Milwaukee PD Hid Stingray Usage From Judges, Defendants And Now Congress Members Want Answers From The FBI

from the the-huge-secret-that-isn't dept

More evidence of Stingray obfuscation has been uncovered in Milwaukee. What appeared at first to be a bog standard court order for tracking of a suspect using a cell phone provider's own "network equipment" actually appears to be something else. The ACLU was already involved in this case, arguing that such tracking by cell phone providers only be available with a warrant. But as it dug into the specifics, it became obvious the tracking had not been performed by the cell provider.

As we read through documentation from the case, however, we began to suspect that something else was going on. It appears that police secretly used a cell site simulator, also known as a Stingray, to track the phone, but successfully concealed that fact from the defense and the court.

Our suspicion was first raised because police initially did not disclose to the defendant that they had located him by tracking his phone, only revealing it at an evidentiary hearing. In reports prepared after the defendant’s arrest, police officers used oddly vague language to explain how they located him: one officer merely wrote that law enforcement had “obtained information” about the defendant’s location; another said that police “obtained information from an unknown source” about where he was. This sounded to us a lot like the kind of intentionally ambiguous language used by police across the country to hide their Stingray use.

Like every other law enforcement agency with a Stingray device in its possession, the Milwaukee PD had signed a nondisclosure agreement with the FBI. This "allowed" it to withhold the information from courts and defendants. But cracks in the NDA appeared and a prolific FOIA filer was able to pry loose documents detailing MPD's use of cell tower spoofers.

Last fall, privacy activist Mike Katz-Lacabe obtained a list of 579 investigations in which the Milwaukee Police Department used Stingrays. (Here are Mike’s public records request and MPD’s response letter). That previously unpublicized list includes an entry for a case that matches the date and description of this one: an October 28, 2013, apprehension of a “fugitive” “related to [an] FBI roundup.”

The ACLU is now arguing for suppression of the evidence obtained with the Stingray. That isn't local law enforcement's only problem, however. The ACLU's exposure of this secret Stingray use (along with the Milwaukee Journal-Sentinel's coverage) has attracted the attention of people in a better position to demand answers from the FBI: Reps. Jim Sensenbrenner and Sheila Jackson.

In a letter sent to James Comey (who kind of has a lot on his plate already, tbh), the Congress members demand to know why the FBI is actively hiding information about these tracking devices from the public.

The FBI’s stated reason for secrecy was that disclosing the existence of the capabilities may allow “the subject of investigation wherein this equipment/technology is used to employ countermeasures to avoid detection by law enforcement.” But certainly not lost on the FBI was the fact that secrecy shields the technology from debate and inevitable controversy. Courts could not review its constitutionality. The public could not debate the merits and costs of the technology and what limitations might be appropriate. While this type of secrecy may be appropriate in the national security context, it is entirely inappropriate in the context of law enforcement where citizens have the constitutional right to challenge the government’s evidence against them

We are not prejudging the outcome of the debate over the use of Stingray technology, but we categorically denounce the use of nondisclosure agreements that limit the ability of the public and of courts to debate the merits of the technology and to implement limits they may deem appropriate.

The letter acknowledges that the FBI has recently backed away from supporting its own NDAs. The FBI's last statement on the matter basically said the NDAs should not be read as saying exactly what they say: that information about Stingray usage should be hidden from everyone, if possible. It also expressed mild disbelief that the agreements were being taken so literally. The disingenuous and self-serving nature of this walkback is highlighted in the letter.

This, however, is at odds with the explicit language of the NDA which precludes disclosure to the public in any manner “including but not limited to: in press releases, in court documents, during judicial hearings, or during other public forums or proceedings.” The agreement, in fact, goes much further and states that the Milwaukee Police Department should seek FBI permission before responding to court ordered disclosures and should be prepared to dismiss cases at the FBI’s request if necessary to protect against disclosure.

