FBI Allegedly Paid More Than $1 Million To Get Into Encrypted iPhone... And To Avoid Setting Legal Precedent It Didn't Like

from the just-saying dept

On Thursday, FBI Director James Comey suggested that the FBI paid over a million dollars to a group of hackers who helped it get into Syed Farook's encrypted work iPhone. Of course, just as pretty much everyone predicted, the FBI found nothing of value on the iPhone. This was hardly a surprise. It was a case where we already know who did it, and that they were already dead. We also know that they destroyed their two personal iPhones, leaving open the question why anyone would think there was anything valuable on the work iPhone.

Specifically, Comey said that buying the exploit from this group cost the FBI "more than I will make in the remainder of this job, which is seven years and four months, for sure." Comey makes $185,100 per year at his job, implying that buying the exploit cost at least $1.3 million or so.

This has, understandably caused some to ask how it could possibly be worth it to pay so much money for an exploit that everyone must have known was worthless.

It would have been more responsible to give the FBI’s slush fund over to the victims’ families than to pursue such an obvious non-lead.

— Jonathan Zdziarski (@JZdziarski) April 21, 2016

Things that would've better served the American public with $1.3M than Comey's goose chase: Mental health funding.

— Jonathan Zdziarski (@JZdziarski) April 21, 2016

Of course, that is taking a slightly narrow view on things, considering that many people believe, strongly, that the FBI's motive here was really to extricate itself from the legal dispute over the phone that had the very strong potential of ending with a bad precedent for the FBI and the DOJ. When looked at through that lens, $1.3 million or whatever seems like very little money to pay...

Filed Under: doj, fbi, hack, iphone, james comey, precedent, syed farook
Companies: apple

FBI Director James Comey Continues To Be The 'Fringe Candidate' Of The Encryption Debate

from the 'I'm-not-an-expert-but-I'm-unshakable-in-my-belief-that-I'm-righ dept

Ahead of a keynote address at Kenyon College, FBI director James Comey made himself available for an interview with Eric Geller of the Daily Dot, in which he assured readers that he is still making use of some very dusty talking points.

For the dozenth time, Comey once again asserted his belief that unicorns are not only real, but that smart people at tech companies can provide him with one.

“I think it’s a bit of a false premise to say that the only answer to the challenge we face is to introduce vulnerabilities into code,” Comey told the Daily Dot, before adding, “I’ll leave that to experts.”

This is Comey's backdoor: a backdoor for all intents and purposes, except that he refuses to call it a backdoor. It's a secret entrance, only known to law enforcement, intelligence agencies and any other government entity that might like access to encrypted devices. It's a bell that can't be unrung, but Comey thinks the FBI can ring it quietly enough, provided the smart tech people come up with a foolproof way to suppress the ringing noise.

Experts -- hundreds of them -- have already offered their opinion. What Comey wants is impossible without introducing abusable vulnerabilities. And while the FBI was seeking access to the infamous San Bernardino iPhone, dozens of experts offered their help, but the FBI wasn't interested. And yet, Comey soldiers on, secure in his delusion that the "experts" will fix his problem, on his terms, even after he and his agency have done all they can to alienate them. No one has made more out of their own ignorance than Comey, who seems to be willfully avoiding any actual discussions with experts -- experts who will very definitely disabuse him of his stupid, dangerous notions.

But that's not the dumbest statement made by Comey in this interview. He tops himself later while addressing the possible repercussions of forcing tech companies to glue horns on horses to sastify his unicorn requests.

Asked about the danger of pushing people to foreign platforms by limiting U.S. encryption, Comey seemed to suggest that the answer was to regulate encryption worldwide. “Every country that cares about the rule of law cares about this,” he said. “I think whatever we come up with—we as a people that care about these issues, in and out of government—it has to have some international component to it.”

