Apple's VP Of Software Engineering: No, We Have Never Given A Backdoor To Any Government

from the shut-up-DOJ dept

One of the more ridiculous claims in the DOJ's filing against Apple last week, was its decision to pick up on former NSA lawyer Stewart Baker's conspiracy theory that Apple had built backdoors into its products for China (side note: I met Stewart in person for the first time recently, and he mocked me about this, saying that I should agree with him on this point). However, as we noted in our post last week, there doesn't seem to be much evidence to support Baker's claims. The two key issues were using the Chinese wireless standard WAPI -- which some have claimed includes some sort of backdoor, but it was also the only real local area wireless tech in China for a while -- and the decision to store iCloud data in China. However, as we noted, there have been reports that the Chinese government tried to then conduct a man in the middle attack against the iCloud servers. If Apple had actually given the government a backdoor, then why would it need to do that?

Either way, in a declaration attached to Apple's response, Apple had Craig Federighi, its senior VP of software engineering, tell the court directly that it has never installed a backdoor for any government ever:

Apple uses the same security protocols everywhere in the world.

Apple has never made user data, whether stored on the iPhone or in iCloud, more technologically accessible to any country's government. We believe any such access is too dangerous to allow. Apple has also not provided any government with its proprietary iOS source code. While governmental agencies in various countries, including the United States, perform regulatory reviews of new iPhone releases, all that Apple provides in those circumstances is an unmodified iPhone device.

It is my understanding that Apple has never worked with any government agency from any country to create a "backdoor" in any of our products or services.

Now, some may push back on the point about WAPI, but again, making use of a third party technology that potentially has backdoors (some of which could be protected against) and being told by the government to build special backdoors just for that government are still vastly different scenarios.

Filed Under: all writs act, backdoors, china, craig federighi, doj, encryption, fbi, going dark, icloud, wapi
Companies: apple

Apple Tells Court That The DOJ Is Lying About It Advertising The Fact That Encryption Keeps Out Law Enforcement

from the not-how-it-works dept

We already covered Apple's reply brief in the fight over getting into Syed Farook's encrypted work iPhone, highlighting a number of lies by the DOJ's filing. But I wanted to focus on a few more highlighted in the additional declarations filed by Apple as well. The DOJ kept insisting that Apple built this feature specifically to keep law enforcement out, which is ridiculous. Apple notes repeatedly that it built the feature to keep its customers safer from malicious attacks, most of which are not from law enforcement. But the DOJ keeps pretending that it was a deliberate attempt to mock law enforcement. In the DOJ's filing:

Here, Apple has deliberately used its control over its software to block law-enforcement requests for access to the contents of its devices, and it has advertised that feature to sell its products.

As part of its reply, however, Apple has a company advertising director, Robert Ferrini, note that the company has never promoted keeping law enforcement out as a feature in its ads:

Since the introduction of iOS 8 in October 2014, Apple has placed approximately 1,793 advertisements worldwide—627 in the United States alone—of different types, including, print ads, television ads, online ads, cinema ads, radio ads and billboards. Those advertisements have generated an estimated 253 billion impressions worldwide and 99 billion impressions in the United States alone (an impression is an estimate of the number of times an ad is viewed or displayed online).

Of those advertisements, not a single one has ever advertised or promoted the ability of Apple’s software to block law enforcement requests for access to the contents of Apple devices.

Indeed, only three of those advertisements reference security at all, and all three related to the Apple Pay service, and then only to say that Apple Pay is "safer than a credit card, and keeps your info yours."

I'm assuming the DOJ, if it decides to push this point, will argue that it wasn't talking about those kinds of advertisements, but Apple's statements to the press, but still, there's a strong point here. Contrary to what the DOJ is saying, no, the company does not proactively advertise the encryption as a way to keep law enforcement out. Or, in short, no, FBI, strong encryption on the iPhone just isn't about you.

Filed Under: advertising, all writs act, doj, encryption, fbi, going dark, law enforcement, robert ferrini
Companies: apple

Apple's Response To DOJ: Your Filing Is Full Of Blatantly Misleading Claims And Outright Falsehoods

from the no-love-lost dept

As expected, Apple has now responded to the DOJ in the case about whether or not it can be forced to write code to break its own security features to help the FBI access the encrypted work iPhone of Syed Farook, one of the San Bernardino attackers. As we noted, the DOJ's filing was chock-full of blatantly misleading claims, and Apple was flabbergasted by just how ridiculous that filing was. That comes through in this response.

The government attempts to rewrite history by portraying the Act as an all-powerful magic wand rather than the limited procedural tool it is. As theorized by the government, the Act can authorize any and all relief except in two situations: (1) where Congress enacts a specific statute prohibiting the precise action (i.e., says a court may not “order a smartphone manufacturer to remove barriers to accessing stored data on a particular smartphone,” ... or (2) where the government seeks to “arbitrarily dragoon[]” or “forcibly deputize[]” “random citizens” off the street.... Thus, according to the government, short of kidnapping or breaking an express law, the courts can order private parties to do virtually anything the Justice Department and FBI can dream up. The Founders would be appalled.

The Founders would be appalled. That's quite a statement.

Apple also slams the DOJ for insisting that this really is all about the one iPhone and that the court should ignore the wider precedent, citing FBI Director James Comey's own statements:

It has become crystal clear that this case is not about a “modest” order and a “single iPhone,” Opp. 1, as the FBI Director himself admitted when testifying before Congress two weeks ago. Ex. EE at 35 [FBI Director James Comey, Encryption Hr’g] (“[T]he broader question we’re talking about here goes far beyond phones or far beyond any case. This collision between public safety and privacy—the courts cannot resolve that.”). Instead, this case hinges on a contentious policy issue about how society should weigh what law enforcement officials want against the widespread repercussions and serious risks their demands would create. “Democracies resolve such tensions through robust debate” among the people and their elected representatives, Dkt. 16-8 [Comey, Going Dark], not through an unprecedented All Writs Act proceeding.

Apple then, repeatedly, points out where the DOJ selectively quoted, misquoted or misleadingly quoted arguments in its favor. For example:

The government misquotes Bank of the United States v. Halstead,..., for the proposition that “‘[t]he operation of [the Act]’” should not be limited “‘to that which it would have had in the year 1789.’” ... (misquoting Halstead, 23 U.S. (10 Wheat.) at 62) (alterations are the government’s). But what the Court actually said was that the “operation of an execution”—the ancient common law writ of “venditioni exponas”—is not limited to that “which it would have had in the year 1789.” ... see also... (“That executions are among the writs hereby authorized to be issued, cannot admit of a doubt . . . .”). The narrow holding of Halstead was that the Act (and the Process Act of 1792) allowed courts “to alter the form of the process of execution.” ... (courts are not limited to the form of the writ of execution “in use in the Supreme Courts of the several States in the year 1789”). The limited “power given to the Courts over their process is no more than authorizing them to regulate and direct the conduct of the Marshal, in the execution of the process.”

The authority to alter the process by which courts issue traditional common law writs is not authority to invent entirely new writs with no common law analog. But that is precisely what the government is asking this Court to do: The Order requiring Apple to create software so that the FBI can hack into the iPhone has no common law analog.

The filing then goes step by step in pointing out how the government is wrong about almost everything. The DOJ, for example, kept insisting that CALEA doesn't apply at all to Apple, but Apple points out that the DOJ just seems to be totally misreading the law:

Contrary to the government’s assertion that its request merely “brush[es] up against similar issues” to CALEA..., CALEA, in fact, has three critical limitations—two of which the government ignores entirely—that preclude the relief the government seeks.... First, CALEA prohibits law enforcement agencies from requiring “electronic communication service” providers to adopt “any specific design of equipment, facilities, services, features, or system configurations . . . .” The term “electronic communication service” provider is broadly defined to encompass Apple. ... (“any service which provides to users thereof the ability to send or receive wire or electronic communications”). Apple is an “electronic communication services” provider for purposes of the very services at issue here because Apple’s software allows users to “send or receive . . . communications” between iPhones through features such as iMessage and Mail....

The government acknowledges that FaceTime and iMessage are electronic communication services, but asserts that this fact is irrelevant because “the Court’s order does not bear at all upon the operation of those programs.” ... Not so. The passcode Apple is being asked to circumvent is a feature of the same Apple iOS that runs FaceTime, iMessage, and Mail, because an integral part of providing those services is enabling the phone’s owner to password-protect the private information contained within those communications. More importantly, the very communications to which law enforcement seeks access are the iMessage communications stored on the phone.... And, only a few pages after asserting that “the Court’s order does not bear at all upon the operation of” FaceTime and iMessage for purposes of the CALEA analysis..., the government spends several pages seeking to justify the Court’s order based on those very same programs, arguing that they render Apple “intimately close” to the crime for purposes of the New York Telephone analysis.

Second, the government does not dispute, or even discuss, that CALEA excludes “information services” providers from the scope of its mandatory assistance provisions.... Apple is indisputably an information services provider given the features of iOS, including Facetime, iMessage, and Mail....

Finally, CALEA makes clear that even telecommunications carriers (a category of providers subject to more intrusive requirements under CALEA, but which Apple is not) cannot be required to “ensure the government’s ability” to decrypt or to create decryption programs the company does not already “possess.”... If companies subject to CALEA’s obligations cannot be required to bear this burden, Congress surely did not intend to allow parties specifically exempted by CALEA (such as Apple) to be subjected to it. The government fails to address this truism.

Next, Apple rebuts the DOJ saying that since CALEA doesn't address this specific situation, that means Congress is just leaving it up to the courts to use the All Writs Act. As Apple points out, in some cases, Congress not doing something doesn't mean it rejected certain positions, but in this case, the legislative history is quite clear that Congress did not intend for companies to be forced to help in this manner.

