ms. Pfefferkorn may not have contemplated demands by defense counsel to examine the software on their own systems and according to their own terms, but their logic applies with equal force to evidentiary challenges to the new code: The risk of the software becoming public increases when it is examined by multiple defense counsel and their experts, on their own systems, with varying levels of technical competency. Fundamentally, then, basic criminal trial processes such as challenges to expert testimony and evidence that results from that testimony based on this new software stand in direct tension with the public interest in the secrecy and security of the source code of the new iPhone unlocking software.

At best, none of these issues can be resolved definitively at this time because the software to unlock the phone has not been written. But the government's demand that the court force Apple to write software that circumvents its own security protocols maybe shortsighted as a matter of trial strategy, in that any evidence obtained by that software may be precluded following a Daubert inquiry. Further, the public interest may be severely compromised by a court order directing that Apple to write the subject software because the due process requirements for defense counsel and their experts to access the software and Apple's security protocols may compromise the secrecy necessary to prevent the proposed workaround from becoming available to hackers, foreign governments and others. No matter what safeguards are ordered by a court, security of the new software may be at considerable risk because it is well known that no security safeguards are impregnable.

The government may be well advised to heed the adage, "Be careful what you ask for. You may just get it." Its victory in the San Bernardino proceedings may be worse than Pyrrhic. It could be dangerous.

Kenneth N. Rashbaum is a Partner at Barton, LLP in New York, where he heads the Privacy and Cybersecurity Practice. He is an Adjunct Professor of Law at Fordham University School of Law, Chair of the Disputes Division of the American Bar Association Section of International Law, Co-Chair of the ABA Section of International Law Privacy, E-Commerce and Data Security Committee and a member of the Section Council. You can follow Ken @KenRashbaum

Liberty McAteer is an Associate at Barton LLP. A former front-end web developer, he advises software developers and e-commerce organizations on data protection, cybersecurity and privacy, including preparation of security and privacy protocols and information security terms in licensing agreements, service level agreements and website terms of service. You can follow Liberty @LibertyMcAteer

Filed Under: daubert standard, doj, encryption, evidence, fbi, security
Companies: apple

DOJ Keeps Pointing To A '3 Factor Test' In Its Cases Against Apple; Except No Such 'Test' Exists

from the making-it-up-as-we-go-along dept

The deeper you dive into the various DOJ filings to try to use the All Writs Act to force Apple to hack into encrypted iPhones, the more and more dishonest they seem. We already covered some of the misleading claims in the DOJ's latest filing in NY, including pointing to a 2012 case as evidence that the All Writs Act can be used to force Apple to break into a phone, when the actual ruling in that case said only that Apple had standing to oppose an All Writs Act order.

However, buried in an excellent article by Sarah Jeong at Vice's Motherboard about that same filing, there's another interesting tidbit that seems worth exploring: in both the NY and California cases, the DOJ has repeatedly pointed to a so-called "three factor test" under United States v. New York Telephone Co., which is the key case that established that it's acceptable, under the All Writs Act, for the FBI to force a telephone company to install and use a "pen register" device on telephone lines (to track who they call). In the original motion for the order in the San Bernardino case, here's the DOJ's argument on page 14 and 15 of that document:

In New York Telephone Co., the Supreme Court considered three factors in concluding that the issuance of the All Writs Act order to the phone company was appropriate. First, it found that the phone company was not "so far removed from the underlying controversy that its assistance could not be permissibly compelled." ... Second, it concluded that the order did not place an undue burden on the phone company.... Third, it determined that the assistance of the company was necessary to achieve the purpose of the warrant.... Each of these factors supports issuance of the order directed to Apple in this case.

The DOJ repeated this paragraph verbatim in its motion to compel (on page 15) and again (verbatim) in the filing in NY (page 38).

The magistrate judge in NY, James Orenstein, accepted this three factors test, and used it to argue that the DOJ's application actually failed to meet the requisite factors (starting right on page 1):

In addition, applicable case law requires me to consider three factors in deciding whether to issue an order under the AWA: the closeness of Apple's relationship to the underlying criminal conduct and government investigation; the burden the requested order would impose on Apple; and the necessity of imposing such a burden on Apple. As explained below, after reviewing the facts in the record and the parties' arguments, I conclude that none of those factors justifies imposing on Apple the obligation to assist the government's investigation against its will.

There's just one problem in all of this -- as highlighted in Jeong's article linked above, and discussed in more detail by Orin Kerr last month: there is no three factors test in the US v. NY Telephone case. As Jeong summarizes:

You could argue it’s three factors, or maybe four, or even five. The point is, NY Telephone isn’t as easy to apply as the government makes it out to be. Everyone in the Apple case is playing in uncharted waters.

Kerr notes that the paragraph in the Supreme Court's ruling, far from laying out a "three factor test" appears to be "frustratingly murky."

The tricky part of New York Telephone is that the Court left the actual test for what the AWA allows frustratingly murky. The Court was comparatively clear about one essential limit on a Court’s power under the AWA: “We agree that the power of federal courts to impose duties upon third parties is not without limits; unreasonable burdens may not be imposed.” Okay. But the rest of what the Court says is really unclear.