The FBI has until March 25th to answer the following questions:

• Does the FBI consider state and local law enforcement to be bound by the NDAs related to the use of cell-site simulators?
• Has the FBI ever requested that a law enforcement agency dismiss a case to maintain the secrecy of law enforcement technology?
• How many NDAs has the FBI signed with state and local law enforcement agencies regarding cell-site simulators?
• Are there other technologies for which the FBI demands state and local law enforcement sign an NDA?
• Does the FBI continue to believe that NDAs are appropriate?
• Would the FBI ever condone perjury to Congress or judges to protect the existence of technology?

The answers should be illuminating -- if the public is actually allowed to see the responses. The FBI may still try to claim this super-secret technology that everyone knows about can't be discussed in an open forum. And I'm certain the agency will claim it would not condone perjury even though its NDAs strongly hint this would be preferable to exposing "sensitive" law enforcement methods.

Filed Under: congress, courts, evidence, fbi, imsi catcher, judges, milwaukee, police, stingray

DOJ To Court: Hey, Can We Postpone Tomorrow's Hearing? We Want To See If We Can Use This New Hole To Hack In

from the oh-really-now? dept

So, this morning we wrote about a new flaw found in the encryption in Apple's iMessage system -- though it was noted that this wouldn't really have impacted what the FBI was trying to do to get into Syed Farook's work iPhone. However, just a little while ago, the Justice Department asked the court to delay the big hearing planned for tomorrow afternoon, because of this newly disclosed vulnerability:

Since the attacks in San Bernardino on December 2, 2015, the Federal Bureau of Investigation (“FBI”) has continued to pursue all avenues available to discover all relevant evidence related to the attacks.

Specifically, since recovering Farook’s iPhone on December 3, 2015, the FBI has continued to research methods to gain access to the data stored on it. The FBI did not cease its efforts after this litigation began. As the FBI continued to conduct its own research, and as a result of the worldwide publicity and attention on this case, others outside the U.S. government have continued to contact the U.S. government offering avenues of possible research.

On Sunday, March 20, 2016, an outside party demonstrated to the FBI a possible method for unlocking Farook’s iPhone. Testing is required to determine whether it is a viable method that will not compromise data on Farook’s iPhone. If the method is viable, it should eliminate the need for the assistance from Apple Inc. (“Apple”) set forth in the All Writs Act Order in this case.

Accordingly, to provide time for testing the method, the government hereby requests that the hearing set for March 22, 2016 be vacated. The government proposes filing a status report with the Court by April 5, 2016.

This could mean a variety of different things... including that the DOJ is looking for a way "out" of this case without setting the precedent it doesn't want, after discovering that the case and public opinion didn't seem to be going the way the DOJ had hoped it was going to go when it first brought it last month. Either way, there's never a dull moment in this case...

Update: And the judge has accepted the request, meaning the hearing is off. The DOJ put out a statement trying to spin this as being about how they're just really interested in getting into this one phone and not about setting a precedent:

Our top priority has always been gaining access into the phone used by the terrorist in San Bernardino. With this goal in mind, the FBI has continued in its efforts to gain access to the phone without Apple's assistance, even during a month-long period of litigation with the company. As a result of these efforts, an outside party demonstrated to the FBI this past weekend a possible method for unlocking the phone. We must first test this method to ensure that it doesn't destroy the data on the phone, but we remain cautiously optimistic. That is why we asked the court to give us some time to explore this option. If this solution works, it will allow us to search the phone and continue our investigation into the terrorist attack that killed 14 people and wounded 22 people.

Of course, that statement is more misleading bullshit from the DOJ. It's pretty clear that the DOJ is just trying to get out of this case as it's realized that the original plan completely backfired, and they were likely to lose.

Update 2: Okay, the court has officially posted its decision to grant the DOJ's request. You can see it below as well.