Let me get this straight: the guy who couldn't even persuade Congress that it was a good idea to force one company to help unlock one phone believes he can talk the rest of the world into getting on board with his anti-encryption plans. If insanity is doing saying the same thing over and over and expecting different results responses, then his planned "we are the backdoored world" singalong is basically Comey assuring the general public that he is mentally unfit -- without having to urinate on himself or submit 244 pages of truther theories as Exhibit A to an unamused judge.

The audacity of that shrug ("no prob, we'll just get the rest of the world to bend to my will") is breathtaking. The best thing the FBI could do to protect its iPhone-cracking interests is chain Comey to a desk in a basement and go back to delivering a steady stream of "no comments" through DOJ lawyers.

Filed Under: encryption, fbi, going dark, james comey

FBI, DEA Taking Two Different Approaches To Pending All Writs Orders Directed At Apple

from the shame-that-'one-size-fits-all-writs'-thing-didn't-work-out... dept

Some of the other iPhones the FBI tried to pretend weren't going to be the beneficiaries of a precedential All Writs order are apparently not even the beneficiaries of the agency's Break Into an iPhone Using This One Simple Trick! anticlimax in the San Bernardino case.

Director James Comey noted there were still more windmills to tilt at after discovering the still-secret exploit only works on a smallish subset of Apple's offerings. In two other cases, the agency has explored its available options. In one case in Massachusetts, it appears to be on the verge of abandoning its quest to force Apple to break into a phone for it, as Motherboard reports.

The Massachusetts case is unique because it's the first of its kind involving a newer model iPhone—an iPhone 6 Plus running iOS 9.1—that likely can not be unlocked using the mysterious method the government wound up using on the older iPhone 5c of Syed Farook, one of the San Bernardino shooters. In addition to security features that automatically wipe the device after 10 passcode attempts, newer models including the iPhone 6 and up have a hardware-backed security feature called Secure Enclave, which makes breaking into the devices significantly harder.

Thus, the case appears to have entered legal limbo, both because the government has failed to respond to Apple’s refusal and because Apple has no way of accessing the phone’s data anyway.

The order set forth by the magistrate judge is unique in the fact that it compels Apple to turn over whatever data it recovers from the phone but does not demand the data be encrypted. Nor has Apple been ordered to assist in the decryption process. All of that ultimately doesn't matter if Apple can't access the data in the first place, hence the stalemate and apparent abandonment.

Meanwhile, slightly to the West, another legal battle over compelled decryption/access continues to be waged. The antagonist in this one is the DEA, however, which is seeking access to an older iPhone. The DOJ has already been served one rejection by magistrate judge James Orenstein. It has appealed that rejection, bumping it up a level in the district court. Now, it's filed a letter stating its intent to leave its All Writs application unaltered as the method the FBI used in the San Bernardino case won't work with this phone either.

The drug dealer had an iPhone 5C running iOS 7 software, while the San Bernardino shooter was using an iPhone 5C running iOS 9, a later version of Apple's operating system.

"The government continues to require Apple's assistance in accessing the data that it is authorized to search by warrant," wrote Capers.

Whatever the exploit is that works with this narrow band of phones, Apple has yet to learn the details. The FBI has shared it with the Senate Intelligence Committee, which means privacy champions like Dianne Feinstein possibly have more info on this security flaw than Apple does. Apple, however, has stated it will not seek to legally compel the FBI to turn over details on the exploit -- which is incredibly gentlemanly considering the FBI has done little else lately but seek to compel Apple to perform all sorts of work for it.

Security researcher Jonathan Zdziarski -- in an open letter to FBI director James Comey -- argues that the FBI should turn over the details to Apple anyway for the safety of its customers.

What has been made painfully apparent to me for nearly the past decade in this field is that keeping an exploit secret is not possible, no matter how good an agency or corporation may be at keeping secrets – because an exploit is merely a dotted line on a blueprint. Mere knowledge of the general parameters of a vulnerability – even just the details of the device’s condition in this case – has been enough for security researchers to know exactly what security boundaries to start looking at, and they can do so now with the confidence that there is a known, exploitable vulnerability. One does not need to steal any exploit code in order to take advantage of a vulnerability; they only need to find the vulnerability; the way in already exists until it is closed.