Here are the key paragraphs from the Supreme Court ruling:

Turning to the facts of this case, we do not think that the Company was a third party so far removed from the underlying controversy that its assistance could not be permissibly compelled. A United States District Court found that there was probable cause to believe that the Company’s facilities were being employed to facilitate a criminal enterprise on a continuing basis. For the Company, with this knowledge, to refuse to supply the meager assistance required by the FBI in its efforts to put an end to this venture threatened obstruction of an investigation which would determine whether the Company’s facilities were being lawfully used. Moreover, it can hardly be contended that the Company, a highly regulated public utility with a duty to serve the public, had a substantial interest in not providing assistance. Certainly the use of pen registers is by no means offensive to it. The Company concedes that it regularly employs such devices without court order for the purposes of checking billing operations, detecting fraud, and preventing violations of law. It also agreed to supply the FBI with all the information required to install its own pen registers. Nor was the District Court’s order in any way burdensome. The order provided that the Company be fully reimbursed at prevailing rates, and compliance with it required minimal effort on the part of the Company and no disruption to its operations.

Finally, we note, as the Court of Appeals recognized, that without the Company's assistance there is no conceivable way in which the surveillance authorized by the District Court could have been successfully accomplished. The FBI, after an exhaustive search, was unable to find a location where it could install its own pen registers without tipping off the targets of the investigation. The provision of a leased line by the Company was essential to the fulfillment of the purpose— to learn the identities of those connected with the gambling operation—for which the pen register order had been issued.

So yeah, it mentions the three things the DOJ keeps insisting are the "three factor test" (if the third party is not "so far removed," if there is no "undue burden" and if the assistance was deemed "necessary"). But there's a hell of a lot of other stuff in there as well, including the fact that in that case, NY Telephone was "a highly regulated public utility." So that seems like a relevant "fourth" factor that weighs against the DOJ (and they conveniently skip over).

And, as Kerr notes, unlike basically any judicial "test," this one fails to lay out any of the ground rules:

The paragraph above is pretty confusing. It begins with the idea that the AWA doesn’t apply to someone “so far removed” from the controversy; then turns to the need for the phone company’s help; then talks about what is “offensive” to the company; and then covers the burden to the phone company, focusing on how much it cost the business and interfered with it. But the paragraph doesn’t link these ideas or say how they relate to one another. It doesn’t say what the standard is for each idea or how much weight to give it.

In other words, this was just a way for the Court to get the case off the docket, not to set a "test" that would be applied 40 years later. Kerr later expands:

We’re mostly left with the uncertainty of the New York Telephone case itself. Beyond the “unreasonable burden” test, it’s not clear what to make of the other matters that the court mentions. Are they all just factors in a grand multi-factor test? Are they actually parts of the undue burden standard, just not explicitly labeled that way? Are they parts of what makes the order “appropriate”?

Once you figure that out — if you can — there’s the uncertainty about what each mentioned standard means.

Kerr then spends a lot of time noting that even with the actual establishment of the "unreasonable burden" test, there are no actual details or explanations to go with it and you can come up with a wide variety of possible interpretations that would lead to very different results. In short, there's no big "test" developed here, and despite nearly four decades, there's no evidence that anyone else has really made use of this "test" to determine the ground rules for it.

Either way, it seems clear that the DOJ keeps making some pretty direct claims in its filings that are based on either direct misreadings of things, or deliberately misleading the courts about these things. That seems like a dangerous game to play.

Filed Under: all writs act, doj, encryption, fbi, pen register, supreme court, three factor test
Companies: apple

The FBI Claims Failure To Guess Password Will Make Data 'Permanently Inaccessible,' Which Isn't True

from the all-in-service-of-future-writs-and-exploitations dept

The FBI's attempt to force Apple to help it break into an iPhone hasn't been going well. A lot of that has to do with the FBI itself, which hasn't exactly been honest in its portrayal of the case. It tried to fight off claims that it was trying to set precedent by claiming it was just about this one phone… which worked right up until it dropped details about twelve other phones it couldn't break into.

Comey's protestations of "no precedent" were further undermined by law enforcement groups filing briefs in support of the FBI that basically stated they, too, would like Apple to be forced to comply with orders like these. And then there was the whole thing about some "dormant cyber pathogen" that was basically laughed off the internet within hours of its appearance.

There were also claims that Apple has done this sort of thing 70 times in the past but was just being inexplicably obstinate this time for reasons the FBI could not comprehend. But that wasn't true either. Apple does provide law enforcement with access to data it can retrieve from its end -- which is nothing like writing software that would allow the FBI (and anyone else who gets their hands on it -- or who makes similar demands following an FBI win) to bypass the security features of its phones.

Dan Gillmor of the ACLU has taken another look at the FBI's motion to compel and found it has misrepresented how Apple's "auto-erase" (which occurs after a certain number of failed login attempts) actually works.

The FBI has been unable to make attempts to determine the passcode to access the SUBJECT DEVICE because Apple has written, or “coded,” its operating systems with a user-enabled “auto-erase function” that would, if enabled, result in the permanent destruction of the required encryption key material after 10 failed attempts at the [sic] entering the correct passcode (meaning that, after 10 failed attempts, the information on the device becomes permanently inaccessible)…

That's not what actually happens, Gillmor points out. All data is not erased once 10 failed attempts are recorded. An agency with as many technically-astute employees -- as well as access to a variety of data recovery and software forensic tools -- should know -- or likely does know -- that it doesn't work this way. The phone doesn't erase all of the data, nor does it make it "permanently inaccessible." Instead, it just destroys one of the keys to the data.