Filed Under: all writs act, court, doj, encryption, fbi, going dark, hacking, syed farook, vulnerability
Companies: apple

Flaw Discovered In Apple iMessage Encryption, Reminding Us That Compelled Backdoors Are Idiotic

from the encryption-is-hard dept

One of the points that seems to be widely misunderstood by people who don't spend much time in computer security worlds, is that building secure encryption systems is really hard and almost everything has some sort of vulnerability somewhere. This is why it's a constant struggle by security researchers, cryptographers and security engineers to continually poke holes in encryption, and try to fix up and patch systems. It's also why the demand for backdoors is idiotic, because they probably already exist in some format. But purposely building in certain kinds of backdoors that can't be closed by law almost certainly blasts open much larger holes for those with nefarious intent to get in.

Case in point: over the weekend, computer science professor Matthew Green and some other researchers announced that they'd discovered a serious hole in the encryption used for Apple's iMessage platform, allowing a sophisticated hacker to access encrypted messages and pictures. And, Green, who has been vocal about the ridiculousness of the DOJ's request against Apple, notes how this is yet more evidence that the DOJ's request is a bad idea:

“Even Apple, with all their skills — and they have terrific cryptographers — wasn’t able to quite get this right,” said Green, whose team of graduate students will publish a paper describing the attack as soon as Apple issues a patch. “So it scares me that we’re having this conversation about adding back doors to encryption when we can’t even get basic encryption right.”

It's worth noting that the flaw that he and his team found would not have helped the FBI get what it wants off of Syed Farook's iPhone, but it's still a reminder of just how complex cryptography currently is, at a time when people are trying to keep everyone out. Offer up any potential backdoor, and you're almost certainly blasting major holes throughout the facade.

Apple is getting ready to push out a software update that will fix the flaw shortly. And this, alone, is yet another reason why the DOJ's case is so dangerous -- since the method it wants to use to get into Farook's phone is via its capabilities to push software updates. Patching software holes is a major reason to accept regular software updates, but the FBI is now trying to co-opt that process to install unsafe code. That, in turn, may prompt people to avoid software updates altogether, which in most cases will make them less safe.

Filed Under: complexity, cryptography, doj, encryption, fbi, imessage, matthew green, privacy
Companies: apple

US Government Has Apparently Demanded, And Obtained, Tech Companies' Source Code In The Past

from the ask-(FISC_)-and-ye-shall-receive dept

From Zack Whittaker at ZDNet comes the alarming revelation that it's not just Apple looking at possibly having to turn over its source code and/or encryption keys to the government, much like what happened to Lavabit. Many other companies have done this previously as the result of orders granted by the nation's most opaque, non-adversarial court.

The US government has made numerous attempts to obtain source code from tech companies in an effort to find security flaws that could be used for surveillance or investigations.

The government has demanded source code in civil cases filed under seal but also by seeking clandestine rulings authorized under the secretive Foreign Intelligence Surveillance Act (FISA), a person with direct knowledge of these demands told ZDNet. We're not naming the person as they relayed information that is likely classified.

With these hearings held in secret and away from the public gaze, the person said that the tech companies hit by these demands are losing "most of the time."

That's hardly heartening. The DOJ would only go so far as to confirm this has happened before, likely because there's no way to deny it. The documents from the Lavabit case have been made public -- with the DOJ using a formerly-sealed document to hint at what could be in store for Apple if it refuses to write FBiOS for it.

Unfortunately, because of the secrecy surrounding the government's requests for source code -- and the court where those requests have been made -- it's extremely difficult to obtain outside confirmation. Whittaker contacted more than a dozen Fortune 500 companies about the unnamed official's claims and received zero comments.

A few, however, flatly denied ever having handed over source code to the US government.

Cisco said in an emailed statement: "We have not and we will not hand over source code to any customers, especially governments."

IBM referred to a 2014 statement saying that the company does not provide "software source code or encryption keys to the NSA or any other government agency for the purpose of accessing client data." A spokesperson confirmed that the statement is still valid, but did not comment further on whether source code had been handed over to a government agency for any other reason.

Cisco is likely still stinging from leaked documents showing its unwitting participation in an NSA unboxing photo shoot and has undoubtedly decided to take a stronger stance against government meddling since that point. As for IBM, its statement is a couple of years old and contains a major qualifying statement.