Here, Congress chose to require limited third-party assistance in certain statutes designed to aid law enforcement in gathering electronic evidence (although none as expansive as what the government seeks here), but it has declined to include similar provisions in other statutes, despite vigorous lobbying by law enforcement and notwithstanding its “prolonged and acute awareness of so important an issue” as the one presented here.... Accordingly, the lack of statutory authorization in CALEA or any of the complementary statutes in the “comprehensive federal scheme” of surveillance and telecommunications law speaks volumes.... To that end, Congress chose to “greatly narrow[]” the “scope of [CALEA],” which ran contrary to the FBI’s interests but was “important from a privacy standpoint.” ... Indeed, CALEA’s provisions were drafted to “limit[] the scope of [industry’s] assistance requirements in several important ways.”....

That the Executive Branch recently abandoned plans to seek legislation expanding CALEA’s reach... provides renewed confirmation that Congress has not acceded to the FBI’s wishes, and belies the government’s view that it has possessed such authority under the All Writs Act since 1789.

In fact, in a footnote, Apple goes even further in not just blasting the DOJ's suggestion that Congress didn't really consider a legislative proposal to update CALEA to suck in requirements for internet communications companies, but also highlighting the infamous quote from top intelligence community lawyer Robert Litt about how they'd just wait for the next terrorist attack and get the law passed in their favor at that point.

The government’s attempts to minimize CALEA II, saying its plans consisted of “mere[] vague discussions” that never developed into a formal legislative submission ..., but federal officials familiar with that failed lobbying effort confirmed that the FBI had in fact developed a “draft proposal” containing a web of detailed provisions, including specific fines and compliance timelines, and had floated that proposal with the White House..... As The Washington Post reported, advocates of the proposal within the government dropped the effort, because they determined they could not get what they wanted from Congress at that time: “Although ‘the legislative environment is very hostile today,’ the intelligence community’s top lawyer, Robert S. Litt, said to colleagues in an August [2015] e-mail, which was obtained by The Post, ‘it could turn in the event of a terrorist attack or criminal event where strong encryption can be shown to have hindered law enforcement.’ There is value, he said, in ‘keeping our options open for such a situation.’”

Next Apple goes through the arguments for saying that, even if the All Writs Act does apply, and even if the court accepts the DOJ's made up three factor test, Apple should still prevail. It notes, again, that it is "far removed" from the issue and reminds the court that the order sought here is very different from past cases where Apple has cooperated:

The government argues that “courts have already issued AWA orders” requiring manufacturers to “unlock” phones ... but those cases involved orders requiring “unlocking” assistance to provide access through existing means, not the extraordinary remedy sought here, i.e., an order that requires creating new software to undermine the phones’ (or in the Blake case, the iPad’s) security safeguards.

It also mocks that weird argument from the DOJ that said because Apple "licenses" rather than "sells" its software, that means Apple is more closely tied to the case:

The government discusses Apple’s software licensing and data policies at length, equating Apple to a feudal lord demanding fealty from its customers (“suzerainty”). ... But the government does not cite any authority, and none exists, suggesting that the design features and software that exist on every iPhone somehow link Apple to the subject phone and the crime. Likewise, the government has cited no case holding that a license to use a product constituted a sufficient connection under New York Telephone. Indeed, under the government’s theory, any ongoing postpurchase connection between a manufacturer or service provider and a consumer suffices to connect the two in perpetuity—even where, as here, the data on the iPhone is inaccessible to Apple.

From there, Apple dives in on the question of how much of a "burden" this would be. This is the issue that Judge Pym has indicated she's most interested in, and Apple goes deep here -- again and again focusing on how the DOJ was blatantly misleading in its motion:

Forcing Apple to create new software that degrades its security features is unprecedented and unlike any burden ever imposed under the All Writs Act. The government’s assertion that the phone companies in Mountain Bell and In re Application of the U.S. for an Order Authorizing the Installation of a Pen Register or Touch-Tone Decoder and a Terminating Trap ..., were conscripted to “write” code, akin to the request here... mischaracterizes the actual assistance required in those cases. The government seizes on the word “programmed” in those cases and superficially equates it to the process of creating new software..... But the “programming” in those cases—back in 1979 and 1980—consisted of a “technician” using a “teletypewriter” in Mountain Bell ..., and “t[ook] less than one minute” in Penn Bell... Indeed, in Mountain Bell, the government itself stated that the only burden imposed “was a large number of print-outs on the teletype machine”—not creating new code..... More importantly, the phone companies already had and themselves used the tracing capabilities the government wanted to access.... And although relying heavily on Mountain Bell, the government neglects to point out the court’s explicit warning that “[t]his holding is a narrow one, and our decision today should not be read to authorize the wholesale imposition upon private, third parties of duties pursuant to search warrants.” ...This case stands light years from Mountain Bell. The government seeks to commandeer Apple to design, create, test, and validate a new operating system that does not exist, and that Apple believes—with overwhelming support from the technology community and security experts—is too dangerous to create.

Seeking to belittle this widely accepted policy position, the government grossly mischaracterizes Apple’s objection to the requested Order as a concern that “compliance will tarnish its brand”..., a mischaracterization that both the FBI Director and the courts have flatly rejected. [See Comey] (“I don’t question [Apple’s] motive”);... (disagreeing “with the government’s contention that Apple’s objection [to being compelled to decrypt an iPhone] is not ‘conscientious’ but merely a matter of ‘its concern with public relations’”). As Apple explained in its Motion, Apple prioritizes the security and privacy of its users, and that priority is reflected in Apple’s increasingly secure operating systems, in which Apple has chosen not to create a back door.

Apple also calls out the DOJ's technical ignorance.

The government’s assertion that “there is no reason to think that the code Apple writes in compliance with the Order will ever leave Apple’s possession” ... simply shows the government misunderstands the technology and the nature of the cyber-threat landscape. As Apple engineer Erik Neuenschwander states:

I believe that Apple’s iOS platform is the most-attacked software platform in existence. Each time Apple closes one vulnerability, attackers work to find another. This is a constant and never-ending battle. Mr. Perino’s description of third-party efforts to circumvent Apple’s security demonstrates this point. And the protections that the government now asks Apple to compromise are the most security-critical software component of the iPhone—any vulnerability or back door, whether introduced intentionally or unintentionally, can represent a risk to all users of Apple devices simultaneously.

... The government is also mistaken in claiming that the crippled iOS it wants Apple to build can only be used on one iPhone:

Mr. Perino’s characterization of Apple’s process . . . is inaccurate. Apple does not create hundreds of millions of operating systems each tailored to an individual device. Each time Apple releases a new operating system, that operating system is the same for every device of a given model. The operating system then gets a personalized signature specific to each device. This personalization occurs as part of the installation process after the iOS is created.

Once GovtOS is created, personalizing it to a new device becomes a simple process. If Apple were forced to create GovtOS for installation on the device at issue in this case, it would likely take only minutes for Apple, or a malicious actor with sufficient access, to perform the necessary engineering work to install it on another device of the same model.

. . . [T]he initial creation of GovtOS itself creates serious ongoing burdens and risks. This includes the risk that if the ability to install GovtOS got into the wrong hands, it would open a significant new avenue of attack, undermining the security protections that Apple has spent years developing to protect its customers.

And, not surprisingly, Apple angrily attacks the DOJ's bogus misleading use of Apple's transparency report statements about responding to lawaful requests for government information in China, by pointing out how that's quite different than this situation:

Finally, the government attempts to disclaim the obvious international implications of its demand, asserting that any pressure to hand over the same software to foreign agents “flows from [Apple’s] decision to do business in foreign countries . . . .”. Contrary to the government’s misleading statistics ..., which had to do with lawful process and did not compel the creation of software that undermines the security of its users, Apple has never built a back door of any kind into iOS, or otherwise made data stored on the iPhone or in iCloud more technically accessible to any country’s government.... The government is wrong in asserting that Apple made “special accommodations” for China, as Apple uses the same security protocols everywhere in the world and follows the same standards for responding to law enforcement requests.

Apple also points out that the FBI appears to be contradicting itself as well:

Moreover, while they now argue that the FBI’s changing of the iCloud passcode—which ended any hope of backing up the phone’s data and accessing it via iCloud—“was the reasoned decision of experienced FBI agents”, the FBI Director himself admitted to Congress under oath that the decision was a “mistake”.... The Justice Department’s shifting, contradictory positions on this issue—first blaming the passcode change on the County, then admitting that the FBI told the County to change the passcode after the County objected to being blamed for doing so, and now trying to justify the decision in the face of Director Comey’s admission that it was a mistake—discredits any notion that the government properly exhausted all viable investigative alternatives before seeking this extraordinary order from this Court.

On the Constitutional questions, again Apple points out that the DOJ doesn't appear to understand what it's talking about:

The government begins its First Amendment analysis by suggesting that “[t]here is reason to doubt that functional programming is even entitled to traditional speech protections” ... , evincing its confusion over the technology it demands Apple create. Even assuming there is such a thing as purely functional code, creating the type of software demanded here, an operating system that has never existed before, would necessarily involve precisely the kind of expression of ideas and concepts protected by the First Amendment. Because writing code requires a choice of (1) language, (2) audience, and (3) syntax and vocabulary, as well as the creation of (4) data structures, (5) algorithms to manipulate and transform data, (6) detailed textual descriptions explaining what code is doing, and (7) methods of communicating information to the user, “[t]here are a number of ways to write code to accomplish a given task.”... As such, code falls squarely within the First Amendment’s protection, as even the cases cited by the government acknowledge...