The key that is erased in this case is called the “file system key”—and (unlike the hardwired “UID” key that we discussed in our previous blog post) it is not burned into the phone’s processor, but instead merely stored in what Apple calls “Effaceable Storage,” which is just a term for part of the flash memory of the phone designed to be easily erasable.

The data is still intact. The front door isn't. But the FBI can work around this by preventing the key from being destroyed in the first place -- without Apple's help.

So the file system key (which the FBI claims it is scared will be destroyed by the phone’s auto-erase security protection) is stored in the Effaceable Storage on the iPhone in the “NAND” flash memory. All the FBI needs to do to avoid any irreversible auto erase is simple to copy that flash memory (which includes the Effaceable Storage) before it tries 10 passcode attempts. It can then re-try indefinitely, because it can restore the NAND flash memory from its backup copy.

Even if the FBI fails in its attempts to brute force the code, the data on the phone remains intact. By working with a copy of the flash memory, the FBI can restore the phone to its "10 guesses" state repeatedly until it finally guesses the code.

The FBI can simply remove this chip from the circuit board (“desolder” it), connect it to a device capable of reading and writing NAND flash, and copy all of its data. It can then replace the chip, and start testing passcodes. If it turns out that the auto-erase feature is on, and the Effaceable Storage gets erased, they can remove the chip, copy the original information back in, and replace it. If they plan to do this many times, they can attach a “test socket” to the circuit board that makes it easy and fast to do this kind of chip swapping.

It's literally unbelievable that the FBI doesn't have access to the tools to perform this or the expertise to get it done. Which leads Gillmor back to the inescapable conclusion: this isn't about one iPhone or even twelve of them. This is about convincing a judge to read the All Writs Act the way the FBI would like it to be read -- a reading that would not only push the envelope for what it can demand from unrelated parties in the future, but that would also give it software to modify and exploit.

If it gets to that point, device users are going to have to start eyeing software/firmware updates very suspiciously.

The FBI wants to weaken the ecosystem we all depend on for maintenance of our all-too-vulnerable devices. If they win, future software updates will present users with a troubling dilemma. When we're asked to install a software update, we won’t know whether it was compelled by a government agency (foreign or domestic), or whether it truly represents the best engineering our chosen platform has to offer.

This is the end game for the FBI, even though it doesn't appear to realize the gravity of the situation. To it, Apple is the obstacle standing between it and the wealth of information it imagines might possibly be on that phone. Even is Apple is forced into compliance and the phone contains nothing of use, it will still have its precedent and its hacking tool and we'll be headed towards a world where patch notes contain warrant canaries.

Filed Under: all writs act, burden, doj, fbi, hacking, iphones, passwords, security
Companies: aclu, apple

Of Cockpits And Phone Encryption: Tradeoffs And Probabilities

from the think-this-through dept

Support our crowdfunding campaign to help us keep covering stories like these!

Blake Ross (boy genius Firefox founder and later Facebook product guy) has written a somewhat bizarre and meandering -- but totally worth reading -- article about the whole Apple v. FBI fight, entitled (believe it or not): Mr. Fart's Favorite Colors. There are a few very good points in there, about the nature of programming, security and the government (some of which even make that title make sense). But I'm going to skip over the farts and colors and even his really excellent description of the ridiculousness of TSA security theater in airports, and leap forward to a key point raised in the article, focused on airplane security, which presents a really good analogy for the iPhone encryption fight. He points out that the only thing that has truly helped stop another 9/11-style plane hijacking (as Bruce Schneier points out repeatedly) is not the TSA security theater, but reinforced, locked cockpit doors that make it impossible for people in the cabin to get into the cockpit.

However, Ross notes, there are scenarios in which those in the cockpit need to leave the cockpit (usually to use the bathroom), and therein lies an interesting security challenge for those designing the security of the planes. How do you let that pilot (or another crew member) back in, but not a bad guy? Here's the solution that airlines have come up with, as described by Ross (or you can read the NY Times version, which is a little drier):

1. When the pooping pilot wants to reenter the cockpit, he calls the flying pilot on the intercom to buzz him in.
2. If there’s no answer, the outside pilot enters an emergency keycode. If the flying pilot doesn’t deny the request within 30 seconds, the door unlocks.
3. The flying pilot can flip a switch to disable the emergency keypad for 5 to 20 minutes (repeatedly).

Like Asimov’s three laws, these checks and balances try to approximate safety while accounting for contingencies. If the flying pilot risked Delta’s gefilte fish and passed out, you want to make sure the other pilot can still re-enter. But add all the delays and overrides and backstops you want; you still have to make a fundamental decision. Who controls entry: the people on the inside, or the people on the outside?

Governments decided that allowing crew members to fully override the flying pilot using a key code would be insecure, since it would be too easy for that code to leak. Thus, there is nothing the outside pilot can do — whether electronically or violently — to open the door if the flying pilot is both conscious and malicious.