Previously-leaked documents somewhat confirm the existence of court orders allowing the NSA to perform its own hardware/software surgery. Presumably, the introduction of backdoors and exploits is made much easier with access to source code. Whittaker points to a Kaspersky Lab's apparent discovery of evidence pointing to the NSA being in possession of "several hard drive manufacturers'" source code -- another indication that the government's history of demanding source code from manufacturers and software creators didn't begin (or end) with Lavabit.

The government may be able to talk the FISA court into granting these requests, given that its purview generally only covers foreign surveillance (except for all the domestic dragnets and "inadvertent" collections) and national security issues. The FBI's open air battle with Apple has already proceeded far past the point that any quasi-hearing in front of the FISC would have. That's the sort of thing an actually adversarial system -- unlike the mostly-closed loop of the FISA court -- tends to result in: a give-and-take played out (mostly) in public, rather than one party saying "we need this" and the other applying ink to the stamp.

Filed Under: doj, fbi, fisa, fisa court, fisc, privacy, security, signing keys, software, source code, tech companies

Former Presidential Cybersecurity 'Czar' Slams DOJ/FBI For Its Position On Apple Encryption

from the speak-louder dept

For many years, if you mentioned the term "cybersecurity czar" in the federal government, it only meant Richard Clarke. He was one of the earliest people to focus on computer security as an issue, and as such, became an advisor to multiple presidents on the issue. I haven't always agreed with him -- there have been points in the past where he's appeared as a leading voice in support of greater surveillance and exaggerated claims about a coming "cyberwar". However, in the past few years, Clarke has become much better on these issues, warning (just prior to Snowden's revelations) that the US's focus on surveillance has actually made the public less safe by leaving vulnerabilities open, rather than closing them.

And now he's weighed in, quite vocally, on the whole Apple v. the FBI thing, strongly in support of Apple. To some extent, this isn't a huge surprise as he was among a large group of smart folks who signed onto a letter a year ago opposing encryption backdoors, but his NPR interview gave him a chance to be quite explicit in just how dumb the FBI/DOJ's requests are. It's worth listening to the whole thing, or at least reading the transcript, but here are a few key highlights. Specifically, he argues that the FBI is lying in saying that it can't get access to the content on the phone, and just wants to set a precedent:

If I were in the job now, I would have simply told the FBI to call Fort Meade, the headquarters of the National Security Agency, and NSA would have solved this problem for them. They're not as interested in solving the problem as they are in getting a legal precedent.... Every expert I know believes that NSA could crack this phone. They want the precedent that the government can compel a computer device manufacturer to allow the government in.

Earlier in the interview, he totally dismisses the idea that there's a big dispute in the administration about this, saying that it's just the FBI and DOJ exaggerating:

Well, I don't think it's a fierce debate. I think the Justice Department and the FBI are on their own here. You know, the secretary of defense has said how important encryption is when asked about this case. The National Security Agency director and three past National Security Agency directors, a former CIA director, a former Homeland Security secretary have all said that they're much more sympathetic with Apple in this case. You really have to understand that the FBI director is exaggerating the need for this and is trying to build it up as an emotional case, organizing the families of the victims and all of that. And it's Jim Comey and the attorney general is letting him get away with it.

It's good to see more officials speaking out and calling bullshit on the FBI/DOJ claims on all of this.

Filed Under: all writs act, cybersecurity, doj, encryption, fbi, iphone, nsa, precedent, richard clarke
Companies: apple

How Apple Could Lose By Winning: The DOJ's Next Move Could Be Worse

from the we-can-do-this-the-easy-way-or-the-hard-way dept

Since the conflict over smartphone security, long simmering between Apple and the FBI, burst into the headlines last month, many of us who advocate for strong encryption have watched the competing legal arguments advanced by the parties with a certain queasiness. Many of the arguments on Apple's side—whether offered by the company itself or the myriad groups who have weighed in with friend-of-the-court briefs—have turned critically on the government's unprecedented invocation of the hoary All Writs Act to compel the company to write and authenticate a novel piece of software effectively dragooning Apple engineers into government service.