[...]

Given that it’s only a matter of time before a criminal finds the blueprint to this vulnerability, I urge you to consider briefing Apple of the tool and techniques used to access Syed Farook’s device. While the part of the tool that brute forces a PIN does not seem to work on newer devices, the locks that it picks in order to get past the front door most certainly can be vulnerabilities that carry over into newer devices. Depending on the nature of these components of the solution, criminals or nation states could take advantage of them to install malware, spyware, ransomware, or to infect a target by other means. Individual components of this tool may be very dangerous to millions of Americans, even if the solution as a whole is not viable.

Not that the FBI will be swayed by the words of highly-respected iPhone forensics expert. It tuned out security researchers during its quest for alternate unlocking methods and it likely could care less who else gets in as long as law enforcement agencies get in first.

Filed Under: doj, encryption, fbi, james comey
Companies: apple

Senator Wyden Lays Out New 'Compact For Privacy & Security In The Digital Age' In Response To Surveillance/Encryption Fights

from the something-to-get-behind dept

Yesterday, at the excellent RightsCon event in San Francisco, Senator Ron Wyden gave a barn burner of a speech, in which he detailed why it was so important to protect our privacy and security in a digital age, at a time when law enforcement and the intelligence communities are digging deeper and deeper into all of our personal information. He started out with a clear and emphatic statement on how he will block any attempt by Congress to undermine encryption:

I am here to tell you why I will use every power I have as a senator to block plans to weaken strong encryption. I am here to tell you why FBI Director Comey’s plans and expected legislation will be a lose-lose - they would lead to less security and less liberty

Furthermore, he made it clear that anyone who says that this just a debate between privacy and security has it totally wrong:

And let me be clear at the outset that the debate about data security is not about choosing security or choosing privacy. It is about choosing less security or choosing more security. People who think that the government should have more surveillance powers will often try to frame this debate as a choice between privacy and security. They are wrong. Our job is to convince the public that when politicians or the news media say that, we are here to tell you it’s not the case. It’s less security versus more security.

He further pointed out that, contrary to the claims of James Comey and others in law enforcement, this is the "golden age of surveillance" in that modern technologies have given law enforcement much more access to private information than they've ever had before. And he compared the freakout claims from law enforcement to similar claims 50 years ago, when the Supreme Court ruled in Miranda v. Arizona that law enforcement had to read people their rights -- and law enforcement and the media insisted this would lead to much more criminal activity:

I think that it is useful to compare this discussion to another one that was playing out fifty years ago. Fifty years ago this summer, the Supreme Court handed down a landmark decision in the case of Miranda vs. Arizona, in which the Court ruled that before law enforcement officers interrogate a suspect, they must advise that person of his or her constitutional rights. Everyone who’s ever watched a TV cop show knows this – you have the right to remain silent, you have the right to an attorney, and so forth. Today, this is a very important feature of the American justice system. It helps ensure that poor people know that they have the same rights under the law as rich people who can afford high-priced lawyers. And it helps reduce the likelihood of innocent people who are unsure about their rights being pressured to sign false confessions. The Miranda ruling helped bring our country closer to the promise of equal justice for all.

But if you had been following the public debate back in the summer of 1966, you would have heard a lot of politicians and prosecutors saying that the sky was falling. A few weeks after the decision, a New York Times headline read “Miranda Decision Said to End Effective Use of Confessions.” The article quoted some of the most respected prosecutors and law enforcement officials in the country warning that this decision was an absolute catastrophe. Future president Richard Nixon called the ruling a “Dickensian legalism” that would “hamstring” law enforcement, and he even suggested that the Constitution should be amended to overturn it.

Needless to say, the sky did not fall. In fact, crime rates have been dropping for the past twenty or thirty years. The national murder rate and burglary rate are both lower than they were the day that the Miranda ruling was handed down. Obviously there are a lot of factors that go into crime rates, but I think it’s clear that despite all of the dire warnings from both politicians and respected law enforcement officials, this ruling did not lead to the end of law enforcement in America. Fifty years later, the Miranda ruling remains a cornerstone of American due process.