And as Ross notes, this is a pretty reasonable tradeoff in nearly all circumstances. It's quite difficult for someone bad to get in, and yet those in the cockpit can mostly be okay with leaving and getting back in even if a pilot remaining in the cockpit suddenly drops dead. But, there is still one scenario in which that security gets totally messed up -- and it's with Germanwings Flight 9525 almost a year ago, in which a mentally ill co-pilot locked the captain out of the cockpit and then deliberately crashed the plane into a mountain.

As Time Magazine noted, this is the tricky part of security systems: "sometimes it’s important to keep people out; sometimes it’s important to get inside."

And, of course, there's a little of that in the Apple v. FBI fight. The FBI is arguing that it's important to let people in, because 14 people died after a husband and wife killed 14 people and wounded more. But lots of other people are pointing out that there are much bigger security benefits in keeping people out. And that's why this is really a debate about "security v. security" rather than "security v. privacy."

Strong encryption on devices is like that locked cockpit door. Under most scenarios, it keeps people much safer. It's a useful and powerful security feature. But, yes, in some cases -- such as that of the suicidal Germanwings co-pilot -- it is less secure. And, there do seem to be ways to mitigate that kind of risk without harming the wider security (many airlines now require that even if someone leaves the cockpit, a second crew-member must be present in the cockpit). But, in the end, we look at the likelihood and probability of the need for such security solutions. And it's not hard to realize that, in the grand scheme of things, locking people out protects many, many, many more people from the rare instances of suicidal co-pilots (and or quasi-terrorist attacks).

And that's the real issue here. Strong encryption on our devices is much more likely to lead to much more protection and security for many more people than without such encryption. Nearly all of us are likely to be safer because of strong encryption. But, that might not include everyone. Yes, there will be some instances -- though likely few and far between -- where such encryption allows someone to secretly plan and (potentially) get away with some sort of heinous act. And it will be reasonable and expected that people will whine and complain about how the security feature got in the way of stopping that attack. But the likelihood of that is much, much smaller, than the very real possibility of attacks on weak phones affecting many of us.

Or, as Ross concludes (in a way that makes even more sense if you read the whole piece...):

Unfortunately it’s not that complicated, which means it’s not that simple. Unbreakable phones are coming. We’ll have to decide who controls the cockpit: The captain? Or the cabin? Either choice has problems, but — I’m sorry, Aunt Congress — you crash if you pick 2.

But when you have people like the technically ignorant San Bernardino District Attorney Michael Ramos insisting that he needs to be able to get into that iPhone, just recognize that he's arguing that we should unlock cockpit doors just in case there's a suicidal co-pilot in there, without recognizing how frequently such unlocked cockpit doors will be used by others who wish to do even more harm.

Support our crowdfunding campaign to help us keep covering stories like these!

Filed Under: backdoors, blake ross, cockpits, congress, doj, encryption, fbi, security, tradeoffs
Companies: apple, germanwings

DOJ To NY Court: Hey, Can We Have Another Judge Look Over That Ruling About Breaking Into iPhones?

from the because-of-course dept

This is hardly a big surprise, but the Justice Department is not at all happy about NY magistrate judge James Orenstein's decision last week in the case against accused drug trafficker Jun Feng, that it cannot force Apple to break the security on an iPhone using the All Writs Act. While so much of the attention concerning iPhone encryption has been placed on the case in San Bernardino, the NY case made news well before the California case, and Orenstein was clearly aware that his ruling would have a much wider impact (and it was clearly written with that intent in mind). The Justice Department, of course, is now, in effect asking for a second opinion on the issue, carefully trying to position this case as something quite different than the San Bernardino case. In particular, the Justice Department is claiming that since this particular iPhone is using iOS 7, rather than 8, Apple already has a backdoor, and can easily unlock the contents of the phone.

To be clear, the DOJ probably does have a stronger argument in this case than it has in San Bernardino, but it's still got some serious problems.

The FBI/DOJ has been going around spreading misleading claims about how Apple has readily complied with similar orders to the San Bernardino order in the past. As we've noted, that's not actually true. The earlier orders involved earlier versions of iPhones where Apple did have easy access to opening up those phones -- and the San Bernardino case was different because it used a more modern version of the operating system, where it did not have such access. The DOJ's argument in NY is that this case is basically like the earlier cases since iOS 7 doesn't have the same strong encryption as later versions.

This is a routine application asking the Court to order a third party to assist in the execution of a search warrant. The Department of Justice has made the same application, for the same assistance, from the same company, dozens of times before. Federal courts around the nation have granted these applications. The company has complied every time. Until now.

In mid-2014, law enforcement agents arrested Jun Feng on charges related to his participation in a methamphetamine distribution conspiracy. Agents conducted a search of Feng’s home, pursuant to a warrant, and seized an Apple iPhone 5s running iOS 7. The government subsequently obtained a warrant to search the phone. The government is unable to access the data on the phone, however, because the phone is locked with a passcode. The government cannot bypass the lock screen without risking data destruction. Apple can. Apple has extracted data from iPhones like this one pursuant to All Writs Act orders numerous times, including as a result of orders issued in the Eastern District of New York. Apple has confirmed that it can do so again, in this case, with this phone, and that doing so would pose no significant burden to the company.

As an aside, the DOJ also points out that because someone has activated the "remote wipe" feature on Feng's phone, it's afraid to even turn on the phone, as that might destroy whatever is on the phone -- and claims that this service "can interfere with execution of a warrant."