Later it points out that the DOJ's claim that since Apple can write such code however it wants it's not compelled speech, Apple points out that their argument says the exact opposite:

The government attempts to evade this unavoidable conclusion by insisting that, “[t]o the extent [that] Apple’s software includes expressive elements . . . the Order permits Apple to express whatever it wants, so long as the software functions” by allowing it to hack into iPhones.... This serves only to illuminate the broader speech implications of the government’s request. The code that the government is asking the Court to force Apple to write contains an extra layer of expression unique to this case. When Apple designed iOS 8, it consciously took a position on an issue of public importance.... The government disagrees with Apple’s position and asks this Court to compel Apple to write new code that reflects its own viewpoint—a viewpoint that is deeply offensive to Apple.

The filing is basically Apple, over and over again, saying, "uh, what the DOJ said was wrong, clueless, technically ignorant, or purposely misleading." Hell, they even attack the DOJ's claim that the All Writs Act was used back in 1807 to force Aaron Burr's secretary to decrypt one of Burr's cipher-protected letters. Apple points out that the DOJ is lying.

The government contends that Chief Justice Marshall once ordered a third party to “provide decryption services” to the government.... He did nothing of the sort, and the All Writs Act was not even at issue in Burr. In that case, Aaron Burr’s secretary declined to state whether he “understood” the contents of a certain letter written in cipher, on the ground that he might incriminate himself.... The Court held that the clerk’s answer as to whether he understood the cipher could not incriminate him, and the Court thus held that “the witness may answer the question now propounded”—i.e., whether he understood the letter.... The Court did not require the clerk to decipher the letter.

If anything, to be honest, I'm surprised that Apple didn't go even harder on the DOJ for misrepresenting things. Either way, Apple is pretty clearly highlighting just how desperate the DOJ seems in this case.

Filed Under: all writs act, doj, encryption, fbi, going dark, syed farook
Companies: apple

DOJ Officials Hint WhatsApp Likely Next In Line For The Apple Treatment

from the the-rest-of-the-dominoes-should-fall-like-a-house-of-cards...-checkmate dept

The New York Times is reporting -- based on the comments of several unnamed officials -- that WhatsApp may be headed for the same sort of courtroom dustup Apple is currently involved in.

As recently as this past week, officials said, the Justice Department was discussing how to proceed in a continuing criminal investigation in which a federal judge had approved a wiretap, but investigators were stymied by WhatsApp’s encryption.

The Justice Department and WhatsApp declined to comment. The government officials and others who discussed the dispute did so on condition of anonymity because the wiretap order and all the information associated with it were under seal. The nature of the case was not clear, except that officials said it was not a terrorism investigation. The location of the investigation was also unclear.

And, as long as we're operating on hearsay and conjecture, there's also this:

You’re getting useless data,” said Joseph DeMarco, a former federal prosecutor who now represents law enforcement agencies that filed briefs supporting the Justice Department in its fight with Apple. “The only way to make this not gibberish is if the company helps.”

“As we know from intercepted prisoner wiretaps,” he added, “criminals think that advanced encryption is great.”

You'd think that access to prisoner wiretaps would somewhat negate the need to break encryption, but maybe these mouthy inmates spend more time chatting about encryption than the allegations against them. And while I understand law enforcement's complaint that they used to be able to get all of this data with a warrant, they also used to have to run license plates by hand and perform stakeouts in person. So, it's not as though advances in technology have delivered no concurrent benefits.

Make no mistake about it: given the multitude of choices, the DOJ would rather have unfettered access to phones and all they contain. WhatsApp may have a billion or so users -- all protected by end-to-end encryption -- but if the FBI can crack open a phone, it can likely get to the content of the messages.

One of the cases indirectly cited (never by name) by James Comey during the early push against the coming darkness of Apple/Google's encryption-by-default revolved around messages recovered from a murdered 12-year-old's phone.

In the case of Amy Fletcher’s son Justin Bloxom, privacy advocates question whether phone evidence was critical to the cases. But Ms. Fletcher said: “Everything that was done was done through texts from a damn cell phone.”

“Had we not had that information, you wouldn’t realize how evil this man was,” said Ms. Fletcher, who didn’t know her son’s 2010 murder in Mansfield, La., had become part of the national debate until contacted by The Wall Street Journal.

There's no mention of WhatsApp in the Wall Street Journal's article, so it may be that all the recovered texts were of the SMS variety. But WhatsApp is supplanting SMS and the DOJ is definitely interested in the heavily-used messaging app. Last year, its requests to Facebook (which owns WhatsApp) for the contents of these messages jumped astronomically.

In the first six months of 2015, US law enforcement agencies sent Facebook 201 wiretap requests (referred to as “Title III” in the report) for 279 users or accounts. In all of 2014, on the other hand, Facebook only received 9 requests for 16 users or accounts.

Motherboard notes that this number, while still seemingly small, represents a 2133% increase. Not only that, but the total number of requests to Facebook for this data dwarfs similar requests from Google, which only saw 30 total for 2013-2014 combined.

The FBI and DOJ have yet to say much publicly about this particular case, probably feeling it's better to fight only one heavily-opposed battle at a time. But whatever the result of the Apple case, it will hardly be the end of the DOJ's efforts to force service providers to assist them in undermining their own protective efforts.

Filed Under: all writs act, doj, encryption, fbi, warrants, whatsapp
Companies: facebook, whatsapp

Apple General Counsel Blasts Justice Department For Crazy Filing

from the no-love-lost dept

It must be admitted that the Apple/FBI fight over iPhone encryption has had much more "outside the courtroom" drama than most cases -- what with both sides putting out their own blog posts and commenting publicly at length on various aspects. But things have been taken up a notch, it seems, with the latest. We wrote about the DOJ's crazy filing in the case, which is just chock full of incredibly misleading claims. Most of the time, when we call out misleading claims in lawsuits, the various parties stay quiet about it. But this one was apparently so crazy that Apple's General Counsel Bruce Sewell called a press conference where he just blasted the DOJ through and through. It's worth looking at his whole statement (highlights by me):

First, the tone of the brief reads like an indictment. We've all heard Director Comey and Attorney General Lynch thank Apple for its consistent help in working with law enforcement. Director Comey's own statement that "there are no demons here." Well, you certainly wouldn't conclude it from this brief. In 30 years of practice I don't think I've seen a legal brief that was more intended to smear the other side with false accusations and innuendo, and less intended to focus on the real merits of the case.

For the first time we see an allegation that Apple has deliberately made changes to block law enforcement requests for access. This should be deeply offensive to everyone that reads it. An unsupported, unsubstantiated effort to vilify Apple rather than confront the issues in the case.

Or the ridiculous section on China where an AUSA, an officer of the court, uses unidentified Internet sources to raise the spectre that Apple has a different and sinister relationship with China. Of course that is not true, and the speculation is based on no substance at all.

To do this in a brief before a magistrate judge just shows the desperation that the Department of Justice now feels. We would never respond in kind, but imagine Apple asking a court if the FBI could be trusted "because there is this real question about whether J. Edgar Hoover ordered the assassination of Kennedy — see ConspiracyTheory.com as our supporting evidence."

We add security features to protect our customers from hackers and criminals. And the FBI should be supporting us in this because it keeps everyone safe. To suggest otherwise is demeaning. It cheapens the debate and it tries to mask the real and serious issues. I can only conclude that the DoJ is so desperate at this point that it has thrown all decorum to the winds....

We know there are great people in the DoJ and the FBI. We work shoulder to shoulder with them all the time. That's why this cheap shot brief surprises us so much. We help when we're asked to. We're honest about what we can and cannot do. Let's at least treat one another with respect and get this case before the American people in a responsible way. We are going before court to exercise our legal rights. Everyone should beware because it seems like disagreeing with the Department of Justice means you must be evil and anti-American. Nothing could be further from the truth.

Somehow, I don't think Apple and the DOJ will be exchanging holiday cards this year. Apple's reply brief is due on Tuesday. I imagine it'll be an interesting weekend in Cupertino.

Filed Under: all writs act, bruce sewell, doj, encryption, fbi, litigation
Companies: apple

We Read The DOJ's Latest Apple Filing To Highlight All Of Its Misleading Claims

from the uh,-that's-not-how-this-works dept

Support our crowdfunding campaign to help us keep covering stories like these!

The Justice Department has now filed its response to Apple's motion to vacate being forced to undermine the security features of Syed Farook's work iPhone. It's... quite a piece of work. The DOJ is pulling out all the stops in this one, and it seems to be going deeper and deeper into the ridiculous as it does so. Of course, it repeats many of the arguments in its earlier filings (both its original application for the All Writs Order as well as its Motion to Compel -- which even the judge told the DOJ she didn't think it should file). For example, it continues to assert that this should be judged on the "three factor test" that it made up from a Supreme Court decision that doesn't actually have a three factor test.

But the crux of the DOJ's argument is basically "how dare Apple make a warrant-proof phone" and thus it's Apple's fault that they haven't made it easy for the FBI to get what it wants. This argument is bonkers on many levels. Let's dig in:

By Apple’s own reckoning, the corporation—which grosses hundreds of billions of dollars a year—would need to set aside as few as six of its 100,000 employees for perhaps as little as two weeks. This burden, which is not unreasonable, is the direct result of Apple’s deliberate marketing decision to engineer its products so that the government cannot search them, even with a warrant.

This is a purposeful misrepresentation. The issue here is that the judge has made it clear that the key issue that she's concerned with is whether or not the request from the DOJ represents an "unreasonable burden" on Apple -- as the "burden" is the only actual test laid out in the US v. NY Telephone case the DOJ keeps pointing to. But Apple didn't present the time and manpower to show that it's the resources that are the unreasonable burden, but the potential impact on the safety and security of its customers. Focusing on the time is not the issue, but of course, the DOJ pretends it is.

