Congressman Proposes Law Banning Government From Purchasing Apple Devices

from the Florida-Man:-Congression-Edition dept

Global terrorism has accomplished one thing: the continual generation of stupid legislation. Add some panicked law enforcement voices to the mix and some lawmaker is going to feel compelled to throw a Kneejerk Convention.

Legislators on both coasts are pushing a ban on the sale of encrypted phones. And now this, as reported by Zack Whittaker of ZDNet.

Republican lawmaker Rep. David Jolly (R-FL, 13th) has introduced a bill that would ban Apple products across government.

Jolly said the legislative effort was in protest of the company's refusal to help federal agents unlock an iPhone belonging to one of the San Bernardino terrorists.

Jolly, it must be said, is the paragon of efficient stupidity.

The bill, dubbed the "No Taxpayer Support for Apple Act," or HR 4663, is just 11 lines long.

Here's the official wording.

No agency or other entity within the executive, legislative, or judicial branch of the Federal Government may purchase any product manufactured by, licensed by, or otherwise sold under the trademark of Apple Inc. of 1 Infinite Loop, Cupertino, California (hereafter referred to “Apple”) until a court of Federal jurisdiction certifies that Apple has provided the Federal Government with the technical support necessary to access encrypted information sought by a judicial warrant that may be materially relevant to the investigation of commission of terrorism.

This would be a boon for Apple's competitors, except for the fact that they've all backed Apple in its fight against the FBI. Is Rep. Jolly going to be happy that the lesser of two evils has supplanted Apple's government marketshare, or will he be amending this to encompass the companies who have shown support for Apple's material support for terrorism refusal to assist the FBI in setting a dangerous precedent?

I sincerely hope he does go that route. Because if he does, government agencies will not only be locked out (irony!) of purchasing Apple devices, but they won't be able to use Android or Microsoft devices either.

Agencies might have to move towards a more paperful office, what with a variety of tech companies expressing their support for Apple. Government employees will also find themselves without an internet browser option -- which will probably be fine as Reddit, Twitter and Facebook would all be on Jolly's "enemies of the state" list. Perhaps the elimination of unproductive web surfing will make up for efficiency loss resulting from the lack of an email or cloud storage options.

But perhaps the most hilarious thing about Jolly's dumbass proposal is his statement in support of it.

“Taxpayers should not be subsidizing a company that refuses to cooperate in a terror investigation that left 14 Americans dead on American soil,” Jolly said.

While we've often noted the FBI's over-zealousness when it comes to terrorism investigations, we honestly had no idea it had gotten this far out of hand. Apparently, the FBI has already killed 14 Americans during its investigation of the San Bernardino shooting. How many more will it have to kill before this investigation is concluded? If Apple's swift compliance can prevent the FBI from killing more people, perhaps it's time to reconsider its stance.

Filed Under: congress, david jolly, doj, encryption, fbi
Companies: apple

Law Enforcement Groups File Amicus Brief In Favor Of FBI... But Which Undermines DOJ's Claim That This Is Just About One Phone

from the about-that... dept

Support our crowdfunding campaign to help us keep covering stories like these!

So, we already wrote about the nutty amicus filing in support of the FBI by San Bernardino's District Attorney, as well as the tons of amicus briefs in support of Apple. However, there are two more amicus briefs that were filed in support of the Justice Department, and we didn't want to leave those out of our coverage either. The main one is a brief from a ton of law enforcement agencies, namely the Federal Law Enforcement Officers Association, the Association of Prosecuting Attorneys, and the National Sheriff's Association.

The argument is not a surprising one. It's basically "but we really, really, really want to see what's on these phones" combined with "this may inspire others not to obey us."

Amici believe that the position Apple has taken is a dangerous one. First, Apple's refusal to provide assistance has far-reaching public safety ramifications by making it difficult, and in some cases impossible, for law enforcement to fulfill its obligation to investigate crimes, protect the public by bringing criminals to justice, and enforce the law. Second, if Apple were to prevail, the public at large may itself think twice about cooperating with law enforcement when called upon to do so.

Of course both of these are hogwash. First of all, Apple has provided a ton of assistance. But providing some assistance doesn't mean it should be compelled to provide all possible assistance. In fact, this claim ignores the very heart of this case, which is just how far must Apple go, and can a company be compelled to go way beyond what any company has been compelled to do in the past. But this filing misleads the court and pretends it's simply about whether or not Apple should provide any assistance. Similarly, the argument that this kind of info is needed to "enforce the law" is similarly ridiculous. As we've noted, law enforcement never gets "all of the information." It never knows what information has been destroyed, or is hidden and not found, or is just in people's brains. The idea that they need every possible scrap of information has simply never been true, and in fact, our Constitution is designed on the principle that, no, law enforcement doesn't always have the right to access any and all information it wants. That's on purpose.

Separately, this amicus brief -- despite officially being in support of the Justice Department and the FBI may serve to undermine their case. After all, a key part of the DOJ's argument is that this case is just about this one phone. However, as we've discussed, tons of law enforcement folks are salivating over using this ruling as a precedent elsewhere. And this brief makes that quite clear, which might help the judge realize that the Justice Department is being misleading in arguing otherwise.

The other amicus brief in support of the DOJ is one filed on behalf of six individuals who are mostly family members of people who were killed in the San Bernardino attack (five of them, with the other person being the husband of a woman who witnessed the attack, but was not shot). This filing was also not unexpected given that, as we reported earlier, the DOJ reached out to a lawyer to file this amicus brief before even asking the judge for the order. For whatever reason, the actual brief does not appear on PACER, just the application for the amicus brief (it says the brief is attached, but as of my writing this, the full brief does not appear in PACER). I can certainly understand why these individuals would want to support the DOJ here (though, as noted in our earlier posts, at least three other family members have supported Apple's position). But I'm not convinced that their views have any legal impact on the case, just an emotional one.