To strengthen its argument, the DOJ points out that Apple's own law enforcement guidelines notes that it can access data on devices using iOS 7 or earlier. But the DOJ is (shocker!) not being entirely accurate. Here's the way the DOJ explains it:

Apple states in its Legal Process Guidelines, which Apple makes publicly available online and provides to law enforcement to this day, that “for iOS devices running iOS versions earlier than iOS 8.0, upon receipt of a valid search warrant issued upon a showing of probable cause, Apple can extract certain categories of active data from passcode locked iOS devices.” See “Extracting Data from Passcode Locked iOS Devices,” Apple Legal Process Guidelines § III(I) (last accessed Mar. 2016), http://www.apple.com/privacy/docs/legal-process-guidelines-us.pdf, attached hereto as Exhibit D. Apple’s guidelines also express a preference for specific language to be included in the order directed to it and how such an order should be served. Id. Apple states in its guidelines: “Once law enforcement has obtained a search warrant containing this language, it may be served on Apple by email . . . . After the data extraction process has been completed, a copy of the user generated content on the device will be provided.”

That sounds kind of damning... until you actually click the link the DOJ provides and read what Apple actually says. Because it's not what the DOJ claims. In fact, the Apple law enforcement guidelines makes it clear that while, yes, it can access some data on versions of iOS before iOS 8 that does not include information encrypted via a passcode. Here's the full paragraph which the DOJ carefully quoted above, and we'll highlight the relevant section that the DOJ conveniently left out:

For iOS devices running iOS versions earlier than iOS 8.0, upon receipt of a valid search warrant issued upon a showing of probable cause, Apple can extract certain categories of active data from passcode locked iOS devices. Specifically, the user generated active files on an iOS device that are contained in Apple’s native apps and for which the data is not encrypted using the passcode (“user generated active files”), can be extracted and provided to law enforcement on external media. Apple can perform this data extraction process on iOS devices running iOS 4 through iOS 7. Please note the only categories of user generated active files that can be provided to law enforcement, pursuant to a valid search warrant, are: SMS, iMessage, MMS, photos, videos, contacts, audio recording, and call history. Apple cannot provide: email, calendar entries, or any third-party app data.

Notice the section I've bolded? Apple says it can't extract information that is encrypted using a passcode. Seems notable that the DOJ left that part out. Of course, from the rest of the paragraph, it's possible to read that to mean that there's a lot of information that is not encrypted by the passcode -- including SMS, iMessage, MMS, photos, call history and more. So, the DOJ's claim on that kind of information may be much more valid.

On the whole, though, the DOJ does have a point that, given the version of the iOS on this phone, the "burden" placed on Apple is likely quite different in this case, rather than in other cases, where the security features are more advanced. And it may be more accurate that this case is a lot more like previous cases where Apple willingly complied with warrants and All Writs Act orders. Of course, just because it has complied in the past, that does not mean those orders are legal. And Apple's response will likely highlight that fact. Apple, of course, has the right to do what it's done in past cases, and then later decide that the All Writs Act is inappropriate in such cases -- and then to ask a judge to rule on that.

Even then, however, the DOJ's arguments seem... questionable. As EFF lawyer Kurt Opsahl points out, early on in the filing, the DOJ cites a Florida district court's order on a motion to quash in a case called United States v. David Zaragoza, claiming that it shows that courts can force Apple to help via the All Writs Act. However, if you actually read that ruling, it rejects Zaragoza's attempt to toss out an All Writs Act claim, but says that Apple has standing to object to such a demand:

In this case, the party bestpositioned to oppose, or to choose to not oppose, the AWA Order is Apple, because Apple bears the burden to comply with that order. Furthermore, Apple is the only party that can inform the court of highly-relevant facts–such as the amount of effort that is required to unlock and obtain information from the iPhone and the extent to which complying with the order would interfere with Apple’s daily operations.

That seems like an... odd case to argue says that Apple has to comply with All Writs Act demands, doesn't it? It's almost as if the DOJ expects that no one will read any of the stuff it cites.

Still, given the situation (a phone using iOS 7), this case is a lot less of a slam dunk than it might be on a more modern iPhone. And, of course, there's an argument that that's what the DOJ is banking on. If it can get the order here, it can then leverage that into other cases, such as the one in San Bernardino, where it can just turn around and say "well, if the order is valid for iOS 7, why isn't it valid for iOS 8?" Apple, of course, would then have a response concerning the "burden" on iOS being much greater due to the different security framework, but by then you're already arguing it at the level the DOJ prefers -- on the question of burden, rather than the question of whether or not the All Writs Act itself is applicable in these scenarios.

The DOJ goes on to claim that, contrary to Judge Orenstein's ruling last week, other laws do not cover this situation, and that the wiretapping statute CALEA and the electronic communications privacy law ECPA discuss different scenarios altogether, meaning that the All Writs Act can apply, as "filling the gap." This rebuts Orenstein's argument that this kind of remedy is not allowed by CALEA and ECPA. It also generally attacks the key points of Orenstein's ruling, claiming that he's misreading the case law, some of which may be on point. Some of which, on the other hand, are a bit crazy.