But there has always been an obvious alternative—a way to achieve the FBI's aim of circumventing iPhone security features without requiring any Apple employees to write a line of new code: the Lavabit Option.

That is, instead of asking Apple to create a hacking tool that would permit the FBI to attempt to brute-force a phone's passcode without triggering escalating delays between guesses or deletion of encrypted data, they could simply demand that Apple turn over the source code and documentation the FBI would need to develop its own custom version of the iOS boot ROM, sans security features. Then, they require Apple to either cryptographically sign that code or provide the government with access to its developer credentials, so that the FBiOS can run on an iPhone.

That hypothetical possibility is raised explicitly by the Justice Department in a footnote to its most recent motion in its ongoing litigation with Apple, which explains that the FBI had not gone that route because it "believed such a request would be less palatable to Apple." Having tried it the easy way, the FBI suggests it's happy to do things the hard way: "If Apple would prefer that course, however, that may provide an alternative that requires less labor by Apple programmers." The government follows up with a citation to the Fourth Circuit's ruling in the now-infamous Lavabit case. Because the secure e-mail service Lavabit maintained minimal logs of user metadata, the government had obtained an order to install a "pen register"—a mechanism for recording metadata in realtime—on the company's systems in order to monitor a particular user, widely believed to be Edward Snowden. In order to make that data intelligible, however, it also demanded the use of the SSL keys used to encrypt all users' traffic. When the Fourth Circuit upheld that demand, CEO Ladar Levinson chose to shutter the site entirely.

Apple's latest reply brief clearly registered the company's dismayed response to this legal shot across the bow:

The catastrophic security implications of that threat only highlight the government's misunderstanding or reckless disregard of the technology at issue and the security risks implicated by its suggestion.

Such a move would signal a race to the bottom of the slippery slope that has haunted privacy advocates: A world where companies can be forced to sign code developed by the government to facilitate surveillance. In this case, that means software to brute force a passcode, but could as easily apply to remote exploits targeting any networked device that relies on developer credentials to authenticate trusted updates. Which is to say, nearly any modern networked device. It entails, quite literally, handing the government the keys to the kingdom.

What's particularly worrying is that, while this approach is massively more troubling from a security perspective than funneling such requests through the company itself on a case-by-case basis, it would likely stand on a less shaky legal foundation.

Apple's arguments throughout this case have stressed the unprecedented nature of the FBI's attempt to conscript the firm's engineers, noting that the All-Writs Act invoked by the government was meant to enable only the particular types of orders familiar from common law, not grant an all-purpose power to "order private parties to do virtually anything the Justice Department and FBI can dream up." The trouble is, an order to turn over information in the "possession custody or control" of a private party is just such a traditional order. Such demands are routinely made, for instance, via a subpoena duces tecum requiring a person or company to produce documents.

It's likely that Apple's developer keys are stored in a Hardware Security Module that would make it difficult or impossible to produce a copy of their firmware signing key directly to the government. But that might not be much legal help. In a separate iPhone unlocking case in New York, magistrate judge James Ornstein recently rejected the government's argument that a previous All-Writs Act case, New York Telephone Co., required Apple's compliance. In that case, Ornstein noted, the government's

agents would normally have been able to install the authorized pen register without the company's assistance but for the fact that the subject telephone's wires were so placed as to prevent the agents from gaining surreptitious access. The agents thus needed the telephone company not to provide technical expertise they lacked, but only to step out of the way and let them perform their authorized surveillance on company property.

But that sounds much closer to what would be involved in a case where Apple is required to authenticate government-written code: Just "step out of the way" and let the FBI access the HSM containing the keys used to sign updates.