From there, he announced what he's calling a new "Compact for Privacy and Security in the Digital Age" with four key prongs:

• Protecting strong encryption to safeguard Americans’ private data. Wyden’s Secure Data Act would ban the government from forcing companies to build backdoors or otherwise weaken the security of their products.
• Overhauling the Third Party Doctrine to make clear individuals do not lose their privacy rights just because they share some of their personal information with a particular company.
• Increasing transparency by holding at least three congressional hearings each year on the privacy impacts of surveillance laws, authorities and practices.
• Being on high alert for fresh attempts to undermine checks on government power. Right now the Justice Department is seeking a change to the rules for getting warrants to track computer hackers that would allow DOJ to use a single warrant to remotely access any computer that a suspected hacker is believed to have broken into. This rule change could potentially allow federal investigators to use a single warrant to access millions of computers, and it would treat the victims of the hack the same as the hacker himself.
• Finally, the government must do much more to hire people who understand technology and the implications of weakening digital security and privacy.

He spent some time in his speech blasting the concept of the third party doctrine and how ridiculous it is in practice:

Here’s the problem. A few decades ago, courts began ruling that if you provide information to a third party, like your bank or your phone company, you are no longer keeping it private, and it is no longer protected under the Fourth Amendment to the Constitution.

There is a huge, glaring problem with that logic. When you share your information with a single private company, that is not the same thing as making it public. Your phone company may have records of who you call, and your bank may have records of how you spend your money, but your contract with them will have rules for when and how they are allowed to share that information. They are not allowed to just disclose it freely.

This is true in the digital world as well. When I post a handsome new profile picture on Facebook, or send out a tweet to tell people that I’m holding a town hall in Oregon, I’ve chosen to make that information public. But when I send an email to my wife, or store a document in the cloud so I can work on it later, my service provider and I have an agreement that my information will stay private. The premise in current law is that I have agreed to make that information public just because my service provider is holding it. And that premise is simply absurd.

It's yet another great speech on an important topic from Senator Wyden -- and he includes a call to action to get people who support this vision to speak out on it. As it stands right now there are a few others in Congress who get how important all of this is, but many do not. And that needs to change. And while many people will be quite cynical about this and say that we'll never get others in Congess to recognize this issue, Senator Wyden reminded everyone that many people had the same view about SOPA/PIPA and the public eventually shifted Congress' position on that as well:

We can win this fight for security and liberty. It obviously won’t be easy, but we’ve done it before. Remember in the January of 2012, we were talking about the anti-Internet SOPA and PIPA bills. The first vote was on whether to override my hold on PIPA. Talk about long odds. The Chamber of Commerce, Hollywood, all the powerful special interests were against us. When that debate started, no one gave us a chance. Then the Internet community mobilized. Websites went dark in protest. And when the dust settled, well, everyone here knows how that ended. We won. Let’s work together and do it again.

While I do worry about the tendency of some to always roll out the "SOPA example" as proof, it is true that when enough people speak up, all the lobbyists and money in the world can be defeated. And this is a time when it would be nice to see that happen again.

Filed Under: compact for privacy & security, encryption, fbi, going dark, james comey, privacy, ron wyden, security, third party doctrine

iPhone Forensics Experts Demonstrate Basic Proof Of Concept That The iPhone Hack The FBI Says 'Doesn't Work' Actually Does Work

from the the-fbi-lied-again? dept

When the DOJ announced that the FBI may have miraculously found a way in to Syed Farook's work iPhone after swearing to a court that such a thing was impossible, many people zeroed in on the possibility of "NAND Mirroring" as the technique in question. After all, during a Congressional hearing, Rep. Darrell Issa had gone fairly deep technically (for a Congressperson, at least) in asking FBI Director James Comey if the FBI had tested such a method. Well-known iPhone forensics guru Jonathan Zdziarski wrote up a good blog post explaining why such a technique was the most likely. While recognizing that there are other possibilities, he does a good job breaking down why none of the other possibilities are all that likely, given a variety of facts related to the case (I won't go through all of that -- just go read his post). It's worth a read. It also has a nice quick explanation of NAND mirroring:

This is where the NAND chip is typically desoldered, dumped into a file (likely by a chip reader/programmer, which is like a cd burner for chips), and then copied so that if the device begins to wipe or delay after five or ten tries, they can just re-write the original image back to the chip. This technique is kind of like cheating at Super Mario Bros. with a save-game, allowing you to play the same level over and over after you keep dying. Only instead of playing a game, they’re trying different pin combinations.

However, on Friday, we noted that FBI Director James Comey was already denying this was the method, saying that it "doesn't work." The FBI also "classified" the method in question which raised some additional eyebrows. Either way, Zdziarski was pretty sure that Comey's claim that NAND mirroring doesn't work was bogus:

FBI Director Comey, in a press conference, claims the NAND technique “doesn’t work”; this says more about the credibility of this information than anything. Every expert I’ve consulted (including three hardware forensics firms) believe it works, and multiple firms are still in the process of validating the technique. The amount of time to prep and test this technique alone is proving greater than the month that we’ve been discussing it – it’s very unlikely that any reputable source could have already discredited this method, given how much time and effort it is taking everyone else to fully flesh out and test it. When asked directly if the FBI tried this technique, Comey dodged the question and replied (on the topic of “chip copying”), “I don’t want to say beyond that”, indicating the FBI hadn’t tried it. This speaks volumes about how flippantly the FBI is willing to discount viable methods endorsed by numerous researchers.

And now, Zdziarski has cooked up a fairly straightforward proof of concept to show that NAND mirroring absolutely could work: As Zdziarski explains:

This is a simple “concept” demonstration / simulation of a NAND mirroring attack on an iOS 9.0 device. I wanted to demonstrate how copying back disk content could allow for unlimited passcode attempts. Here, instead of using a chip programmer to copy certain contents of the NAND, I demonstrate it by copying the data using a jailbreak. For Farook’s phone, the FBI would remove the NAND chip, copy the contents into an image file, try passcodes, and then copy the original content back over onto the chip.

I did this here, only with a jailbreak: I made a copy of two property lists stored on the device, then copied them back and rebooted after five attempts. When doing this on a NAND level, actual blocks of encrypted disk content would be copied back and forth, whereas I’m working with files here. The concept is the same, and serves only to demonstrate that unlimited passcode attempts can be achieved by back-copying disk content. Again, NO JAILBREAK IS NEEDED to do this to Farook’s device, as the FBI would be physically removing the NAND to copy this data.

Elsewhere Zdziarski also points out that, despite the FBI insisting that it was reaching out to everyone who might be able to help, none of the top researchers in the space have been approached by the FBI (and apparently a few who reached out the other way were rebuffed). Once again, it looks like whatever the FBI is doing with the phone, it's not being particularly upfront with the public (or, potentially, the courts).

Filed Under: doj, fbi, forensics, iphone, james comey, jonathan zdziarski, nand mirroring
Companies: apple

FBI Denies It Lied About Ability To Crack iPhone, Also Suggests Cellebrite Rumor Is Wrong

from the but-who-do-you-believe dept

LAST DAY to support Techdirt's crowdfunding campaign!

As we pointed out earlier this week, it's pretty obvious that the Justice Department lied to a federal magistrate judge in saying that it had exhausted all possible opportunities to get into the work iPhone of Syed Farook, given that it has now put the case about it on hold to test out a "new way" to get into the phone. The DOJ had made a filing claiming that Apple's help was the only way to get into the phone, yet now is saying that's probably not true. However, the FBI is insisting that the DOJ wasn't lying. In a letter to the Editor at the Wall Street Journal, FBI Director James Comey reacts angrily to a similar opinion piece at the WSJ suggesting the DOJ lied:

You are simply wrong to assert that the FBI and the Justice Department lied about our ability to access the San Bernardino killer’s phone. I would have thought that you, as advocates of market forces, would realize the impact of the San Bernardino litigation. It stimulated creative people around the world to see what they might be able to do. And I’m not embarrassed to admit that all technical creativity does not reside in government. Lots of folks came to us with ideas. It looks like one of those ideas may work and that is a very good thing, because the San Bernardino case was not about trying to send a message or set a precedent; it was and is about fully investigating a terrorist attack.