Take, for example, the question of whether or not Apple is "too far removed" for the All Writs Act to apply. In his ruling, Orenstein noted that Feng was using his own property, not Apple's: "To the extent that Feng used his iPhone in committing crimes, he used his own property, not Apple's." Incredibly, the DOJ hits back on that claim by saying that because Apple licenses rather than sells its software, Feng was actually using Apple's property, and thus it is not too far removed:

To the contrary, Feng used Apple's property — the software on the phone — to commit and conceal his crimes.... Indeed, Apple’s property — the software features including the passcode feature, auto-erase feature (if enabled), and remote wipe feature — continues to obstruct the investigation. Given that Apple manufactured, sold, and continues to exercise control over a phone used in a criminal enterprise, where it designed and has exclusive expertise about the software used to further that criminal enterprise, where that very software now thwarts the execution of the search warrant, and where Apple provides ongoing services to phone owners, including control over what software may run on the device and the ability to wipe the phone remotely, compulsion of Apple is permissible

In fact, the DOJ -- somewhat incredibly -- cites Apple's own filing in the infamous triennial review for copyright exemptions. Back in 2009, Apple opposed rules that would exempt phone jailbreaking, and in the process discussed "ownership" based on licensing. The DOJ appears to be using Apple's claims about copyright related issues, to bite back at Apple and claim that because it claims ownership of the software, it can't also claim that it's too far removed to be excused from obligations under the All Writs Act.

Man, those copyright issues sure have a way of showing up in strange places, huh?

Given all that and more, the DOJ asks the court to basically have another judge overrule Judge Orenstein. This isn't a huge surprise. Everyone knows that this case (and the San Bernardino case) will go through the full appeals process before it's finally over. This is just the next step on that long road. To be honest, the DOJ's argument here is much stronger than in the San Bernardino case at a first read, but the fact that it deliberately misrepresented what Apple's law enforcement guidelines say suggest that some of its other arguments may not be fully above board either.

Filed Under: all writs act, doj, encryption, ios 7, james orenstein, jun feng
Companies: apple

Supreme Court Refuses To Hear Apple's Appeal In eBook Price Fixing Case

from the time-to-pay-up dept

This isn't a huge surprise, but this morning the Supreme Court refused to hear Apple's appeal of its loss in the case brought by the Justice Department for engaging in price fixing on ebooks with the big book publishers. During the course of the case and appeals, Apple worked out a settlement, agreeing to pay $450 million -- but only after the appeals process was exhausted. And, that's now happened. As with basically all appeals rejected by the Supreme Court, the court gave no reason. It just denied cert. Meanwhile, even as Apple has now lost the case, it did still succeed in forcing the price of many ebooks much, much higher.

Filed Under: ebooks, price fixing, supreme court
Companies: apple

Full Brief From San Bernardino District Attorney Even More Insane Than Application About 'Dormant Cyber Pathogen'

from the it-goes-on-and-on dept

Support our crowdfunding campaign to help us keep covering stories like these!

Like many, we wrote about the bizarre filing from San Bernardino County District Attorney Michael Ramos in the Apple/FBI encryption fight -- you know, the one where he speculates randomly that the iPhone might contain evidence of a "dormant cyber pathogen" that is waiting to infect computer systems everywhere? Of course, that was found in his 4 page application to file the full brief, and as far as we can tell, no one else has explored the full 40 page brief that Ramos eventually did file, after magistrate judge Pym granted permission. And, it probably won't surprise you that in a filing that's 10x as long, it's got much more room for crazy arguments, many of which seem to be in the "day is night, black is white" variety. Let's dig in:

At issue before this Court is whether on balance there is a compelling governmental interest in acquiring evidence of criminal activity contained solely on the specific San Bernardino County-owned iPhone, seized and ordered searched by a lawful search warrant issued by a United States Magistrate, that outweighs any real or imagined interest that Apple, a for-profit California-based corporation, asserts to deny assistance to the FBI, San Bernardino County District Attorney's forensic partners, and by extension the San Bernardino County District Attorney and our client, the People of the State of California, in acquiring this evidence.

Actually, that's not the issue. The issue is not whether there's a compelling governmental interest, but whether or not a company can be compelled to build new hacking tools and surreptitiously load them onto user devices. That's a very different question, and one that Ramos doesn't even want to consider. So, instead, he makes up things unrelated to the issue at hand.

Then, Ramos repeats the whole bogus "there may have been a third shooter!" and "DORMANT CYBER PATHOGEN!" arguments, based on absolutely no evidence, and follows it up by flipping the burden of proof, and hilariously arguing that it is Apple's burden to prove that there is no such dormant cyber pathogen. PROVE A NEGATIVE, APPLE!

At the time that the murders in San Bernardino County were being perpetrated on December 2, 2015, at least two 911 calls to the San Bernardino Police Dispatch Center reported the involvement of three perpetrators. Although the reports of three individuals were not corroborated, and may ultimately be incorrect, the fact remains that the information contained solely on the seized iPhone could provide evidence to identify, as of yet, unknown co-conspirators who would be prosecuted by the District Attorney for multiple murders and attempted murders in San Bernardino County.

In addition, the iPhone is a county telephone that may have connected to the San Bernardino County computer network. The seized iPhone may contain evidence, that can only be found on the seized phone, that it was used as a weapon to introduce a lying-dormant cyber pathogen endangering San Bernardino County's infrastructure, a Violation of Cal. Penal Code § 502 (Lexis 2016), and which would pose a continuing threat to the citizens of San Bernardino County.