Similarly, many of the First Amendment arguments raised by Apple and the Electronic Frontier Foundation—to the effect that "code is speech" and the requirement that Apple create new software amounts to "compelled speech"—would also fall by the wayside. They might still advance such arguments with respect to the "endorsement" implicit in using company credentials to sign software, but a court may not find that as intuitive as the idea that "compelled speech" is involved in requiring engineers to devise wholly novel and potentially complicated software.

Many of Apple's other arguments, of course, would remain untouched: There's the idea that Congress has established a comprehensive statutory framework specifying the means of law enforcement access to digital content via laws like the Communications Assistance for Law Enforcement Act and the Electronic Communications Privacy Act, making the All-Writs Act an inappropriate mechanism to seek authority withheld by Congress. Nor would a "sign our code" approach affect any of Apple's claims about the broader security harms inherent in the creation of developer-authenticated tools to break security. But the long list of legal barriers to the FBI getting its way would surely be significantly reduced.

That means it's not just important that Apple win in this case—it matters how it wins. If the company emerges victorious on grounds fundamentally tied to the mandate to create software rather than the demand to authenticate it, it could prove a pyrrhic victory indeed, opening the door for the government to insist on doing things the "hard way," and inaugurating an era of government scripted malware signed to look like genuine updates.

Filed Under: all writs act, doj, encryption, fbi, going dark, key
Companies: apple, lavabit

Apple's VP Of Software Engineering: No, We Have Never Given A Backdoor To Any Government

from the shut-up-DOJ dept

One of the more ridiculous claims in the DOJ's filing against Apple last week, was its decision to pick up on former NSA lawyer Stewart Baker's conspiracy theory that Apple had built backdoors into its products for China (side note: I met Stewart in person for the first time recently, and he mocked me about this, saying that I should agree with him on this point). However, as we noted in our post last week, there doesn't seem to be much evidence to support Baker's claims. The two key issues were using the Chinese wireless standard WAPI -- which some have claimed includes some sort of backdoor, but it was also the only real local area wireless tech in China for a while -- and the decision to store iCloud data in China. However, as we noted, there have been reports that the Chinese government tried to then conduct a man in the middle attack against the iCloud servers. If Apple had actually given the government a backdoor, then why would it need to do that?

Either way, in a declaration attached to Apple's response, Apple had Craig Federighi, its senior VP of software engineering, tell the court directly that it has never installed a backdoor for any government ever:

Apple uses the same security protocols everywhere in the world.

Apple has never made user data, whether stored on the iPhone or in iCloud, more technologically accessible to any country's government. We believe any such access is too dangerous to allow. Apple has also not provided any government with its proprietary iOS source code. While governmental agencies in various countries, including the United States, perform regulatory reviews of new iPhone releases, all that Apple provides in those circumstances is an unmodified iPhone device.

It is my understanding that Apple has never worked with any government agency from any country to create a "backdoor" in any of our products or services.

Now, some may push back on the point about WAPI, but again, making use of a third party technology that potentially has backdoors (some of which could be protected against) and being told by the government to build special backdoors just for that government are still vastly different scenarios.

Filed Under: all writs act, backdoors, china, craig federighi, doj, encryption, fbi, going dark, icloud, wapi
Companies: apple

Apple Tells Court That The DOJ Is Lying About It Advertising The Fact That Encryption Keeps Out Law Enforcement

from the not-how-it-works dept

We already covered Apple's reply brief in the fight over getting into Syed Farook's encrypted work iPhone, highlighting a number of lies by the DOJ's filing. But I wanted to focus on a few more highlighted in the additional declarations filed by Apple as well. The DOJ kept insisting that Apple built this feature specifically to keep law enforcement out, which is ridiculous. Apple notes repeatedly that it built the feature to keep its customers safer from malicious attacks, most of which are not from law enforcement. But the DOJ keeps pretending that it was a deliberate attempt to mock law enforcement. In the DOJ's filing:

Here, Apple has deliberately used its control over its software to block law-enforcement requests for access to the contents of its devices, and it has advertised that feature to sell its products.