Support our crowdfunding campaign to help us keep covering stories like these!

Filed Under: all writs act, amicus brief, doj, encryption, fbi, law enforcement, san bernardino
Companies: apple

We Read All 20 Filings In Support Of Apple Against The FBI; Here Are The Most Interesting Points

from the it's-a-crypto-party dept

Support our crowdfunding campaign to help us keep covering stories like these!

In the last week or so, it became quite clear that a fair number of tech companies and organizations in the civil liberties community would file amicus (friend of the court) briefs urging magistrate judge Sheri Pym to side with Apple over the Justice Department and the FBI. However, now that the briefs are in, it's fairly staggering just how many companies, organizations and individuals signed onto briefs supporting Apple. Yes, many of them teamed up and filed briefs together, but it's still a ton. And that's especially true for an issue at the district court level in front of a magistrate judge. Here's the big list put together by Apple, including links to various blog posts and press releases about the filings:

Amicus Briefs

• 32 Law Professors
• Access Now and Wickr Foundation | Press Release
• ACT/The App Association | Medium Post
• Airbnb, Atlassian, Automattic, CloudFlare, eBay, GitHub, Kickstarter, LinkedIn, Mapbox, Medium, Meetup, Reddit, Square, Squarespace, Twilio, Twitter and Wickr | Automattic & WordPress.com Blog Post | Tweet from Twitter
• Amazon, Box, Cisco, Dropbox, Evernote, Facebook, Google, Microsoft, Mozilla, Nest, Pinterest, Slack, Snapchat, WhatsApp, and Yahoo | Tweet from Box | Evernote Blog Post  | Facebook Statement | Microsoft Blog Post | Mozilla Blog Post | Snapchat Blog Post | WhatsApp Facebook Post | Yahoo Tumblr Post
• American Civil Liberties Union, ACLU of Northern California, ACLU of Southern California, and ACLU of San Diego and Imperial Counties | Blog Post
• AT&T | Public Policy Blog Post
• AVG Technologies, Data Foundry, Golden Frog, the Computer & Communications Industry Association (CCIA), the Internet Association, and the Internet Infrastructure Coalition | Golden Frog Blog | CCIA News
• BSA|The Software Alliance, the Consumer Technology Association, the Information Technology Industry Council, and TechNet | Press Release
• Center for Democracy & Technology | Insight
• Electronic Frontier Foundation and 46 technologists, researchers, and cryptographers | Blog Post | Press Release
• Electronic Privacy Information Center (EPIC) and eight consumer privacy organizations | EPIC Top News
• Intel | Blog Post
• iPhone security and applied cryptography experts including Dino Dai Zovi, Dan Boneh (Stanford), Charlie Miller, Dr. Hovav Shacham (UC San Diego), Bruce Schneier (Harvard), Dan Wallach (Rice) and Jonathan Zdziarski | Blog Post
• The Media Institute | Press Release
• Privacy International and Human Rights Watch

Letters to the Court

• Beats, Rhymes & Relief, Center for Media Justice, The Gathering for Justice, Justice League NYC, Opal Tometi and Shaun King
• David Kaye, United Nations Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression | Supporting Document
• Salihin Kondoker, San Bernardino, CA

Not entirely sure why, but Apple (at least as I'm writing this) did not include one other amicus brief on its side, which is from Lavabit, the one company out there should should have tremendous perspective on Apple's situation, given that it shut down its entire business to avoid having to hand over its encryption keys to the government. At this point, we just have Lavabit's motion for leave to file its brief, rather than the full brief. If and when that brief is released, we may address it separately.

I've also put all of these together in a collection which are embedded below (which also lets you search through the text of them all).

Having read through many of them (and skimmed the rest), there are certainly some common themes. Frankly, an awful lot of them do really feel like they're just a rehashing of Apple's motion to vacate, repeating the claim that the All Writs Act should not apply (and that CALEA already covers this issue and doesn't allow such a solution). Obviously, all the filings from the various tech companies are getting a lot of the press attention, and they're worth reading to perhaps better understand a few of the key legal points that Apple is raising. Similarly, the filings from civil liberties/human rights groups aren't all that surprising either -- focusing more on some of the human rights questions. The EFF brief is a bit different in focusing on the First Amendment issue, which many expect won't even be looked at by the courts. It's really the only brief that digs deeply into that issue and is worth a read for that reason (I've seen legal experts in fairly strong disagreement about the applicability of the First Amendment argument here).

Separately, I thought that the filing from EPIC was worthwhile as well, in focusing in on the importance of encryption on phones these days because so much personal information is accessible from phones and because unencrypted phones are such a big target for criminals. That's a slightly different perspective that isn't covered nearly as much by other filings and actually could be a useful perspective for the court.

However, the most interesting filing of all may be the one filed by a group of iPhone Security and Applied Cryptography Experts, and put together by Jennifer Granick and Riana Pfefferkorn from Stanford's Center for Internet and Society. That brief is super educational in getting down into the weeds of just how dangerous it would be for Apple to create this code. Since so many people -- including the DOJ -- seem to think that Apple can just create this code and then make it disappear, this filing is super useful in debunking that claim. It first notes that the Court did try to put in some "safeguards" against abuse of the code, but then explains why those won't help:

These rules are not meaningful barriers to misuse and abuse of the forensic capabilities this Court is ordering Apple to create. First, the Order assumes that Apple will create the Custom Code without any vulnerabilities in its implementation. Vulnerabilities are common in software code, including Apple’s iOS, and despite Apple’s best efforts. The government dismissively downplays the effort required to develop and update the Custom Code, stating that Apple “writes software code as part of its regular business,” including “routinely patch[ing] security or functionality issues” in iOS and “releas[ing] new versions of [iOS] to address issues.” Application at 15. But creating software (especially secure software) is complex, and software development requires rigorous testing.