Second, the DOJ's continued its ridiculous insistence that making your products safe and secure is a "deliberate marketing decision" -- which somehow makes it offensive in some way. Apple didn't engineer its products "so that the government cannot search them," it's so that your information is safe and secure from anyone, including criminals. You would think that law enforcement people in the FBI and DOJ would appreciate more secure devices that reduce crime. There was a time that they did. To sneeringly suggest that better protecting the public is nothing more than a "marketing decision" is ridiculous. Hell, even if it was a "marketing decision," a big part of the reason that "the market" wanted such features so badly was because the US government itself overstepped its bounds with mass surveillance.

The Court’s Order is modest. It applies to a single iPhone, and it allows Apple to decide the least burdensome means of complying. As Apple well knows, the Order does not compel it to unlock other iPhones or to give the government a universal “master key” or “back door.” It is a narrow, targeted order that will produce a narrow, targeted piece of software capable of running on just one iPhone, in the security of Apple’s corporate headquarters.

It has been explained -- at length -- by both Apple and various amicus briefs, how ridiculous this is. Everyone -- including the FBI -- has now admitted that this case is almost entirely about the precedent, and that a win for the DOJ will inevitably mean a long line of law local and federal law enforcement lining up outside Apple's headquarters in Cupertino with court orders in their hands, demanding that Apple help them crack into iPhones. That's a big deal. It also sets a precedent even beyond Apple, that companies can be forced to deliberately (1) weaken security on their devices and services and (2) lie to the public about it by "signing" the devices as legit.

The government and the community need to know what is on the terrorist’s phone, and the government needs Apple’s assistance to find out.

No it does not need to know and no it does not need Apple's assistance. Again, there is always evidence that is off-limits in criminal investigations, and there are ways in which the FBI can likely get into this particular phone.

Instead of complying, Apple attacked the All Writs Act as archaic, the Court’s Order as leading to a “police state,” and the FBI’s investigation as shoddy, while extolling itself as the primary guardian of Americans’ privacy.... Apple’s rhetoric is not only false, but also corrosive of the very institutions that are best able to safeguard our liberty and our rights: the courts, the Fourth Amendment, longstanding precedent and venerable laws, and the democratically elected branches of government.

Apple didn't attack the AWA as "archaic" so much as inapplicable in this situation. Once again, the DOJ is doing some serious misrepresentation in this filing (and we're just three paragraphs in).

This case—like the three-factor Supreme Court test on which it must be decided—is about specific facts, not broad generalities. Here, Apple deliberately raised technological barriers that now stand between a lawful warrant and an iPhone containing evidence related to the terrorist mass murder of 14 Americans. Apple alone can remove those barriers so that the FBI can search the phone, and it can do so without undue burden. Under those specific circumstances, Apple can be compelled to give aid. That is not lawless tyranny. Rather, it is ordered liberty vindicating the rule of law. This Court can, and should, stand by the Order. Apple can, and should, comply with it.

Three factors! Drink! And, yes, Apple put in place these "barriers," but not as barriers to the government, but as security for everyone -- and there's a very big question, which the DOJ so desperately wishes to avoid with the mumble jumble above, which is whether or not a company can be forced to purposely write and sign code that deliberately undermines security features.

In deciding New York Telephone, the Supreme Court directly confronted and expressly rejected the policy arguments Apple raises now. Like Apple, the telephone company argued: that Congress had not given courts the power to issue such an order in its prior legislation; that the AWA could not be read so broadly; that it was for Congress to decide whether to provide such authority; and that relying on the AWA was a dangerous step down a slippery slope ending in arbitrary police powers.

Once again, the DOJ is misrepresenting the issues at play both in this case and in NY Telephone. In that case, a key part of the SCOTUS decision was based on the fact that NY Telephone was a public utility and therefore had certain responsibilities. That's not true of Apple. The DOJ also misrepresents the Congressional situation, which is different here, in that Congress did pass a specific law in this area, CALEA, which explicitly says that Apple need not help in this situation. The All Writs Act is a "gap filling" law, for when Congress has not spoken. But on this issue, it has.

The Supreme Court’s approach to the AWA does not create an unlimited source of judicial power, as Apple contends. The Act is self-limiting because it can only be invoked in aid of a court’s jurisdiction. Here, that jurisdiction rests on a lawful warrant, issued by a neutral magistrate pursuant to Rule 41. And New York Telephone provides a further safeguard, not through bright-line rules but rather through three factors courts must consider before exercising their discretion: (1) how far removed a party is from the investigative need; (2) how unreasonable a burden would be placed on that party; and (3) how necessary the party’s assistance is to the government. This three-factor analysis respects Congress’s mandate that the Act be flexible and adaptable, while eliminating the concern that random citizens will be forcibly deputized.

Three factors! Drink!

The DOJ insists that even with CALEA not saying it can do this, that doesn't matter, because CALEA is all about what companies can be forced to do prior to a warrant, not after.

CALEA, passed in 1994, does not “meticulously,” “intricately,” or “specifically” address when a court may order a smartphone manufacturer to remove barriers to accessing stored data on a particular smartphone. Rather, it governs what steps telecommunications carriers involved in transmission and switching must take in advance of court orders to ensure their systems can isolate information to allow for the real-time interception of network communications

But of course, under that interpretation, then the All Writs Act grants tremendous powers -- exactly the kinds of powers the DOJ insists elsewhere in this brief that isn't at issue in this case. I don't see how the DOJ can have it both ways.

As Apple recognizes, this Court must consider three equitable factors: (1) how “far removed” Apple is “from the underlying controversy”; (2) how “unreasonable [a] burden” the Order would place on Apple; and (3) how “necessary” its assistance is to searching Farook’s iPhone.

Three factors! Drink!

Apple is not so far removed from the underlying controversy that it should be excused from assisting in the execution of the search warrant. In New York Telephone, the phone company was sufficiently close to the controversy because the criminals used its phone lines. See 434 U.S. at 174. The Court did not require that the phone company know criminals were using its phone lines, or that it be involved in the crime. See id. Here, as a neutral magistrate found, there is probable cause to believe that Farook’s iPhone contains evidence related to his crimes. That alone would be sufficient proximity under the AWA and New York Telephone, even if Apple did not also own and control the software on Farook’s iPhone.

But again, under such an interpretation, the AWA can be used to force basically any tech company to figure out ways to spy on users if the FBI comes calling and gets a magistrate judge to rubber stamp an order. That's... crazy. Just because they use your technology does not mean that you're somehow legally on the hook for helping the FBI investigate their usage.

As Apple’s business model and its representations to its investors and customers make clear, Apple intentionally and for commercial advantage retains exclusive control over the software that can be used on iPhones, giving it monopoly-like control over the means of distributing software to the phones. As detailed below, Apple does so by: (1) firmly controlling iPhones’ operating systems and first-party software; (2) carefully managing and vetting third-party software before authenticating it for use on iPhones; and (3) continually receiving information from devices running its licensed software and its proprietary services, and retaining continued access to data from those devices about how its customers are using them. Having established suzerainty over its users’ phones—and control over the precise features of the phones necessary for unlocking them—Apple cannot now pretend to be a bystander, watching this investigation from afar.

This is kind of an incredible argument when you think about it: because Apple makes sure that its devices have updated software to keep it safe from vulnerabilities, that means that Apple is somehow connected to any use of the phone and responsible for helping the FBI crack into the phone. Does the FBI really want to encourage companies to stop offering any follow on support for software? Because that's the argument they're making here.

Thus, by its own design, Apple remains close to its iPhones through careful management and constant vigil over what software is on an iPhone and how that software is used. Indeed, Apple is much less “removed from the controversy”—in this case, the government’s inability to search Farook’s iPhone—than was the New York Telephone company because that company did not deliberately place its phone lines to prevent inconspicuous government access.... Here, Apple has deliberately used its control over its software to block law-enforcement requests for access to the contents of its devices, and it has advertised that feature to sell its products.

This argument is particularly maddening: basically continuing the ridiculous line of thinking that protecting user privacy is some sort of deliberate marketing strategy against the government, rather than in favor of protecting customers' own security and privacy.

And then we get even more maddening. In discussing the "burden" the DOJ literally tries to argue that if there is a burden, it's Apple's fault for designing a system so secure.

Apple is one of the richest and most tech-savvy companies in the world, and it is more than able to comply with the AWA order. Indeed, it concedes it can do so with relatively little effort. Even this modest burden is largely a result of Apple’s own decision to design and market a nearly warrant-proof phone.

This is monumentally misleading. The whole DOJ premise is that Apple deliberately is trying to interfere with legal investigations. But that's bonkers. Apple is just trying to build a secure phone for its users -- and a natural and unavoidable consequence of that is that it makes it more difficult for law enforcement to get access to that info. But that's because the whole point of such security is to make it more difficult for everyone who is not the phone's owner to get access, because that's how you protect them.

The DOJ is so vain it thinks Apple's security is all about them.

Then we get back to the lying:

Apple’s primary argument regarding undue burden appears to be that it should not be required to write any amount of code to assist the government.

Not really. Its primary argument is that the burden is in writing any amount of code that undermines the safety and security of its customers. That last part is kind of the important part. No wonder the DOJ ignores it.

Apple asserts that it would take six to ten employees two to four weeks to develop new code in order to carry out the Court’s Order.... Even taking Apple at its word, this is not an undue burden, especially given Apple’s vast resources and the government’s willingness to find reasonable compromises and provide reasonable reimbursement.

Apple is a Fortune 5 corporation with tremendous power and means: it has more than 100,000 full-time-equivalent employees and had an annual income of over $200 billion dollars in fiscal year 2015—more than the operating budget for California.... Indeed, Apple’s revenues exceed the nominal GDPs of two thirds of the world’s nations. To build the ordered software, no more than ten employees would be required to work for no more than four weeks, perhaps as little as two weeks.