As part of its reply, however, Apple has a company advertising director, Robert Ferrini, note that the company has never promoted keeping law enforcement out as a feature in its ads:

Since the introduction of iOS 8 in October 2014, Apple has placed approximately 1,793 advertisements worldwide—627 in the United States alone—of different types, including, print ads, television ads, online ads, cinema ads, radio ads and billboards. Those advertisements have generated an estimated 253 billion impressions worldwide and 99 billion impressions in the United States alone (an impression is an estimate of the number of times an ad is viewed or displayed online).

Of those advertisements, not a single one has ever advertised or promoted the ability of Apple’s software to block law enforcement requests for access to the contents of Apple devices.

Indeed, only three of those advertisements reference security at all, and all three related to the Apple Pay service, and then only to say that Apple Pay is "safer than a credit card, and keeps your info yours."

I'm assuming the DOJ, if it decides to push this point, will argue that it wasn't talking about those kinds of advertisements, but Apple's statements to the press, but still, there's a strong point here. Contrary to what the DOJ is saying, no, the company does not proactively advertise the encryption as a way to keep law enforcement out. Or, in short, no, FBI, strong encryption on the iPhone just isn't about you.

Filed Under: advertising, all writs act, doj, encryption, fbi, going dark, law enforcement, robert ferrini
Companies: apple

Apple's Response To DOJ: Your Filing Is Full Of Blatantly Misleading Claims And Outright Falsehoods

from the no-love-lost dept

As expected, Apple has now responded to the DOJ in the case about whether or not it can be forced to write code to break its own security features to help the FBI access the encrypted work iPhone of Syed Farook, one of the San Bernardino attackers. As we noted, the DOJ's filing was chock-full of blatantly misleading claims, and Apple was flabbergasted by just how ridiculous that filing was. That comes through in this response.

The government attempts to rewrite history by portraying the Act as an all-powerful magic wand rather than the limited procedural tool it is. As theorized by the government, the Act can authorize any and all relief except in two situations: (1) where Congress enacts a specific statute prohibiting the precise action (i.e., says a court may not “order a smartphone manufacturer to remove barriers to accessing stored data on a particular smartphone,” ... or (2) where the government seeks to “arbitrarily dragoon[]” or “forcibly deputize[]” “random citizens” off the street.... Thus, according to the government, short of kidnapping or breaking an express law, the courts can order private parties to do virtually anything the Justice Department and FBI can dream up. The Founders would be appalled.

The Founders would be appalled. That's quite a statement.

Apple also slams the DOJ for insisting that this really is all about the one iPhone and that the court should ignore the wider precedent, citing FBI Director James Comey's own statements:

It has become crystal clear that this case is not about a “modest” order and a “single iPhone,” Opp. 1, as the FBI Director himself admitted when testifying before Congress two weeks ago. Ex. EE at 35 [FBI Director James Comey, Encryption Hr’g] (“[T]he broader question we’re talking about here goes far beyond phones or far beyond any case. This collision between public safety and privacy—the courts cannot resolve that.”). Instead, this case hinges on a contentious policy issue about how society should weigh what law enforcement officials want against the widespread repercussions and serious risks their demands would create. “Democracies resolve such tensions through robust debate” among the people and their elected representatives, Dkt. 16-8 [Comey, Going Dark], not through an unprecedented All Writs Act proceeding.

Apple then, repeatedly, points out where the DOJ selectively quoted, misquoted or misleadingly quoted arguments in its favor. For example:

The government misquotes Bank of the United States v. Halstead,..., for the proposition that “‘[t]he operation of [the Act]’” should not be limited “‘to that which it would have had in the year 1789.’” ... (misquoting Halstead, 23 U.S. (10 Wheat.) at 62) (alterations are the government’s). But what the Court actually said was that the “operation of an execution”—the ancient common law writ of “venditioni exponas”—is not limited to that “which it would have had in the year 1789.” ... see also... (“That executions are among the writs hereby authorized to be issued, cannot admit of a doubt . . . .”). The narrow holding of Halstead was that the Act (and the Process Act of 1792) allowed courts “to alter the form of the process of execution.” ... (courts are not limited to the form of the writ of execution “in use in the Supreme Courts of the several States in the year 1789”). The limited “power given to the Courts over their process is no more than authorizing them to regulate and direct the conduct of the Marshal, in the execution of the process.”