Vulnerabilities are common in software code, despite vendors’ best efforts. To address this problem, vendors employ extensive pre-release testing; after-thefact audits, including by independent security researchers; and regular updates. Yet none of these practices, alone or in concert, can ensure that software will not be vulnerable and subject to misuse. Yet, given the circumstances of this case, this code is unlikely to go through this lifecycle, increasing the risk that it will introduce vulnerabilities into the iPhone ecosystem.

For example, since first introducing the earliest iPhone, Apple has waged a cat-and-mouse battle with “jailbreakers,” software developers who identified and exploited vulnerabilities in the devices in order to run software other than that signed by Apple and to defeat carrier locks that tied handsets to particular cellular providers. Apple warns its users against jailbreaking and the practice is contrary to Apple’s terms of service. Jailbreaking involves modifying the iPhone firmware so that it will run software code without checking to see if the code has been signed by Apple. When Apple releases a new iOS, scores of independent programmers study the code, successfully finding ways to circumvent Apple’s imposed restrictions. In response, Apple issues software updates to defeat these jailbreaks. Eventually, the jailbreaking community finds new ways to circumvent controls built into Apple’s increasingly secure iOSes. Today, all iOS versions through 9.2 are jailbroken, even though doing so is increasingly harder due to Apple’s efforts.

In other words, vulnerabilities in Apple’s software have persisted for years even though Apple very much does not want them to. This is a lesson for this case. Apple can try its very hardest to create this Custom Code as the Court directs. Nevertheless, it may well fail, as it has acknowledged to the Court.... Even with time and extensive testing, which the government’s sense of urgency seems designed to deny Apple, it is extremely difficult to write bug-free code. Software bugs can interact with existing code in complex ways, creating unanticipated new paths for bypassing iPhone security and exploiting the phone.

This is a point that so few people outside of the tech world seem to get. Security vulnerabilities exist and software (and hardware) are incredibly complex. Purposefully creating vulnerabilities likely creates even more vulnerabilities and those can be pretty dangerous. And that's especially true in a situation -- such as this one -- where Apple will have to create the code entirely by itself, and without any outside security audit possible.

Furthermore, the brief notes the fact that, contrary to what many keep insisting, there's a high likelihood that any such code will leak out:

This Court also allowed the Custom Code to stay with Apple, rather than go to the FBI. Simply put, if no one else has the Custom Code, no one else should be able to use it, at least not without Apple’s knowledge. However, once created, this software is going to be very valuable to law enforcement, intelligence agencies, corporate spies, identity thieves, hackers, and other attackers who will want to steal or buy the Custom Code. Keeping the Custom Code secret is essential to ensuring that this forensic software not pose a broader security threat to iOS users. But the high demand poses a serious risk that the Custom Code will leak outside of Apple’s facilities.

Other governments, or ours, may eventually compel Apple to turn the Custom Code over so that law enforcement officials can unlock phones without delay or Apple oversight. Authoritarian governments will likely be the most enthusiastic customers for the Custom Code this Court is contemplating ordering Apple to create and sign. The software will be used in China, Russia, Turkey, the United Arab Emirates, and other governments with poor human-rights records where iPhones are sold.

Inadequate security practices by those governments increase the risk that attackers will acquire and use the Custom Code. Given the Custom Code’s value, unscrupulous government officials in corruption-plagued jurisdictions could foreseeably sell the Custom Code to third parties. For example, if the Russian government compelled Apple to hand over the Custom Code, it could end up being sold by a corrupt agent to a Russian identity-theft ring. Even without selling it, corrupt officials could also use the code for their own agendas, such as to target political or personal enemies who had broken no law. Journalists, human-rights advocates, religious and sexual minorities, and others in those countries are at much greater risk if software that can bypass passcode limitations exists.

There is also a danger that the Custom Code will be lost or stolen. The more often Apple must use the forensic capability this Court is ordering it to create, the more people have to have access to it. The more people who have access to the Custom Code, the more likely it will leak. The software will be valuable to anyone eager to bypass security measures on one of the most secure smartphones on the market. The incentive to steal the Custom Code is huge. The Custom Code would be invaluable to identity thieves, blackmailers, and those engaged in corporate espionage and intellectual property theft, to name a few.

Those technicians responsible for using the Custom Code to comply with access demands will likely be targeted by phishing attacks—emails carefully designed to seem legitimate but which contain malware—that seek to steal the Custom Code. The same technicians will be approached with offers to buy the software. The price offered could be irresistibly high, as the Custom Code will be worth a lot to foreign national security officials and organized crime syndicates, and can be sold to multiple customers. Or Apple technicians may be blackmailed to the same end. In short, the Custom Code will be exceedingly valuable and in danger of leaking or being stolen.

Finally, that brief also notes a key point being raised increasingly by security experts: that if a company can be forced to remove security features in an automatic update, it creates incentives for people not to update their devices, which will open up many more serious security problems:

Automatic updates are an important way that software companies ensure their users are as protected as possible from attackers, without inconvenience, significant effort, or technical savvy on the part of the user (who is more likely to install security updates when there is little or nothing she needs to do). These autoupdates are one of the reasons why the millions of iPhones currently in use worldwide are very secure.

Consumers (and their devices) trust these auto-updates because they are signed by the vendor. A cryptographic signature from Microsoft or Apple assures the user that the software she is about to install legitimately comes from the company she trusts. It is akin to Apple saying, “This is Apple, and we stand behind this software.” Here, however, the Court is contemplating ordering Apple to sign software it does not stand behind and in fact considers “too dangerous to build.” .... And the next logical step if this Court enforces its Order is for the FBI to ask to compel other vendors, in addition to Apple, to sign other software that bypasses other customer security measures, creating new and different risks.