Again, this is misleading (sense a theme?). First, as noted above, the "burden" is not so much in the time or engineers allotted to this issue. Second, even if we accept the DOJ's assertions here, it's misleading. The Apple filing noted that it would take that much effort just to create the initial code and to test it, but then noted -- quite rightly -- that if in the testing any problems arose, as they almost certainly would, it would need to basically redo the process. Part of the point, which can slip by non-technical people who have no experience developing and deploying code, is that this process could take a long, long time, and involve a lot of effort before it's actually safe to use on the actual phone.

Next up, the DOJ continues to insist that there can't possibly be any danger in creating this code, because Apple surely knows how to guard it, and further, that even if the code got out, that it wouldn't matter because it's asking for code that will only run on the Farook phone.

Next, contrary to Apple’s stated fears, there is no reason to think that the code Apple writes in compliance with the Order will ever leave Apple’s possession. Nothing in the Order requires Apple to provide that code to the government or to explain to the government how it works. And Apple has shown it is amply capable of protecting code that could compromise its security. For example, Apple currently protects (1) the source code to iOS and other core Apple software and (2) Apple’s electronic signature, which as described above allows software to be run on Apple hardware.... Those —which the government has not requested—are the keys to the kingdom. If Apple can guard them, it can guard this.

But, again, that leaves out the reality of testing this particular code and how that makes it much more likely the code will get out. This argument was presented in the amicus brief filed by iPhone forensics and security experts.

Next up, the DOJ totally misrepresents Apple's current assistance to government requests for information from the Chinese government. The DOJ is trying to argue, misleadingly, that Apple has no problem doing the same stuff for China, so that its worries about this case, creating a precedent for authoritarian regimes, is nonsense. But it's the DOJ's argument that's truly nonsense:

Apple suggests that, as a practical matter, it will cease to resist foreign governments’ efforts to obtain information on iPhone users if this Court rules against it. It offers no evidence for this proposition, and the evidence in the public record raises questions whether it is even resisting foreign governments now. For example, according to Apple’s own data, China demanded information from Apple regarding over 4,000 iPhones in the first half of 2015, and Apple produced data 74% of the time.... Apple appears to have made special accommodations in China as well: for example, moving Chinese user data to Chinese government servers, and installing a different WiFi protocol for Chinese iPhones.... Such accommodations provide Apple with access to a huge, and growing, market.... This Court’s Order changes neither the carrots nor the sticks that foreign governments can use on Apple. Thus, it does not follow that if America forgoes Apple’s assistance in this terrorism investigation, Apple will refuse to comply with the demands of foreign governments. Nor does it follow that if the Court stands by its Order, Apple must yield to foreign demands, made in different circumstances without the safeguards of American law.

What the DOJ is referring to here is Apple's latest transparency report in which it notes that it complied with 74% of government requests for information from China. You can see it here: But again, Apple has always been willing to respond to legitimate government requests for information that it has access to. That's why that same chart shows that it complied with 81% of US requests as well. But that says absolutely nothing about the requirement to build a special system to hack in and access data that it does not currently have access to.

The rest of the China stuff, about servers and WAPI, is just the DOJ picking up on Stewart Baker's conspiracy theory that he posted a few weeks back. Lots of countries (stupidly) demand local storage, not necessarily because of surveillance reasons, but because they think it's good for their economy. And the reason Apple used WAPI was because that was the standard used in China for WiFi-like wireless. And as for the idea that Apple magically gave access to the Chinese, that makes no sense, given that Apple then had to fight a man in the middle attack against iCloud in China that was claimed to have originated from the Chinese government. If Apple gave it access, why would the government need to run a MiTM attack? The whole argument makes no sense.

In the first half of 2015 alone, Apple handled 27,000 “device requests”—often covering multiple devices—and provided data approximately 60% of the time.... If Apple can provide data from thousands of iPhones and Apple users to China and other countries, it can comply with the AWA in America. (Id.) This is not speculation because, in fact, Apple complied for years with American court orders to extract data from passcode-locked iPhones, dedicating infrastructure and personnel in order to do so.

Again that's different. That's about supplying the info that Apple had access to and not about writing code to undermine security features. Apples and oranges.

Finally, the DOJ mocks Apple's constitutional arguments on the First and Fifth Amendments.

Apple’s claim is particularly weak because it does not involve a person being compelled to speak publicly, but a for-profit corporation being asked to modify commercial software that will be seen only by Apple. There is reason to doubt that functional programming is even entitled to traditional speech protections....

To the extent Apple’s software includes expressive elements—such as variable names and comments—the Order permits Apple to express whatever it wants, so long as the software functions.

We're not "compelling" you to say this exactly, we're letting you say whatever you want... so long as it does what we want it to. That still seems like compelled speech, no?

Apple lastly asserts that the Order violates its Fifth Amendment right to due process. Apple is currently availing itself of the considerable process our legal system provides, and it is ludicrous to describe the government’s actions here as “arbitrary.”

Once again, it appears that many of the DOJ's arguments here are misleading in the extreme. Apple's response is due next week, and I imagine it will be quite a read as well.

Support our crowdfunding campaign to help us keep covering stories like these!

Filed Under: all writs act, china, doj, encryption, fbi
Companies: apple

DOJ Keeps Pointing To A '3 Factor Test' In Its Cases Against Apple; Except No Such 'Test' Exists

from the making-it-up-as-we-go-along dept

The deeper you dive into the various DOJ filings to try to use the All Writs Act to force Apple to hack into encrypted iPhones, the more and more dishonest they seem. We already covered some of the misleading claims in the DOJ's latest filing in NY, including pointing to a 2012 case as evidence that the All Writs Act can be used to force Apple to break into a phone, when the actual ruling in that case said only that Apple had standing to oppose an All Writs Act order.

However, buried in an excellent article by Sarah Jeong at Vice's Motherboard about that same filing, there's another interesting tidbit that seems worth exploring: in both the NY and California cases, the DOJ has repeatedly pointed to a so-called "three factor test" under United States v. New York Telephone Co., which is the key case that established that it's acceptable, under the All Writs Act, for the FBI to force a telephone company to install and use a "pen register" device on telephone lines (to track who they call). In the original motion for the order in the San Bernardino case, here's the DOJ's argument on page 14 and 15 of that document:

In New York Telephone Co., the Supreme Court considered three factors in concluding that the issuance of the All Writs Act order to the phone company was appropriate. First, it found that the phone company was not "so far removed from the underlying controversy that its assistance could not be permissibly compelled." ... Second, it concluded that the order did not place an undue burden on the phone company.... Third, it determined that the assistance of the company was necessary to achieve the purpose of the warrant.... Each of these factors supports issuance of the order directed to Apple in this case.

The DOJ repeated this paragraph verbatim in its motion to compel (on page 15) and again (verbatim) in the filing in NY (page 38).

The magistrate judge in NY, James Orenstein, accepted this three factors test, and used it to argue that the DOJ's application actually failed to meet the requisite factors (starting right on page 1):

In addition, applicable case law requires me to consider three factors in deciding whether to issue an order under the AWA: the closeness of Apple's relationship to the underlying criminal conduct and government investigation; the burden the requested order would impose on Apple; and the necessity of imposing such a burden on Apple. As explained below, after reviewing the facts in the record and the parties' arguments, I conclude that none of those factors justifies imposing on Apple the obligation to assist the government's investigation against its will.

There's just one problem in all of this -- as highlighted in Jeong's article linked above, and discussed in more detail by Orin Kerr last month: there is no three factors test in the US v. NY Telephone case. As Jeong summarizes:

You could argue it’s three factors, or maybe four, or even five. The point is, NY Telephone isn’t as easy to apply as the government makes it out to be. Everyone in the Apple case is playing in uncharted waters.

Kerr notes that the paragraph in the Supreme Court's ruling, far from laying out a "three factor test" appears to be "frustratingly murky."

The tricky part of New York Telephone is that the Court left the actual test for what the AWA allows frustratingly murky. The Court was comparatively clear about one essential limit on a Court’s power under the AWA: “We agree that the power of federal courts to impose duties upon third parties is not without limits; unreasonable burdens may not be imposed.” Okay. But the rest of what the Court says is really unclear.

Here are the key paragraphs from the Supreme Court ruling:

Turning to the facts of this case, we do not think that the Company was a third party so far removed from the underlying controversy that its assistance could not be permissibly compelled. A United States District Court found that there was probable cause to believe that the Company’s facilities were being employed to facilitate a criminal enterprise on a continuing basis. For the Company, with this knowledge, to refuse to supply the meager assistance required by the FBI in its efforts to put an end to this venture threatened obstruction of an investigation which would determine whether the Company’s facilities were being lawfully used. Moreover, it can hardly be contended that the Company, a highly regulated public utility with a duty to serve the public, had a substantial interest in not providing assistance. Certainly the use of pen registers is by no means offensive to it. The Company concedes that it regularly employs such devices without court order for the purposes of checking billing operations, detecting fraud, and preventing violations of law. It also agreed to supply the FBI with all the information required to install its own pen registers. Nor was the District Court’s order in any way burdensome. The order provided that the Company be fully reimbursed at prevailing rates, and compliance with it required minimal effort on the part of the Company and no disruption to its operations.

Finally, we note, as the Court of Appeals recognized, that without the Company's assistance there is no conceivable way in which the surveillance authorized by the District Court could have been successfully accomplished. The FBI, after an exhaustive search, was unable to find a location where it could install its own pen registers without tipping off the targets of the investigation. The provision of a leased line by the Company was essential to the fulfillment of the purpose— to learn the identities of those connected with the gambling operation—for which the pen register order had been issued.