James B. Comey

It's difficult to take much of that at face value -- especially as the government continues to push for similar court orders in other cases. And especially as Comey has been whining on and on about "going dark" for well over a year and a half now. At the very least, it does seem clear that the FBI failed to truly explore all possible options. As some iPhone forensics folks have noted, if this were truly a brand new solution, the FBI would need a hell of a lot more than two weeks of testing to make sure it really worked.

In the meantime, I'd heard from a few folks, and now others are reporting as well, that the assumptions that many had made about the Israeli company Cellebrite providing the solution are simply not true -- along with the idea that the solution involves reflashing the chip. The FBI itself now says it's a "software-based" solution.

FBI Director James Comey, in response to a reporter's question at a briefing, said making a copy of the iPhone’s chip in an effort to circumvent the password lockout “doesn’t work.” Comey wouldn't identify the company that's helping it or discuss details of the technique.

[....]

Law enforcement officials speaking on background debunked another report that had named Israeli forensics firm Cellebrite as the mystery firm helping it break into the phone.

Of course, this is after Cellebrite got a ton of free publicity from press reports claiming that it was the company (all of which was based on a few rumors from within the forensics world): At this point it's not clear that you can trust the FBI or DOJ on anything about these issues, as they've managed the messaging very, very carefully, and at times have made statements that are somewhere in that gray zone between "misleading" and "outright lies." But Comey's actions over the last year and a half make it quite clear that this is not just about this one iPhone and he very, very much wants a precedent that will effectively stop the possibility of encryption that the FBI can't easily circumvent.

LAST DAY to support Techdirt's crowdfunding campaign!

Filed Under: all writs act, doj, iphone, james comey, lies
Companies: cellibrite

White House Apparently Not Necessarily In Agreement With FBI's Position On Encryption Backdoors

from the say-something-dammit dept

There is a (reasonable) tendency to argue that in this big fight over encryption backdoors and "going dark" and "should Apple help the FBI" to assume that the various DOJ/FBI efforts to force backdoors into encryption are the official position of the Obama administration. After all, the Justice Department is a part of the administration and the head of the DOJ, Attorney General Loretta Lynch, reports to President Obama. And the FBI is a part of the DOJ. But it's also been quite clear for some time that there are a variety of opinions within the White House on these issues, with many outside of the DOJ not supporting backdooring encryption at all. In fact, many are actively opposed to such ideas. And now it's reaching the stage where people are starting to push stories that the White House is not at all happy with FBI Director James Comey and his crusade on this issue.

With regards to the Apple standoff, "It's just not clear [Comey] is speaking for the administration," said Richard Clarke, a former White House counterterrorism and cybersecurity chief. "We know there have been administration meetings on this for months. The proposal that Comey had made on encryption was rejected by the administration."

[....]

"I have been very surprised at how public and inflammatory, frankly, the FBI and the Justice Department’s approach has been on this," said Chris Finan, a former National Security Council cybersecurity adviser.

"That doesn't tend to be the administration’s preferred approach to handling things."

There are a lot more quotes in the article suggesting similar things (and also discussing FBI issues beyond just the Apple/encryption debate).

Indeed, back last fall, we noted that leaked documents showed that many in the White House did not agree with Comey or the FBI on this issue -- and some pushed for a public statement opposing backdooring encryption. Unfortunately, the administration later took the cowardly approach of agreeing not to push for legislation, but refusing to take a strong public stance on the issue, because they didn't want to anger the law enforcement community. So, instead, you have the DOJ and FBI -- representatives of the administration -- now running wild, pushing dangerous legal theories that will undermine key elements of computer security, and lots of people think that's the administration's official position.