Apple has not advanced a single argument to indicating why the identification and prosecution of any outstanding coconspirators, or to detect and eliminate cyber security threats to San Bernardino County's infrastructure introduced by its product and concealed by its operating system, and Apple's refusal to assist in acquiring that information, is not a compelling governmental interest. To the extent that Apple states in its brief at page 33 that there is no compelling state interest because the government "has produced nothing more than speculation that this iPhone might contain potentially relevant information," Apple completely forgets that a United States Magistrate has issued a search warrant based on a finding of probable cause that the iPhone does contain evidence of criminal activity. The reason we search is to find out if the device contains evidence or is an instrumentality of the crime. Such authority is granted by the United States Constitution.

Got that? As long as the DA makes up some totally mythical "cyber pathogen," so long as Apple has not proven that such a thing is not on the phone, then open 'er up, Apple!. That's a fascinating view of due process.

Oh, speaking of due process, Ramos then, absolutely ridiculously, flips Apple's 5th Amendment due process argument on its head, arguing that by not hacking into users' devices, Apple is the one that is harming due process rights. Really:

The California Constitution guarantees victims of crimes committed in California a Victims' Bill of Rights.... These rights include those shared by all people of the State of California, "that persons who commit felonious acts causing injury to innocent victims will be appropriately and thoroughly investigated brought before the courts of California and tried by the courts in a timely manner." ... The Victims' Bill of Rights continues to state, "In order to preserve and protect a victim's rights to justice and due process, a victim shall be entitled to the following rights... To be reasonably protected from the defendant and persons acting on behalf of the defendant"... and the right to have all relevant evidence admitted in any criminal proceeding....

The due process protections of the California Constitution clearly attach to not only the fourteen people murdered, and the twenty two injured in the assault, but also those physically uninjured, but mentally injured survivors who witnessed the mass murder.

Apple is infringing on the due process rights of these real, and not speculative, victims. It is preventing protection from the defendant and those who assist the defendant. Through the design of its operating system and its refusal to assist in accessing the information contained on the seized phone, Apple is preventing the acquisition of information leading to the identity or elimination of outstanding coconspirators. This denies the surviving victims of the knowledge that there are either no additional coconspirators, or that those that are outstanding will be pursued. Apple's actions in denying assistance in acquiring access to the phone infringes on the Victims' right to be reasonably protected. Denying access to this information deprives victims of all relevant evidence in any criminal proceeding that could be the product of the information contained on the phone, and it certainly is denying the victims of the right guaranteed to them to have the case investigated and prosecuted in a timely manner.

Let's put this simply: this is an insane reading of the California Constitution. Based on this, Ramos can basically argue that anyone and anything that gets in the way of law enforcement finding out absolutely anything, no matter how speculative is infringing on someone's due process rights. Did you sell someone a shredder that allowed them to shred a paper that may have included something useful? You've infringed someone's due process rights. Did you happen to overhear someone planning a crime, but you can no longer remember what the person looked like? You've violated the victims due process rights. That's not how it works. Private companies don't infringe on someone's due process rights -- governments do.

And, then, just because this isn't crazy enough already, in somehow arguing that a private company has the burden to prove a negative, and that a private company is responsible for due process, Ramos argues that Apple is "usurping the authority of the District Attorney":

In refusing to assist in the opening of this repository of evidence, Apple is making the defacto decision of who can be charged with a crime and is giving a de facto grant of immunity to those iPhone users that use the phone as an instrumentality of a crime, a cyber weapon, or store, intentionally or not, evidence of a crime on the device. Questions of whether Apple's conduct falls within traditional definitions of harboring one who commits a crime aside, Apple is infringing on the authority of the District Attorney to make charging and immunity decisions. Apple is free to exercise its First Amendment rights to express what activities, including none at all, should be considered crimes, or who should be charged with a crime, including nobody, but Apple has no de jure or de facto authority to make those decisions by its actions.

No person but the San Bernardino County District Attorney and his deputies are authorized to decide when criminal charges are brought or not brought, or to whom to provide a grant immunity from prosecution in San Bernardino County. Apple has no such dejure or defacto authority in San Bernardino County.

Except... that's nuts. Apple is not "granting immunity" or making decisions about who can be charged with a crime. Like the whole "dormant cyber pathogen" this is Ramos simply making up shit and telling it to a judge. Nothing that Apple is doing prevents law enforcement from bringing charges if they have enough evidence. But, once again, Ramos is flipping the very concepts of burden of proof and due process in suggesting that any technology that happens to get in the way of collecting evidence is somehow "granting immunity."

If you thought that wasn't crazy enough, Ramos keeps going deeper and deeper into the "What did he just say.....?" hole. Next up: claiming that Apple is an "Orwellian arbiter" of privacy, which in his mind is illegal because Apple is not a public policy maker, and thus is somehow not allowed to build systems that keep customers' info private. I'm NOT JOKING (though, really, I wish I was).