This is why compelling cryptographic signatures is extremely risky. Automatic software updates are a crucial vehicle for maintaining the security of iOS devices and other computers, but they can be effective only so long as users continue to trust them. If the Court compels Apple to create and sign the Custom Code in this high-profile case, then all computer users, especially those for whom smartphone privacy may already be a concern, could become suspicious of all software updates going forward. That is because a member of the public could reasonably fear that in the future, even a signed software update from a trusted vendor will bypass passcode limitations, convert her iPhone into an audio or video recording device, or otherwise interfere with her property, privacy, or security interests. Users will know that these updates could be software designed to extract private data from the user’s machine, but which a company was forced to sign at the behest of some court, law enforcement, or other government official. The code would be indistinguishable from a genuine update created, signed, and transmitted of the vendor’s own free will.

This distrust would have serious ramifications for computer security at large. In response, some users would likely stop accepting iOS updates (which users must choose to install), in which case their machines will remain unprotected against vulnerabilities that legitimate automatic updates would have patched. Importantly, the impact of unpatched devices is not limited to those devices. Vulnerable software that has not been updated can become a vector for spreading malware, potentially compromising other machines on the network. The more users who turn off automatic updates, the more devices, the more information, the more people put at risk. Just as herd immunity to a disease is lost if enough members of the group are not vaccinated against the disease, if enough users stop auto-updating their devices, it will weaken the entire device security ecosystem. Indeed, one computer security expert has likened automatic updates to “a public health system for the Internet.” It is this whole system which the Court ultimately threatens to put at risk should it enforce its Order to Apple.

Good stuff. One hopes that the judge will read this brief, in particular, carefully.

The other two things that were most interesting were not amicus briefs, but merely two of the letters to the judge. First was the letter from the UN Special Rapporteur on "the protection and promotion of the freedom of opinion and expression," David Kaye. He adds in some additional perspective about how the right to secure communications and encryption is a fundamental part of freedom of expression, including quoting from his own report on the benefits of encryption for the public, along with the challenges it presents for law enforcement. As he concludes:

My concern is that the subject order implicates the security, and thus the freedom of expression, of unknown but likely vast numbers of people, those who rely on secure communications for the reasons identified above and explicated in more detail in the report. This is fundamentally a problem of technology, one where compromising security for one and only one time and purpose seems exceedingly difficult if not impossible. Again from the report, “States must show, publicly and transparently, that other less intrusive means are unavailable or have failed and that only broadly intrusive measures, such as backdoors, would achieve the legitimate aim.” ... It is not clear that the Government has tried other means short of compelling Apple’s code-writing in this case, such as enlisting the technical expertise of other agencies to access this particular phone.

Finally, there's the letter from Salihin Kondoker, whose wife, Anies, was one of the people shot, but not killed, in the attack. That letter is truly worth reading. He notes that while he has been "frustrated that there isn't more information" as to why the attack occurred, and that he was initially frustrated that Apple might be a roadblock. But then, as he understood more of the details, he supports Apple's decision.

When I first learned Apple was opposing the order I was frustrated that it would be yet another roadblock. But as I read more about their case, I have come to understand their fight is for something much bigger than one phone. They are worried that this software the government wants them to use will be used against millions of other innocent people. I share their fear.

I support Apple and the decision they have made. I don’t believe Tim Cook or any Apple employee believes in supporting terrorism any more than I do. I think the vicious attacks I’ve read in the media against one of America’s greatest companies are terrible.

In my opinion it is unlikely there is any valuable information on this phone. This was a work phone. My wife also had an iPhone issued by the County and she did not use it for any personal communication. San Bernardino is one of the largest Counties in the country. They can track the phone on GPS in case they needed to determine where people were. Second, both the iCloud account and carrier account were controlled by the county so they could track any communications. This was common knowledge among my wife and other employees. Why then would someone store vital contacts related to an attack on a phone they knew the county had access to? They destroyed their personal phones after the attack. And I believe they did that for a reason.

[....]

Finally, and the reason for my letter to the court, I believe privacy is important and Apple should stay firm in their decision. Neither I, nor my wife, want to raise our children in a world where privacy is the tradeoff for security. I believe this case will have a huge impact all over the world. You will have agencies coming from all over the world to get access to the software the FBI is asking Apple for. It will be abused all over to spy on innocent people.

You never know how much weight a court will put on these things. Amicus briefs often are little more than a chance for some publicity for those filing them. But many of these briefs (and letters) are detailed, thoughtful and actually do add compelling and important perspectives on the larger issues involved in this case. Hopefully the judge pays attention.

Support our crowdfunding campaign to help us keep covering stories like these!

Filed Under: all writs act, amicus briefs, backdoors, calea, doj, encryption, fbi
Companies: apple

San Bernardino DA Tells Judge To Side With FBI Over Apple Because iPhone May Have Mythical Cyber Weapon

from the magical-unicorn-fairy-thinking dept

There's been lots of press coverage over the fact that basically a ton of organizations and experts have filed amicus briefs in support of Apple in its legal fight with the FBI/DOJ -- and we'll have a post on that shortly -- but on the flip side, the District Attorney for San Bernardino Country, hilariously arguing that he represents "the people of California" as his client, has filed one of the nuttiest amicus briefs you'll see in favor of the FBI. The full brief application to file a brief is incredibly short and basically makes no actual legal argument pertaining to the actual questions in the case, involving the power of the All Writs Act, or the necessity of Apple's involvement. Instead, it tosses out two insane reasons why it's necessary to get into this phone -- which, again, is the work iPhone of Syed Farook (the DA spells it Sayed) -- both of which are speculative in the extreme:

1. Initial reports suggested there were three shooters, instead of two. And even though that was later discounted by basically everyone, perhaps this one phone will reveal a third shooter.
2. Perhaps the phone has some sort of mythical cyber weapon that could wreak havoc on the world.