The White House failed badly in not taking a public stance on this months ago, and it should fix that now.

Filed Under: backdoors, doj, encryption, fbi, james comey, loretta lynch, white house

Congress Seems Pretty Angry About The FBI's Belief That The Courts Can Force Apple To Help It Get Into iPhones

from the good-for-them dept

Congressional hearings involving law enforcement and intelligence folks tend to be fawning affairs, with most of Congress willing to accept whatever these guys have to say. Sure, you'll always have a few people critical of certain aspects, but generally speaking, Congress is especially friendly to the FBI, NSA, CIA, etc. So it must have come as a bit of a shock to FBI Director James Comey that during a long House Judiciary Committee hearing yesterday, they seemed pretty pissed off at Comey's belief that the courts should force Apple to help him open up encrypted iPhones.

One judiciary member questioned how the FBI managed to mess up so badly during the San Bernardino investigation and reset the shooter’s password, which is what kicked this whole controversy and court case in motion in the first place. And if the case was such an emergency, why did they wait 50 days to go to court? Another member questioned what happens when China inevitably asks for the same extraordinary powers the FBI is demanding now. Others questioned whether the FBI had really used all the resources available to break into the phone without Apple’s help. For example, why hasn’t the FBI attempted to get the NSA’s help to get into the phone, since hacking is their job?

[....]

More than anything, though, the members of Congress expressed anger that the FBI director didn’t follow through earlier on his stated intention to engage in a debate in Congress and the public about the proper role for encryption in society. Instead, he decided to circumvent that debate altogether and quietly go to court to get a judge to do what the legislative branch has so far refused to do.

In some cases, they directly called out Comey for appearing to use the San Bernardino tragedy for political purposes:

“I would be deeply disappointed if it turns out the government is found to be exploiting a national tragedy to pursue a change in the law,” Rep. John Conyers (D-MI) told Comey.

[....]

“But what concerns me, Mr. Chairman, is that in the middle of an ongoing Congressional debate on this subject, the Federal Bureau of Investigation would ask a federal magistrate to give them the special access to secure products that this committee, this Congress, and the administration have so far refused to provide,” he said. “Why has the government taken this step and forced this issue?”

He went on to speculate that the reason could be found in an email from “a senior lawyer in the intelligence community,” obtained and published in part by the Washington Post in September 2015. The email said that the “the legislative environment [with respect to mandating backdoors] is very hostile today,” but that “it could turn in the event of a terrorist attack or criminal event where strong encryption can be shown to have hindered law enforcement.”

“I’m deeply concerned by this cynical mindset,” said Conyers, implying that the Department of Justice and the FBI might be exploiting the San Bernardino attacks in order to mandate backdoors.

To be fair, contrary to what some articles are saying, this is not the first time Congress has been skeptical about the FBI's view on the encryption wars. A little less than a year ago, a hearing set up by a different committee, the House Oversight Committee included some similar points with Congressional reps being quite skeptical of the claims by law enforcement about the need for encryption backdoors. However, the drumbeat from Congress appears to be getting louder -- and that's a good thing.

Of course, some of the annoyance from Congress appears to just be about who gets to decide what happens here. That is, some of the anger seemed to be over the DOJ's decision to rush to the judicial branch, rather than let the legislative branch figure out what it wants to do. However, there's definitely a clear (and, amazingly, bipartisan) group of folks in Congress who recognize that the FBI's arguments about how it "needs" this information is a bunch of hogwash.