Apple asserts that its operating system and its refusal to assist in unlocking the phone is, in Apple's view, necessary to protect the privacy interests of its customers. Apple advances its concept of privacy as absolute privacy in the context that it proffers the opinion that the contents of any Apple iPhone or Apple mobile device is immune from any type of government intrusion due to its security features. While Apple can represent what it chooses in its marketing of its devices and operating systems, Apple is neither the legislature nor judiciary empowered to define privacy as absolute. Apple in not a public policy maker. Apple is a for-profit corporation. No one has appointed or elected Apple to be the Orwellian arbiter or definer of privacy for society or even for all of Apple's customers.

This falls into the so wrong it's "not even wrong" category. It's insane. It's not even in the realm of reality. Of course a for-profit company gets to determine what kind of privacy tools it offers customers. Is Ramos honestly claiming that companies are somehow breaking the law by building secure systems? Because that's crazy. It goes directly against basically... everything.

From there, Ramos again pretends the case is about something entirely different:

Apple's concept of absolute privacy and immunity from government search is not supported by the Constitution of the United States or the cases that interpret it. Furthermore, Apple has no privacy rights in the device before the Court, nor is it legally permitted to assert any privacy rights regarding the search of the San Bernardino County-owned phone.

Right. And Apple is not asserting privacy rights here so what the hell is Ramos even arguing about here? He's making things up that aren't even remotely related to the case. Apple is not arguing about its privacy rights. It's arguing about whether or not the All Writs Act can be used to force it to build hacking tools that undermine the safety and security of its customers.

Ramos then goes on to totally misinterpret the finding in the famous Supreme Court Riley v. California decision about whether or not law enforcement could search mobile phones without a warrant. The ruling in that case, quite rightly and importantly, noted that you could not search a mobile phone without a warrant. But, Ramos pretends that means that the Supreme Court's decision means that all data on cellphones must be accessible under a warrant, which is not what the court said at all.

Hilariously, after raising issues that aren't before the court at all (Apple claiming a right to "privacy"), Ramos claims that Apple is the one raising issues not before the court -- and appears to do so by not understanding what the actual issue in this case is about:

Apple asserts that unlocking the seized iPhone will open the siege gates and make its users' personal information vulnerable to hackers, identity thieves, hostile foreign agents and unwarranted government surveillance. It has also expressed concerns about how foreign governments may treat their citizens and the demands that might be made on Apple. None of these issues are before the Court. This case does not involve speculation as to what foreign governments may demand of Apple, or how Apple may respond to those demands in the future. There is no issue of identity theft here, and Apple has not advanced an explanation of how unlocking this phone would lead to identity theft elsewhere, nor have they advanced any evidence of identity thefts caused by their unlocking phones prior to the deployment of IOS 8. Similarly, Apple warns of unwarranted government surveillance. No surveillance is present here. Apple has not advanced any evidence or explanation of how this surveillance will be unleashed by unlocking this phone. Apple cites the hacking of the Office of Personnel Management as illustrative of the dangers of hacking into databases, yet these databases were not contained on a specific iPhone as the evidence here is nor has there been an indication that the databases were hacked by an unlocked iPhone. These speculative concerns do not outweigh the compelling interest in the need to acquire real evidence of real crimes from the seized iPhone.

Here's the thing. This isn't that complicated. The law at issue in this case is the All Writs Act. The All Writs Act specifically notes that any "writs of assistance" must be "appropriate" and under the law it's been determined that to be "appropriate" it cannot be unduly "burdensome." The judge in the case has specifically requested that the parties focus on whether or not the order is unduly burdensome, and that's why Apple raised all of the issues above, directly answering the judge's questions which directly relate to the law at hand. To argue that these are "issues not before the court" suggests such a profound ignorance of the case here that one wonders what Ramos is doing here and how he got elected to be San Bernardino's DA.

And, really, for Ramos to whine that Apple's evidence of actual security concerns are somehow too "speculative" when he's the one spewing nonsense about speculative "dormant cyber pathogens" is just... insane.

Finally, Ramos concludes by saying that, look, he doesn't really give a shit how Apple breaks encryption, but it needs to be able to break encryption:

Apple's creation of their iOS 8 and iOS 9, the product of their brilliant engineering created all these issues where it did not exist in previous operating systems. There is nothing unreasonable in having this same brilliance applied to remediating the problem they created. How Apple chooses to accomplish this is a matter of their own choosing. Neither the FBI nor San Bernardino County District Attorney is asking to know how they do it, or directly possess the tools to do so. How Apple resolves the problem, or protects the solution is not our concern. We only seek for this Court to compel that Apple do so.

That's the DA version of "nerd harder, Apple." Of course, it (once again) totally misunderstands and misstates the issue. Also, while it is true that, in this case, there do appear to be technical ways (very, very dangerous ones) to force Apple to do what the FBI wants (which, we should note has very specific requests, which Ramos doesn't even seem aware of, despite being widely discussed), is Ramos honestly asserting that in cases where there isn't such a backdoor possible that companies still be required to break in, even when that's mathematically impossible?

The people of San Bernardino County deserve elected officials who actually understand the issues at hand. Not technically and legally ignorant buffoons who file such misleading tripe in such an important case.

Support our crowdfunding campaign to help us keep covering stories like these!

Filed Under: all writs act, amicus brief, cyber pathogen, doj, due process, encryption, fbi, michael ramos, privacy, san bernardino, san bernardino da
Companies: apple