So yeah, it mentions the three things the DOJ keeps insisting are the "three factor test" (if the third party is not "so far removed," if there is no "undue burden" and if the assistance was deemed "necessary"). But there's a hell of a lot of other stuff in there as well, including the fact that in that case, NY Telephone was "a highly regulated public utility." So that seems like a relevant "fourth" factor that weighs against the DOJ (and they conveniently skip over).

And, as Kerr notes, unlike basically any judicial "test," this one fails to lay out any of the ground rules:

The paragraph above is pretty confusing. It begins with the idea that the AWA doesn’t apply to someone “so far removed” from the controversy; then turns to the need for the phone company’s help; then talks about what is “offensive” to the company; and then covers the burden to the phone company, focusing on how much it cost the business and interfered with it. But the paragraph doesn’t link these ideas or say how they relate to one another. It doesn’t say what the standard is for each idea or how much weight to give it.

In other words, this was just a way for the Court to get the case off the docket, not to set a "test" that would be applied 40 years later. Kerr later expands:

We’re mostly left with the uncertainty of the New York Telephone case itself. Beyond the “unreasonable burden” test, it’s not clear what to make of the other matters that the court mentions. Are they all just factors in a grand multi-factor test? Are they actually parts of the undue burden standard, just not explicitly labeled that way? Are they parts of what makes the order “appropriate”?

Once you figure that out — if you can — there’s the uncertainty about what each mentioned standard means.

Kerr then spends a lot of time noting that even with the actual establishment of the "unreasonable burden" test, there are no actual details or explanations to go with it and you can come up with a wide variety of possible interpretations that would lead to very different results. In short, there's no big "test" developed here, and despite nearly four decades, there's no evidence that anyone else has really made use of this "test" to determine the ground rules for it.

Either way, it seems clear that the DOJ keeps making some pretty direct claims in its filings that are based on either direct misreadings of things, or deliberately misleading the courts about these things. That seems like a dangerous game to play.

Filed Under: all writs act, doj, encryption, fbi, pen register, supreme court, three factor test
Companies: apple

The FBI Claims Failure To Guess Password Will Make Data 'Permanently Inaccessible,' Which Isn't True

from the all-in-service-of-future-writs-and-exploitations dept

The FBI's attempt to force Apple to help it break into an iPhone hasn't been going well. A lot of that has to do with the FBI itself, which hasn't exactly been honest in its portrayal of the case. It tried to fight off claims that it was trying to set precedent by claiming it was just about this one phone… which worked right up until it dropped details about twelve other phones it couldn't break into.

Comey's protestations of "no precedent" were further undermined by law enforcement groups filing briefs in support of the FBI that basically stated they, too, would like Apple to be forced to comply with orders like these. And then there was the whole thing about some "dormant cyber pathogen" that was basically laughed off the internet within hours of its appearance.

There were also claims that Apple has done this sort of thing 70 times in the past but was just being inexplicably obstinate this time for reasons the FBI could not comprehend. But that wasn't true either. Apple does provide law enforcement with access to data it can retrieve from its end -- which is nothing like writing software that would allow the FBI (and anyone else who gets their hands on it -- or who makes similar demands following an FBI win) to bypass the security features of its phones.

Dan Gillmor of the ACLU has taken another look at the FBI's motion to compel and found it has misrepresented how Apple's "auto-erase" (which occurs after a certain number of failed login attempts) actually works.

The FBI has been unable to make attempts to determine the passcode to access the SUBJECT DEVICE because Apple has written, or “coded,” its operating systems with a user-enabled “auto-erase function” that would, if enabled, result in the permanent destruction of the required encryption key material after 10 failed attempts at the [sic] entering the correct passcode (meaning that, after 10 failed attempts, the information on the device becomes permanently inaccessible)…

That's not what actually happens, Gillmor points out. All data is not erased once 10 failed attempts are recorded. An agency with as many technically-astute employees -- as well as access to a variety of data recovery and software forensic tools -- should know -- or likely does know -- that it doesn't work this way. The phone doesn't erase all of the data, nor does it make it "permanently inaccessible." Instead, it just destroys one of the keys to the data.

The key that is erased in this case is called the “file system key”—and (unlike the hardwired “UID” key that we discussed in our previous blog post) it is not burned into the phone’s processor, but instead merely stored in what Apple calls “Effaceable Storage,” which is just a term for part of the flash memory of the phone designed to be easily erasable.

The data is still intact. The front door isn't. But the FBI can work around this by preventing the key from being destroyed in the first place -- without Apple's help.

So the file system key (which the FBI claims it is scared will be destroyed by the phone’s auto-erase security protection) is stored in the Effaceable Storage on the iPhone in the “NAND” flash memory. All the FBI needs to do to avoid any irreversible auto erase is simple to copy that flash memory (which includes the Effaceable Storage) before it tries 10 passcode attempts. It can then re-try indefinitely, because it can restore the NAND flash memory from its backup copy.

Even if the FBI fails in its attempts to brute force the code, the data on the phone remains intact. By working with a copy of the flash memory, the FBI can restore the phone to its "10 guesses" state repeatedly until it finally guesses the code.

The FBI can simply remove this chip from the circuit board (“desolder” it), connect it to a device capable of reading and writing NAND flash, and copy all of its data. It can then replace the chip, and start testing passcodes. If it turns out that the auto-erase feature is on, and the Effaceable Storage gets erased, they can remove the chip, copy the original information back in, and replace it. If they plan to do this many times, they can attach a “test socket” to the circuit board that makes it easy and fast to do this kind of chip swapping.

It's literally unbelievable that the FBI doesn't have access to the tools to perform this or the expertise to get it done. Which leads Gillmor back to the inescapable conclusion: this isn't about one iPhone or even twelve of them. This is about convincing a judge to read the All Writs Act the way the FBI would like it to be read -- a reading that would not only push the envelope for what it can demand from unrelated parties in the future, but that would also give it software to modify and exploit.

If it gets to that point, device users are going to have to start eyeing software/firmware updates very suspiciously.

The FBI wants to weaken the ecosystem we all depend on for maintenance of our all-too-vulnerable devices. If they win, future software updates will present users with a troubling dilemma. When we're asked to install a software update, we won’t know whether it was compelled by a government agency (foreign or domestic), or whether it truly represents the best engineering our chosen platform has to offer.

This is the end game for the FBI, even though it doesn't appear to realize the gravity of the situation. To it, Apple is the obstacle standing between it and the wealth of information it imagines might possibly be on that phone. Even is Apple is forced into compliance and the phone contains nothing of use, it will still have its precedent and its hacking tool and we'll be headed towards a world where patch notes contain warrant canaries.

Filed Under: all writs act, burden, doj, fbi, hacking, iphones, passwords, security
Companies: aclu, apple

DOJ To NY Court: Hey, Can We Have Another Judge Look Over That Ruling About Breaking Into iPhones?

from the because-of-course dept

This is hardly a big surprise, but the Justice Department is not at all happy about NY magistrate judge James Orenstein's decision last week in the case against accused drug trafficker Jun Feng, that it cannot force Apple to break the security on an iPhone using the All Writs Act. While so much of the attention concerning iPhone encryption has been placed on the case in San Bernardino, the NY case made news well before the California case, and Orenstein was clearly aware that his ruling would have a much wider impact (and it was clearly written with that intent in mind). The Justice Department, of course, is now, in effect asking for a second opinion on the issue, carefully trying to position this case as something quite different than the San Bernardino case. In particular, the Justice Department is claiming that since this particular iPhone is using iOS 7, rather than 8, Apple already has a backdoor, and can easily unlock the contents of the phone.

To be clear, the DOJ probably does have a stronger argument in this case than it has in San Bernardino, but it's still got some serious problems.

The FBI/DOJ has been going around spreading misleading claims about how Apple has readily complied with similar orders to the San Bernardino order in the past. As we've noted, that's not actually true. The earlier orders involved earlier versions of iPhones where Apple did have easy access to opening up those phones -- and the San Bernardino case was different because it used a more modern version of the operating system, where it did not have such access. The DOJ's argument in NY is that this case is basically like the earlier cases since iOS 7 doesn't have the same strong encryption as later versions.

This is a routine application asking the Court to order a third party to assist in the execution of a search warrant. The Department of Justice has made the same application, for the same assistance, from the same company, dozens of times before. Federal courts around the nation have granted these applications. The company has complied every time. Until now.

In mid-2014, law enforcement agents arrested Jun Feng on charges related to his participation in a methamphetamine distribution conspiracy. Agents conducted a search of Feng’s home, pursuant to a warrant, and seized an Apple iPhone 5s running iOS 7. The government subsequently obtained a warrant to search the phone. The government is unable to access the data on the phone, however, because the phone is locked with a passcode. The government cannot bypass the lock screen without risking data destruction. Apple can. Apple has extracted data from iPhones like this one pursuant to All Writs Act orders numerous times, including as a result of orders issued in the Eastern District of New York. Apple has confirmed that it can do so again, in this case, with this phone, and that doing so would pose no significant burden to the company.

As an aside, the DOJ also points out that because someone has activated the "remote wipe" feature on Feng's phone, it's afraid to even turn on the phone, as that might destroy whatever is on the phone -- and claims that this service "can interfere with execution of a warrant."

To strengthen its argument, the DOJ points out that Apple's own law enforcement guidelines notes that it can access data on devices using iOS 7 or earlier. But the DOJ is (shocker!) not being entirely accurate. Here's the way the DOJ explains it:

Apple states in its Legal Process Guidelines, which Apple makes publicly available online and provides to law enforcement to this day, that “for iOS devices running iOS versions earlier than iOS 8.0, upon receipt of a valid search warrant issued upon a showing of probable cause, Apple can extract certain categories of active data from passcode locked iOS devices.” See “Extracting Data from Passcode Locked iOS Devices,” Apple Legal Process Guidelines § III(I) (last accessed Mar. 2016), http://www.apple.com/privacy/docs/legal-process-guidelines-us.pdf, attached hereto as Exhibit D. Apple’s guidelines also express a preference for specific language to be included in the order directed to it and how such an order should be served. Id. Apple states in its guidelines: “Once law enforcement has obtained a search warrant containing this language, it may be served on Apple by email . . . . After the data extraction process has been completed, a copy of the user generated content on the device will be provided.”