Really. Here are the key paragraphs from the amicus brief:

At the time that the murders were being perpetrated at least two 911 calls to the San Bernardino Police Dispatch center reported the involvement of three perpetrators. Although the reports of three individuals were not corroborated, and may ultimately be incorrect, the fact remains, that the information contained solely on the seized iPhone could provide evidence to identify as of yet unknown co-conspirators who would be prosecuted for murder and attempted murder in San Bernardino County by the District Attorney.

The iPhone is a county owned telephone that may have connected to the San Bernardino County computer network. The seized IPhone may contain evidence that can only be found on the seized phone that it was used as a weapon to introduce a lying dormant cyber pathogen that endangers San Bernardino County's infrastructure, a violation of Cal. Penal Code §502 (Lexis 2016) and poses a continuing threat to the citizens of San Bernardino County.

What?!? On that first point, as detailed in On the Media's wonderful "Breaking News Consumer Handbook," when it comes to active shooter situations, there will almost always be a false report of more shooters than their actually are. On the second point... just wow. San Bernardino County District Attorney Michael Ramos is apparently now making up shit out of thin air. Aren't law enforcement searches supposed to involve "probable cause" rather than "um... what's the scariest computery thing I could think of based on what I've seen in TV and movies?"

As iPhone forensics expert Jonathan Zdziarski told Dave Kravets at Ars Technica, this is the equivalent of the idea that a "magical unicorn might exist on this phone." He also noted "the world has never seen what he is describing coming from an iPhone." And also:

It sounds like he’s making up these terms as he goes. We've never used these terms in computer science. I think what he’s trying to suggest is that Farook was somehow working with someone to install a program on the iPhone that would infect the local network with some kind of virus or worm or something along those lines. Anything is possible, right? Do they have any evidence whatsoever to show there is any kind of cyber pathogen on the network or any logs or network captures to show that Farook's phone tried to introduce some unauthorized code into the system?

Security researchers are now cracking all kinds of jokes about this:

Cyber pathogens are so unspeakably dangerous that the open research community has wisely never published a single paper about them.

— matt blaze (@mattblaze) March 4, 2016

When the security world is making jokes about your legal filing, perhaps it wasn't a good idea.

Of course, it should also be noted that this is not actually the first time San Bernardino County DA Michael Ramos has been mentioned here on Techdirt. Last year he was blathering on about charging drone operators for murder for flying drones near wildfires. One would hope that magistrate judge Sheri Pym knows better than to give any weight to an argument that is based on magic pixie dust fantasy-land arguments.

Filed Under: cyber pathogen, cyber weapon, doj, fbi, michael ramos, san bernardino, san bernardino da
Companies: apple

Amazon Removes Encryption Support, Just As Its CTO Says 'Encryption Is Mandatory'

from the uh,-what? dept

So this is disappointing. While Amazon has come out in support of Apple's fight against the DOJ on backdoors, and its CTO, Werner Vogels just gave an impassioned speech in favor of encryption, the company itself... has removed encryption from its Fire OS 5. This is getting a lot of attention today in response to this tweet from cybersecurity guy David Scovetta:

While Apple fights the good fight, @Amazon removes encryption as option from FireOS 5 | @csoghoian @normative @eff pic.twitter.com/nggBdtFG7j

— David Scovetta (@davidscovetta) March 3, 2016

If you can't see that, it is a screenshot noting that Amazon has ended encryption support for the Fire tablet:

Encryption Support on Fire Tablet

Encryption support will soon be deprecated on Fire HD (4th Generation) and Fire HDX 8.9 (4th Generation). Here's what to do to ensure your data and other information are saved.

Your device has encrypted data. However, device encryption is no longer supported in Fire OS 5. Follow the steps outlined below to save your data.

It turns out this information actually started leaking out last week, with complaints popping up on Reddit and Hacker News and various Amazon forums.

This is ridiculous. So far, Amazon has not been willing to comment, but it's hard to square this decision with what its CTO Vogels was saying just as Amazon made this move:

We have a very strong opinion on this. We believe that you cannot have a connected business, or an Internet-connected business and not make security and protection of your customers your number one priority.

Encryption plays a very, very important role in that. To be honest, it is one of the few really strong tools we have so customers know that only they have access to their data and nobody else.

In our cloud division we put encryption into all of our services where customers can manage their own keys. I think that encrypting your data … of your customers is mandatory. It is not only mandatory from a business point or in the cloud, but also on premise. You should be encrypting your data. Without backdoors you can be sure that you are the only one who has access to your data.

I and many others agree. Which raises serious questions why the company where Vogels is CTO seems to now be doing the exact opposite.

Filed Under: encryption, fire os, fire phones, fire tablet, security, werner vogels
Companies: amazon, apple

Surprise: Pro-Surveillance WSJ Editorial Board Sides With Apple Over FBI

from the good-for-them dept

Well here's a surprise. The Wall Street Journal Editorial board, which is notoriously pro-surveillance, has come out with an editorial that argues that Apple is right on encryption and should resist the FBI's demands. I was not expecting that. This is the same WSJ that fought hard against amending the PATRIOT Act, which it insisted was necessary for surveillance. This is the same WSJ that published an editorial calling Ed Snowden a sociopath and arguing for less oversight of the NSA. Hell, it's the same WSJ that a little over a year ago published a piece by former publisher L. Gordon Crovitz, arguing that Apple is crazy for not installing backdoors in its iPhones.