Filed Under: all writs act, congress, doj, encryption, house judiciary committee, james comey, john conyers, mobile phones
Companies: apple

The List Of 12 Other Cases Where The DOJ Has Demanded Apple Help It Hack Into iPhones

from the no-precedent? dept

In our last post we noted that while FBI Director James Comey insists that it wasn't trying to set a precedent, and this move was just about getting access to a single phone, law enforcement around the country was eagerly lining up behind the FBI to make similar requests. And... then last night it came out that even the DOJ is making similar requests in 12 other cases. And now, the full list of such cases has come out: Now, it's actually not entirely clear from this that all the cases really are the same. All of them do involve the DOJ using the All Writs Act to demand extra assistance from Apple -- and we already knew about some of those earlier cases. And in most of them, the specifics of the "ask" is not actually public yet.

That is, it's not known if they're all asking for the same level of forcing Apple to build a new operating system that reduces security and enables the FBI to hack through a weak passcode. It's safe to assume that's probably the case in at least some of them.

Still, given all of this, the details of all of these cases were kept sealed until now. And, it's been reported that Apple had asked for the San Bernardino case to be sealed as well, but the DOJ was the one who moved to make it public. And that lends tremendous weight to the idea that not only is the FBI desperately seeking to set a precedent, but it was waiting for a case with "good PR optics" to go public with, so that it could pull on some heart strings to get the public on its side. The high profile "terror" case in which a bunch of people were murdered in cold blood apparently was the perfect case.

But, yeah, once again, Director Comey was flat out lying when he claimed the FBI has no interest in setting a precedent.

Filed Under: all writs act, doj, encryption, fbi, going dark, iphones, james comey, precedent, privacy, security
Companies: apple

FBI Insists It's Not Trying To Set A Precedent, But Law Enforcement Is Drooling Over Exactly That Possibility

from the going-to-court-to-force-you-to-hack-your-customers dept

In Jim Comey's defensive blog post over the weekend, he insisted that the FBI was absolutely not doing this to set a precedent or to do anything other than get into a single phone:

The San Bernardino litigation isn't about trying to set a precedent or send any kind of message....

The particular legal issue is actually quite narrow. The relief we seek is limited and its value increasingly obsolete because the technology continues to evolve. We simply want the chance, with a search warrant, to try to guess the terrorist's passcode without the phone essentially self-destructing and without it taking a decade to guess correctly. That's it. We don't want to break anyone's encryption or set a master key loose on the land.

Yeah, except that's clearly bullshit. They absolutely want the precedent, and if the FBI's PR strategy is to now insist this precedent won't be useful beyond this case, perhaps it should have coordinated those talking points with others in law enforcement. Because if you talk to them, they're happy to tell everyone just how badly they want this precedent so they, too, can demand Apple build hacking tools into iPhones. Jenna McLaughlin at The Intercept has put together examples of law enforcement people practically drooling over the possibilities that will be opened up should the FBI win.

In Suffolk County, Massachusetts, district attorney’s office spokesperson Jake Wark said prosecutors “can’t rule out” bringing their own case of a locked cellphone before a judge, too. “It may be a question of finding the right case,” he told the Wall Street Journal.

“It’s going to have significant ramifications on us locally,” Matt Rokus, deputy chief of Wisconsin’s Eau Claire Police Department, told the city’s Leader-Telegram newspaper on Monday.

In South Dakota, Minnehaha County State’s Attorney Aaron McGowan told the Sioux Falls Argus Leader that “the court’s ruling could have a significant impact on conducting sensitive criminal investigations.”

And then of course, there's Cyrus Vance, the Manhattan DA who also has been quite vocal in asking for backdoors into encryption, who has admitted that he basically wants the same power the FBI is now trying to exert. And, meanwhile, Senator Richard Burr used the Apple case as a keying off point to try to push for legislation he's been working on for a while that would effectively mandate such backdoors.

So it's fairly difficult to believe the FBI and Director Comey when not only does everyone know he's lying, but his friends and colleagues in law enforcement can't even be bothered to play along with the script.

Update: Oh, and even the DOJ is off-script as well. It's now being reported that the DOJ is currently seeking similar orders on 12 more iPhones. So, yeah, Comey's flat out lying.

Filed Under: cyrus vance, doj, encryption, fbi, going dark, james comey, law enforcement, police, precedent
Companies: apple