That sounds kind of damning... until you actually click the link the DOJ provides and read what Apple actually says. Because it's not what the DOJ claims. In fact, the Apple law enforcement guidelines makes it clear that while, yes, it can access some data on versions of iOS before iOS 8 that does not include information encrypted via a passcode. Here's the full paragraph which the DOJ carefully quoted above, and we'll highlight the relevant section that the DOJ conveniently left out:

For iOS devices running iOS versions earlier than iOS 8.0, upon receipt of a valid search warrant issued upon a showing of probable cause, Apple can extract certain categories of active data from passcode locked iOS devices. Specifically, the user generated active files on an iOS device that are contained in Apple’s native apps and for which the data is not encrypted using the passcode (“user generated active files”), can be extracted and provided to law enforcement on external media. Apple can perform this data extraction process on iOS devices running iOS 4 through iOS 7. Please note the only categories of user generated active files that can be provided to law enforcement, pursuant to a valid search warrant, are: SMS, iMessage, MMS, photos, videos, contacts, audio recording, and call history. Apple cannot provide: email, calendar entries, or any third-party app data.

Notice the section I've bolded? Apple says it can't extract information that is encrypted using a passcode. Seems notable that the DOJ left that part out. Of course, from the rest of the paragraph, it's possible to read that to mean that there's a lot of information that is not encrypted by the passcode -- including SMS, iMessage, MMS, photos, call history and more. So, the DOJ's claim on that kind of information may be much more valid.

On the whole, though, the DOJ does have a point that, given the version of the iOS on this phone, the "burden" placed on Apple is likely quite different in this case, rather than in other cases, where the security features are more advanced. And it may be more accurate that this case is a lot more like previous cases where Apple willingly complied with warrants and All Writs Act orders. Of course, just because it has complied in the past, that does not mean those orders are legal. And Apple's response will likely highlight that fact. Apple, of course, has the right to do what it's done in past cases, and then later decide that the All Writs Act is inappropriate in such cases -- and then to ask a judge to rule on that.

Even then, however, the DOJ's arguments seem... questionable. As EFF lawyer Kurt Opsahl points out, early on in the filing, the DOJ cites a Florida district court's order on a motion to quash in a case called United States v. David Zaragoza, claiming that it shows that courts can force Apple to help via the All Writs Act. However, if you actually read that ruling, it rejects Zaragoza's attempt to toss out an All Writs Act claim, but says that Apple has standing to object to such a demand:

In this case, the party bestpositioned to oppose, or to choose to not oppose, the AWA Order is Apple, because Apple bears the burden to comply with that order. Furthermore, Apple is the only party that can inform the court of highly-relevant facts–such as the amount of effort that is required to unlock and obtain information from the iPhone and the extent to which complying with the order would interfere with Apple’s daily operations.

That seems like an... odd case to argue says that Apple has to comply with All Writs Act demands, doesn't it? It's almost as if the DOJ expects that no one will read any of the stuff it cites.

Still, given the situation (a phone using iOS 7), this case is a lot less of a slam dunk than it might be on a more modern iPhone. And, of course, there's an argument that that's what the DOJ is banking on. If it can get the order here, it can then leverage that into other cases, such as the one in San Bernardino, where it can just turn around and say "well, if the order is valid for iOS 7, why isn't it valid for iOS 8?" Apple, of course, would then have a response concerning the "burden" on iOS being much greater due to the different security framework, but by then you're already arguing it at the level the DOJ prefers -- on the question of burden, rather than the question of whether or not the All Writs Act itself is applicable in these scenarios.

The DOJ goes on to claim that, contrary to Judge Orenstein's ruling last week, other laws do not cover this situation, and that the wiretapping statute CALEA and the electronic communications privacy law ECPA discuss different scenarios altogether, meaning that the All Writs Act can apply, as "filling the gap." This rebuts Orenstein's argument that this kind of remedy is not allowed by CALEA and ECPA. It also generally attacks the key points of Orenstein's ruling, claiming that he's misreading the case law, some of which may be on point. Some of which, on the other hand, are a bit crazy.

Take, for example, the question of whether or not Apple is "too far removed" for the All Writs Act to apply. In his ruling, Orenstein noted that Feng was using his own property, not Apple's: "To the extent that Feng used his iPhone in committing crimes, he used his own property, not Apple's." Incredibly, the DOJ hits back on that claim by saying that because Apple licenses rather than sells its software, Feng was actually using Apple's property, and thus it is not too far removed:

To the contrary, Feng used Apple's property — the software on the phone — to commit and conceal his crimes.... Indeed, Apple’s property — the software features including the passcode feature, auto-erase feature (if enabled), and remote wipe feature — continues to obstruct the investigation. Given that Apple manufactured, sold, and continues to exercise control over a phone used in a criminal enterprise, where it designed and has exclusive expertise about the software used to further that criminal enterprise, where that very software now thwarts the execution of the search warrant, and where Apple provides ongoing services to phone owners, including control over what software may run on the device and the ability to wipe the phone remotely, compulsion of Apple is permissible

In fact, the DOJ -- somewhat incredibly -- cites Apple's own filing in the infamous triennial review for copyright exemptions. Back in 2009, Apple opposed rules that would exempt phone jailbreaking, and in the process discussed "ownership" based on licensing. The DOJ appears to be using Apple's claims about copyright related issues, to bite back at Apple and claim that because it claims ownership of the software, it can't also claim that it's too far removed to be excused from obligations under the All Writs Act.

Man, those copyright issues sure have a way of showing up in strange places, huh?

Given all that and more, the DOJ asks the court to basically have another judge overrule Judge Orenstein. This isn't a huge surprise. Everyone knows that this case (and the San Bernardino case) will go through the full appeals process before it's finally over. This is just the next step on that long road. To be honest, the DOJ's argument here is much stronger than in the San Bernardino case at a first read, but the fact that it deliberately misrepresented what Apple's law enforcement guidelines say suggest that some of its other arguments may not be fully above board either.

Filed Under: all writs act, doj, encryption, ios 7, james orenstein, jun feng
Companies: apple

Full Brief From San Bernardino District Attorney Even More Insane Than Application About 'Dormant Cyber Pathogen'

from the it-goes-on-and-on dept

Support our crowdfunding campaign to help us keep covering stories like these!

Like many, we wrote about the bizarre filing from San Bernardino County District Attorney Michael Ramos in the Apple/FBI encryption fight -- you know, the one where he speculates randomly that the iPhone might contain evidence of a "dormant cyber pathogen" that is waiting to infect computer systems everywhere? Of course, that was found in his 4 page application to file the full brief, and as far as we can tell, no one else has explored the full 40 page brief that Ramos eventually did file, after magistrate judge Pym granted permission. And, it probably won't surprise you that in a filing that's 10x as long, it's got much more room for crazy arguments, many of which seem to be in the "day is night, black is white" variety. Let's dig in:

At issue before this Court is whether on balance there is a compelling governmental interest in acquiring evidence of criminal activity contained solely on the specific San Bernardino County-owned iPhone, seized and ordered searched by a lawful search warrant issued by a United States Magistrate, that outweighs any real or imagined interest that Apple, a for-profit California-based corporation, asserts to deny assistance to the FBI, San Bernardino County District Attorney's forensic partners, and by extension the San Bernardino County District Attorney and our client, the People of the State of California, in acquiring this evidence.

Actually, that's not the issue. The issue is not whether there's a compelling governmental interest, but whether or not a company can be compelled to build new hacking tools and surreptitiously load them onto user devices. That's a very different question, and one that Ramos doesn't even want to consider. So, instead, he makes up things unrelated to the issue at hand.

Then, Ramos repeats the whole bogus "there may have been a third shooter!" and "DORMANT CYBER PATHOGEN!" arguments, based on absolutely no evidence, and follows it up by flipping the burden of proof, and hilariously arguing that it is Apple's burden to prove that there is no such dormant cyber pathogen. PROVE A NEGATIVE, APPLE!

At the time that the murders in San Bernardino County were being perpetrated on December 2, 2015, at least two 911 calls to the San Bernardino Police Dispatch Center reported the involvement of three perpetrators. Although the reports of three individuals were not corroborated, and may ultimately be incorrect, the fact remains that the information contained solely on the seized iPhone could provide evidence to identify, as of yet, unknown co-conspirators who would be prosecuted by the District Attorney for multiple murders and attempted murders in San Bernardino County.

In addition, the iPhone is a county telephone that may have connected to the San Bernardino County computer network. The seized iPhone may contain evidence, that can only be found on the seized phone, that it was used as a weapon to introduce a lying-dormant cyber pathogen endangering San Bernardino County's infrastructure, a Violation of Cal. Penal Code § 502 (Lexis 2016), and which would pose a continuing threat to the citizens of San Bernardino County.

Apple has not advanced a single argument to indicating why the identification and prosecution of any outstanding coconspirators, or to detect and eliminate cyber security threats to San Bernardino County's infrastructure introduced by its product and concealed by its operating system, and Apple's refusal to assist in acquiring that information, is not a compelling governmental interest. To the extent that Apple states in its brief at page 33 that there is no compelling state interest because the government "has produced nothing more than speculation that this iPhone might contain potentially relevant information," Apple completely forgets that a United States Magistrate has issued a search warrant based on a finding of probable cause that the iPhone does contain evidence of criminal activity. The reason we search is to find out if the device contains evidence or is an instrumentality of the crime. Such authority is granted by the United States Constitution.