But, for whatever reason, in this case, the WSJ editorial board has Apple's back. Not only that, but unlike many news reports, this piece actually seems to get the facts right and "debunks" many of the myths floating around -- many that are being pushed by the FBI and its supporters:

One confusion promoted by the FBI is that its order is merely a run-of-the-mill search warrant. This is false. The FBI is invoking the 1789 All Writs Act, an otherwise unremarkable law that grants judges the authority to enforce their orders as “necessary or appropriate.” The problem is that the All Writs Act is not a catch-all license for anything judges want to do. They can only exercise powers that Congress has granted them.

[....]

The other myth is that Apple is merely being asked to crack “one phone in the entire world,” as Marco Rubio puts it. This is also false. The Justice Department is beseeching Apple to provide software retrofits in at least a dozen public cases, and state and local prosecutors have stacks of backlogged iPhones they want unlocked too. In the New York case Apple won this week, prosecutors want Apple to unlock an iPhone even though the owner has pleaded guilty.

The opinion piece also recognizes just how crazy it would be if the DOJ wins and how far the precedent reaches:

Congress could instruct tech makers from now on to build “back doors” into their devices for law-enforcement use, for better or more likely worse. But this back-door debate has raged for two years. In the absence of congressional action, the courts can’t now appoint themselves as a super legislature to commandeer innocent third parties ex post facto.

What makes the FBI’s request so extraordinary is that the iPhone encryption and security methods were legal when they were created and still are. Apple has no more connection to the data on Farook’s phone than Ford does to a bank robber who uses an F-150 as a getaway vehicle.

This is all pretty accurate, which is a surprise, given how vehement the WSJ's editorial pages have been in the past in support of greater surveillance powers. On its own the WSJ piece is a nice summary of the issue. However, given the source, it's absolutely amazing. It suggests that, even among its usual allies, the DOJ's arguments in favor of backdooring encryption are not working very well.

Filed Under: doj, encryption, fbi, surveillance, wsj
Companies: apple

Congress Seems Pretty Angry About The FBI's Belief That The Courts Can Force Apple To Help It Get Into iPhones

from the good-for-them dept

Congressional hearings involving law enforcement and intelligence folks tend to be fawning affairs, with most of Congress willing to accept whatever these guys have to say. Sure, you'll always have a few people critical of certain aspects, but generally speaking, Congress is especially friendly to the FBI, NSA, CIA, etc. So it must have come as a bit of a shock to FBI Director James Comey that during a long House Judiciary Committee hearing yesterday, they seemed pretty pissed off at Comey's belief that the courts should force Apple to help him open up encrypted iPhones.

One judiciary member questioned how the FBI managed to mess up so badly during the San Bernardino investigation and reset the shooter’s password, which is what kicked this whole controversy and court case in motion in the first place. And if the case was such an emergency, why did they wait 50 days to go to court? Another member questioned what happens when China inevitably asks for the same extraordinary powers the FBI is demanding now. Others questioned whether the FBI had really used all the resources available to break into the phone without Apple’s help. For example, why hasn’t the FBI attempted to get the NSA’s help to get into the phone, since hacking is their job?

[....]

More than anything, though, the members of Congress expressed anger that the FBI director didn’t follow through earlier on his stated intention to engage in a debate in Congress and the public about the proper role for encryption in society. Instead, he decided to circumvent that debate altogether and quietly go to court to get a judge to do what the legislative branch has so far refused to do.

In some cases, they directly called out Comey for appearing to use the San Bernardino tragedy for political purposes:

“I would be deeply disappointed if it turns out the government is found to be exploiting a national tragedy to pursue a change in the law,” Rep. John Conyers (D-MI) told Comey.

[....]

“But what concerns me, Mr. Chairman, is that in the middle of an ongoing Congressional debate on this subject, the Federal Bureau of Investigation would ask a federal magistrate to give them the special access to secure products that this committee, this Congress, and the administration have so far refused to provide,” he said. “Why has the government taken this step and forced this issue?”

He went on to speculate that the reason could be found in an email from “a senior lawyer in the intelligence community,” obtained and published in part by the Washington Post in September 2015. The email said that the “the legislative environment [with respect to mandating backdoors] is very hostile today,” but that “it could turn in the event of a terrorist attack or criminal event where strong encryption can be shown to have hindered law enforcement.”

“I’m deeply concerned by this cynical mindset,” said Conyers, implying that the Department of Justice and the FBI might be exploiting the San Bernardino attacks in order to mandate backdoors.

To be fair, contrary to what some articles are saying, this is not the first time Congress has been skeptical about the FBI's view on the encryption wars. A little less than a year ago, a hearing set up by a different committee, the House Oversight Committee included some similar points with Congressional reps being quite skeptical of the claims by law enforcement about the need for encryption backdoors. However, the drumbeat from Congress appears to be getting louder -- and that's a good thing.

Of course, some of the annoyance from Congress appears to just be about who gets to decide what happens here. That is, some of the anger seemed to be over the DOJ's decision to rush to the judicial branch, rather than let the legislative branch figure out what it wants to do. However, there's definitely a clear (and, amazingly, bipartisan) group of folks in Congress who recognize that the FBI's arguments about how it "needs" this information is a bunch of hogwash.

Filed Under: all writs act, congress, doj, encryption, house judiciary committee, james comey, john conyers, mobile phones
Companies: apple

FCC 'Probing' Whether Cable Companies Have Sabotaged Internet Video

from the well,-duh dept

Most people realize that the cable and broadcast industry has worked tirelessly to protect its legacy cash cow from disruption. Dish was forced to make its ad-skipping DVR less useful if it wanted streaming licensing rights. Fox, Disney and Comcast/NBC for years kept Hulu from being too disruptive. ESPN sued Verizon for trying to offer more flexible TV lineups. Apple keeps running face first into broadcasters terrified of real disruption with its own TV plans. That's before you even get to cable companies busy capping and metering usage to hurt streaming services, while zero rating their own services for competitive advantage.