Got that? As long as the DA makes up some totally mythical "cyber pathogen," so long as Apple has not proven that such a thing is not on the phone, then open 'er up, Apple!. That's a fascinating view of due process.

Oh, speaking of due process, Ramos then, absolutely ridiculously, flips Apple's 5th Amendment due process argument on its head, arguing that by not hacking into users' devices, Apple is the one that is harming due process rights. Really:

The California Constitution guarantees victims of crimes committed in California a Victims' Bill of Rights.... These rights include those shared by all people of the State of California, "that persons who commit felonious acts causing injury to innocent victims will be appropriately and thoroughly investigated brought before the courts of California and tried by the courts in a timely manner." ... The Victims' Bill of Rights continues to state, "In order to preserve and protect a victim's rights to justice and due process, a victim shall be entitled to the following rights... To be reasonably protected from the defendant and persons acting on behalf of the defendant"... and the right to have all relevant evidence admitted in any criminal proceeding....

The due process protections of the California Constitution clearly attach to not only the fourteen people murdered, and the twenty two injured in the assault, but also those physically uninjured, but mentally injured survivors who witnessed the mass murder.

Apple is infringing on the due process rights of these real, and not speculative, victims. It is preventing protection from the defendant and those who assist the defendant. Through the design of its operating system and its refusal to assist in accessing the information contained on the seized phone, Apple is preventing the acquisition of information leading to the identity or elimination of outstanding coconspirators. This denies the surviving victims of the knowledge that there are either no additional coconspirators, or that those that are outstanding will be pursued. Apple's actions in denying assistance in acquiring access to the phone infringes on the Victims' right to be reasonably protected. Denying access to this information deprives victims of all relevant evidence in any criminal proceeding that could be the product of the information contained on the phone, and it certainly is denying the victims of the right guaranteed to them to have the case investigated and prosecuted in a timely manner.

Let's put this simply: this is an insane reading of the California Constitution. Based on this, Ramos can basically argue that anyone and anything that gets in the way of law enforcement finding out absolutely anything, no matter how speculative is infringing on someone's due process rights. Did you sell someone a shredder that allowed them to shred a paper that may have included something useful? You've infringed someone's due process rights. Did you happen to overhear someone planning a crime, but you can no longer remember what the person looked like? You've violated the victims due process rights. That's not how it works. Private companies don't infringe on someone's due process rights -- governments do.

And, then, just because this isn't crazy enough already, in somehow arguing that a private company has the burden to prove a negative, and that a private company is responsible for due process, Ramos argues that Apple is "usurping the authority of the District Attorney":

In refusing to assist in the opening of this repository of evidence, Apple is making the defacto decision of who can be charged with a crime and is giving a de facto grant of immunity to those iPhone users that use the phone as an instrumentality of a crime, a cyber weapon, or store, intentionally or not, evidence of a crime on the device. Questions of whether Apple's conduct falls within traditional definitions of harboring one who commits a crime aside, Apple is infringing on the authority of the District Attorney to make charging and immunity decisions. Apple is free to exercise its First Amendment rights to express what activities, including none at all, should be considered crimes, or who should be charged with a crime, including nobody, but Apple has no de jure or de facto authority to make those decisions by its actions.

No person but the San Bernardino County District Attorney and his deputies are authorized to decide when criminal charges are brought or not brought, or to whom to provide a grant immunity from prosecution in San Bernardino County. Apple has no such dejure or defacto authority in San Bernardino County.

Except... that's nuts. Apple is not "granting immunity" or making decisions about who can be charged with a crime. Like the whole "dormant cyber pathogen" this is Ramos simply making up shit and telling it to a judge. Nothing that Apple is doing prevents law enforcement from bringing charges if they have enough evidence. But, once again, Ramos is flipping the very concepts of burden of proof and due process in suggesting that any technology that happens to get in the way of collecting evidence is somehow "granting immunity."

If you thought that wasn't crazy enough, Ramos keeps going deeper and deeper into the "What did he just say.....?" hole. Next up: claiming that Apple is an "Orwellian arbiter" of privacy, which in his mind is illegal because Apple is not a public policy maker, and thus is somehow not allowed to build systems that keep customers' info private. I'm NOT JOKING (though, really, I wish I was).

Apple asserts that its operating system and its refusal to assist in unlocking the phone is, in Apple's view, necessary to protect the privacy interests of its customers. Apple advances its concept of privacy as absolute privacy in the context that it proffers the opinion that the contents of any Apple iPhone or Apple mobile device is immune from any type of government intrusion due to its security features. While Apple can represent what it chooses in its marketing of its devices and operating systems, Apple is neither the legislature nor judiciary empowered to define privacy as absolute. Apple in not a public policy maker. Apple is a for-profit corporation. No one has appointed or elected Apple to be the Orwellian arbiter or definer of privacy for society or even for all of Apple's customers.

This falls into the so wrong it's "not even wrong" category. It's insane. It's not even in the realm of reality. Of course a for-profit company gets to determine what kind of privacy tools it offers customers. Is Ramos honestly claiming that companies are somehow breaking the law by building secure systems? Because that's crazy. It goes directly against basically... everything.

From there, Ramos again pretends the case is about something entirely different:

Apple's concept of absolute privacy and immunity from government search is not supported by the Constitution of the United States or the cases that interpret it. Furthermore, Apple has no privacy rights in the device before the Court, nor is it legally permitted to assert any privacy rights regarding the search of the San Bernardino County-owned phone.

Right. And Apple is not asserting privacy rights here so what the hell is Ramos even arguing about here? He's making things up that aren't even remotely related to the case. Apple is not arguing about its privacy rights. It's arguing about whether or not the All Writs Act can be used to force it to build hacking tools that undermine the safety and security of its customers.

Ramos then goes on to totally misinterpret the finding in the famous Supreme Court Riley v. California decision about whether or not law enforcement could search mobile phones without a warrant. The ruling in that case, quite rightly and importantly, noted that you could not search a mobile phone without a warrant. But, Ramos pretends that means that the Supreme Court's decision means that all data on cellphones must be accessible under a warrant, which is not what the court said at all.

Hilariously, after raising issues that aren't before the court at all (Apple claiming a right to "privacy"), Ramos claims that Apple is the one raising issues not before the court -- and appears to do so by not understanding what the actual issue in this case is about:

Apple asserts that unlocking the seized iPhone will open the siege gates and make its users' personal information vulnerable to hackers, identity thieves, hostile foreign agents and unwarranted government surveillance. It has also expressed concerns about how foreign governments may treat their citizens and the demands that might be made on Apple. None of these issues are before the Court. This case does not involve speculation as to what foreign governments may demand of Apple, or how Apple may respond to those demands in the future. There is no issue of identity theft here, and Apple has not advanced an explanation of how unlocking this phone would lead to identity theft elsewhere, nor have they advanced any evidence of identity thefts caused by their unlocking phones prior to the deployment of IOS 8. Similarly, Apple warns of unwarranted government surveillance. No surveillance is present here. Apple has not advanced any evidence or explanation of how this surveillance will be unleashed by unlocking this phone. Apple cites the hacking of the Office of Personnel Management as illustrative of the dangers of hacking into databases, yet these databases were not contained on a specific iPhone as the evidence here is nor has there been an indication that the databases were hacked by an unlocked iPhone. These speculative concerns do not outweigh the compelling interest in the need to acquire real evidence of real crimes from the seized iPhone.

Here's the thing. This isn't that complicated. The law at issue in this case is the All Writs Act. The All Writs Act specifically notes that any "writs of assistance" must be "appropriate" and under the law it's been determined that to be "appropriate" it cannot be unduly "burdensome." The judge in the case has specifically requested that the parties focus on whether or not the order is unduly burdensome, and that's why Apple raised all of the issues above, directly answering the judge's questions which directly relate to the law at hand. To argue that these are "issues not before the court" suggests such a profound ignorance of the case here that one wonders what Ramos is doing here and how he got elected to be San Bernardino's DA.

And, really, for Ramos to whine that Apple's evidence of actual security concerns are somehow too "speculative" when he's the one spewing nonsense about speculative "dormant cyber pathogens" is just... insane.

Finally, Ramos concludes by saying that, look, he doesn't really give a shit how Apple breaks encryption, but it needs to be able to break encryption:

Apple's creation of their iOS 8 and iOS 9, the product of their brilliant engineering created all these issues where it did not exist in previous operating systems. There is nothing unreasonable in having this same brilliance applied to remediating the problem they created. How Apple chooses to accomplish this is a matter of their own choosing. Neither the FBI nor San Bernardino County District Attorney is asking to know how they do it, or directly possess the tools to do so. How Apple resolves the problem, or protects the solution is not our concern. We only seek for this Court to compel that Apple do so.

That's the DA version of "nerd harder, Apple." Of course, it (once again) totally misunderstands and misstates the issue. Also, while it is true that, in this case, there do appear to be technical ways (very, very dangerous ones) to force Apple to do what the FBI wants (which, we should note has very specific requests, which Ramos doesn't even seem aware of, despite being widely discussed), is Ramos honestly asserting that in cases where there isn't such a backdoor possible that companies still be required to break in, even when that's mathematically impossible?

The people of San Bernardino County deserve elected officials who actually understand the issues at hand. Not technically and legally ignorant buffoons who file such misleading tripe in such an important case.

Support our crowdfunding campaign to help us keep covering stories like these!

Filed Under: all writs act, amicus brief, cyber pathogen, doj, due process, encryption, fbi, michael ramos, privacy, san bernardino, san bernardino da
Companies: apple