Gosh, it's almost as if there's a broad, coordinated, decade-long effort to keep legacy television expensive, barely-competitive, and shitty.

Enter the FCC, which, according to a Wall Street Journal report (registration required), is "probing" whether there's a coordinated effort by the cable and broadcast industry to keep Internet video from truly taking off. Though there's a number of ways the industry does this, the FCC's latest inquiry is focused on cable companies demanding broadcasters not license content to competing streaming services:

"Some evidence suggests the restrictive clauses may have effectively kept many TV programs off the Internet. Several big tech companies have tried to start Internet TV services, but have found it hard to get programming because of the exclusivity provisions. One new online TV venture, Sling TV, a subsidiary of Dish Network, says it suffered months of delay because of challenges posed by the contract clauses.

“When we launched Sling, one of the toughest things [was that] many of the programmers…had conditions in their programming agreements with other distributors that did restrict them in how they could license content,” Roger Lynch, Sling’s CEO, said in an interview."

So yes, some cable operators have demanded broadcasters intentionally limit who they offer service to, and you'd assume that Dish has forwarded something vaguely-resembling evidence to the FCC.

But the Journal report is oddly myopic in its coverage of the issue, vaguely implying that broadcasters like Disney, Fox, et al aren't also part of the problem. Disney for example owns ESPN, which again sued Verizon for upsetting the status quo of bloated, expensive channel bundles. Comcast/NBC took steps to hinder Hulu's growth despite being theoretically prohibited (via NBC merger condition) from Hulu management. Fox, meanwhile, has sued the hell out of any company attempting to do anything to so much as jostle the traditional TV apple cart.

This all comes up now because the FCC is reviewing Charter's attempted merger of Bright House Networks and Time Warner Cable. The regulator is fielding concerns from numerous companies that the merger will create another Comcast with a vested interest in hurting streaming video. Comcast's attempt to acquire these same companies was blocked, you'll recall, because the combined power of a broadcaster, cable operator and broadband company worried regulators (well, that and Comcast was immeasurably full of shit during its sales pitch).

Charter, by contrast, doesn't have the broadcast power of Comcast. And while Charter's customer service rankings are almost as bad as Comcast's, for whatever reason the company doesn't generate the same negative public sentiment, meaning less political pressure on the FCC to block the deal. To try and seal the deal, Charter has even gone so far as to hire respected neutrality advocate Marvin Ammori to help craft a company promise to avoid usage caps and adhere to net neutrality for (an admittedly unimpressive) three years after the deal is signed.

As such you're likely to see the FCC approve the deal, and the "probe" the Journal references is the regulator feeling out just what the conditions should be. Prohibiting Charter from agreements intentionally designed to sabotage streaming video competition might be a start, but it's not going to hinder the broadband and cable industry's primary avenue attack against Internet video: usage caps and zero rating. And so far, the FCC has been utterly comatose in its response to how Comcast and Verizon are using caps to give their own content a distinct marketplace advantage.

It's all well and good if the FCC wants to aid streaming video competition by opening the set top box or thwarting anti-competitive deals, but if the agency doesn't seriously address broadband competition, usage caps and zero rating, streaming video's just going to find itself choked off on the other end of the line. If the FCC wants to help, it can start by "probing" whether usage caps are necessary, whether the meters being used are accurate, and whether it made a mistake when it decided on net neutrality rules that pussy foot around the obvious problems caused by zero rating.

Historically telecom and cable merger conditions imposed by the FCC are sad, mostly meaningless, restrictions volunteered by the companies themselves (which they still often fail to adhere to). The FCC's going to have to dramatically change this historical narrative if it seriously hopes to keep the cable and broadcast industry from waging all-out-war on disruptive streaming alternatives.

Filed Under: collusion, competition, fcc, internet, internet video
Companies: apple, comcast, disney, espn, fox, hulu, verizon

Judge In Different Apple Case Says That All Writs Act Doesn't Mean Apple Needs To Help Feds Break Into Phone

from the paper-trail dept

Everybody has obviously been focused on the DOJ's All Writs Act request on Apple in the case involving the San Bernardino attacker's work iPhone, but as we've been covering there are a other cases where the feds have made use of the All Writs Act as well, including a key one in NY in the court of Magistrate Judge James Orenstein that we've been covering for a while now. Orenstein has already expressed skepticism about the government's argument, and now has come out with a well timed order denying it.

Judge Orenstein is no fool, and knows that the world will pay close attention to his order -- so it's pretty detailed. Also, and this is important, it basically mimics the key argument that Apple has made in its filing in the San Bernardino case, saying that the All Writs Act is preempted by other laws (mainly CALEA) and therefore, Apple cannot be compelled to help. In short, Congress has addressed this more specific issue and hasn't passed a law that allows the government to get what it wants, so the government can't just fall back on the All Writs Act to do what Congress failed to do:

More specifically, the established rules for interpreting a statute's text constrain me to reject the government's interpretation that the AWA empowers a court to grant any relief not outright prohibited by law. Under a more appropriate understanding of the AWA's function as a source of residual authority to issue orders that are "agreeable to the usages and principles of law," 28 U.S.C. § 1651(a), the relief the government seeks is unavailable because Congress has considered legislation that would achieve the same result but has not adopted it. In addition, applicable case law requires me to consider three factors in deciding whether to issue an order under the AWA: the closeness of Apple's relationship to the underlying criminal conduct and government investigation; the burden the requested order would impose on Apple; and the necessity of imposing such a burden on Apple. As explained below, after reviewing the facts in the record and the parties' arguments, I conclude that none of those factors justifies imposing on Apple the obligation to assist the government's investigation against its will. I therefore deny the motion.

In the case -- involving drug trafficking (not terrorism) charges against Jun Feng -- the DEA seized Feng's iPhone 5 (with iOS7) and wanted to use the All Writs Act to compel Apple to help open it up. The case was complicated by the fact that as this was being debated, Feng took a plea deal. However, the government still wanted to move forward to set a precedent (it claimed the information might be useful in sentencing or to find other partners and customers of Feng). Judge Orenstein "agreed" with the government that the issue is not moot, based on this, but uses it as a chance to shoot down its All Writs Act argument entirely.

In going into detail, Judge Orenstein basically repeats the basic argument that CALEA rules here, and the All Writs Act does not apply:

I believe Apple has the better argument – both because it is arguable that CALEA explicitly absolves a company like Apple of any responsibility to provide the assistance the government seeks here and also because even if CALEA does not have such an explicit prohibition, it is part of a larger legislative scheme that is so comprehensive as to imply a prohibition against imposing requirements on private entities such as Apple that the statute does not affirmatively prescribe.

Judge Orenstein goes on for many pages, in great detail, explaining why CALEA applies over the AWA and why it says that Apple need not help the government here. It's worth a read, but it follows pretty closely on Apple's own arguments.

There are also some pretty good lines and takedowns of government arguments, and I'll just note one here, involving how the government's argument could be so widely abused, in particular how the DOJ says that because Apple just "licenses" the software instead of selling it, then Apple retains a relationship which makes the All Writs Act demands apply. Judge Orenstein points out how insane such a reading of the law would be:

If Apple's retention of intellectual property rights in the software deployed in a device sold to the public sufficed to render it sufficiently close, for purposes of the AWA, to any crime committed by any user of such a device, it would eventually render the first discretionary factor under N.Y. Tel. Co. a dead letter. As constantly increasing computing power is continually squeezed into ever smaller storage devices, the category of consumer products containing licensed software will continue to grow. In a world in which so many devices, not just smartphones, will be connected to the Internet of Things, the government's theory that a licensing agreement allows it to compel the manufacturers of such products to help it surveil the products' users will result in a virtually limitless expansion of the government's legal authority to surreptitiously intrude on personal privacy.

This being a NY district court, the ruling has no direct precedential value (and certainly not in the Central District of California where the other big case is happening), but at the very least sets up the possibility of a circuit split that could get the issue to the Supreme Court relatively quickly. Also, just in general, it's good to see a judge not just roll over for the DOJ on requests like this and give due recognition to the legal concerns at issue.

Filed Under: all writs act, calea, dea, doj, encryption, fbi, james orenstein, jun feng
Companies: apple

Appeals Court Dumps Apple's Slide To Unlock Patent, Tosses Massive Jury Award Against Samsung In The Trash

from the bye-bye dept

Apple may have been able to convince a jury that Samsung violated a bunch of its patents, on concepts like "slide to unlock," but apparently the Court of Appeals for the Federal Circuit (CAFC) disagrees. Despite the court's reputation for regularly expanding the power of patents (and getting smacked around by the Supreme Court for doing so), CAFC has sided with Samsung and tossed out a jury's $120 million award and with it some Apple patents -- including "slide to unlock."

There were a few different patents in this lawsuit, and the appeals court found that Samsung didn't infringe on one of them and that two others were invalid. On the Slide to Unlock patent -- US Patent 8,046,721 -- the court said it was invalidated due to obviousness and the fact that all of the elements involved in slide to unlock were found in prior art. It notes that the "case for obviousness was strong" while "Apple's evidence... was weak." In fact, the court is not at all impressed by Apple's arguments for why "slide to unlock" was some great innovation -- including the idea that because the Steve Jobs reality distortion field made people all excited about it, that doesn't mean the idea wasn't obvious at the time.

Apple appears to identify the unsolved problem as the lack of an “intuitive” method of unlocking a touch-screen portable device. But Apple provided no evidence showing that this problem was recognized in the industry. No reasonable jury could find testimony by a single expert about his personal experience with one device as evidence of an industry-wide long-felt need.

[....]

As evidence of industry praise, Apple presented expert testimony that the attendees at an Apple event manifested approval when Steve Jobs first presented and unlocked the iPhone.... Evidence of approval by Apple fans—who may or may not have been skilled in the art—during the presentation of the iPhone is not legally sufficient.

CAFC also found an Apple patent (US Patent 8,074,172 on "autocorrect" features to be invalid as well. Everyone agreed that there was a ton of prior art around autocorrect -- it was just a question of whether or not Samsung did it "Apple's way." But here the court said that "Apple's way" was pretty obvious from the prior art. Once again, this may sound familiar:

In short, we find that Samsung presented a strong case of obviousness, showing that every element of claim 18 was present in the prior art. Apple’s evidence of secondary considerations was very weak.

Apple's "weak" defense was, in short, "but the iPhone was super popular and people like autocorrect" The court notes that this doesn't really matter.

Apple’s evidence shows that phones with autocorrection may sell better than phones without autocorrection, but it does not show that phones with the specific implementation of autocorrection embodied by claim 18 sell better than phones with other methods of autocorrection disclosed by the prior art.

The even bigger win, monetarily, for Samsung, though is the US Patent 5,946,647, which was on a "system and method for performing an action on a structure in computer-generated data." The alleged infringement of that patent was what made up the bulk ($98 million) of the $120 million award. And here, CAFC found simply that Samsung didn't infringe (the discussion there involves claim construction and specifically how Samsung's setup operates). Samsung is still fighting Apple on multiple other patent battles (and has lost a few). But considering how much attention the "slide to unlock" patent got, it's good to see it get tossed.

Filed Under: obvious, patents, slide to unlock
Companies: apple, samsung