The authority to alter the process by which courts issue traditional common law writs is not authority to invent entirely new writs with no common law analog. But that is precisely what the government is asking this Court to do: The Order requiring Apple to create software so that the FBI can hack into the iPhone has no common law analog.

The filing then goes step by step in pointing out how the government is wrong about almost everything. The DOJ, for example, kept insisting that CALEA doesn't apply at all to Apple, but Apple points out that the DOJ just seems to be totally misreading the law:

Contrary to the government’s assertion that its request merely “brush[es] up against similar issues” to CALEA..., CALEA, in fact, has three critical limitations—two of which the government ignores entirely—that preclude the relief the government seeks.... First, CALEA prohibits law enforcement agencies from requiring “electronic communication service” providers to adopt “any specific design of equipment, facilities, services, features, or system configurations . . . .” The term “electronic communication service” provider is broadly defined to encompass Apple. ... (“any service which provides to users thereof the ability to send or receive wire or electronic communications”). Apple is an “electronic communication services” provider for purposes of the very services at issue here because Apple’s software allows users to “send or receive . . . communications” between iPhones through features such as iMessage and Mail....

The government acknowledges that FaceTime and iMessage are electronic communication services, but asserts that this fact is irrelevant because “the Court’s order does not bear at all upon the operation of those programs.” ... Not so. The passcode Apple is being asked to circumvent is a feature of the same Apple iOS that runs FaceTime, iMessage, and Mail, because an integral part of providing those services is enabling the phone’s owner to password-protect the private information contained within those communications. More importantly, the very communications to which law enforcement seeks access are the iMessage communications stored on the phone.... And, only a few pages after asserting that “the Court’s order does not bear at all upon the operation of” FaceTime and iMessage for purposes of the CALEA analysis..., the government spends several pages seeking to justify the Court’s order based on those very same programs, arguing that they render Apple “intimately close” to the crime for purposes of the New York Telephone analysis.

Second, the government does not dispute, or even discuss, that CALEA excludes “information services” providers from the scope of its mandatory assistance provisions.... Apple is indisputably an information services provider given the features of iOS, including Facetime, iMessage, and Mail....

Finally, CALEA makes clear that even telecommunications carriers (a category of providers subject to more intrusive requirements under CALEA, but which Apple is not) cannot be required to “ensure the government’s ability” to decrypt or to create decryption programs the company does not already “possess.”... If companies subject to CALEA’s obligations cannot be required to bear this burden, Congress surely did not intend to allow parties specifically exempted by CALEA (such as Apple) to be subjected to it. The government fails to address this truism.

Next, Apple rebuts the DOJ saying that since CALEA doesn't address this specific situation, that means Congress is just leaving it up to the courts to use the All Writs Act. As Apple points out, in some cases, Congress not doing something doesn't mean it rejected certain positions, but in this case, the legislative history is quite clear that Congress did not intend for companies to be forced to help in this manner.

Here, Congress chose to require limited third-party assistance in certain statutes designed to aid law enforcement in gathering electronic evidence (although none as expansive as what the government seeks here), but it has declined to include similar provisions in other statutes, despite vigorous lobbying by law enforcement and notwithstanding its “prolonged and acute awareness of so important an issue” as the one presented here.... Accordingly, the lack of statutory authorization in CALEA or any of the complementary statutes in the “comprehensive federal scheme” of surveillance and telecommunications law speaks volumes.... To that end, Congress chose to “greatly narrow[]” the “scope of [CALEA],” which ran contrary to the FBI’s interests but was “important from a privacy standpoint.” ... Indeed, CALEA’s provisions were drafted to “limit[] the scope of [industry’s] assistance requirements in several important ways.”....

That the Executive Branch recently abandoned plans to seek legislation expanding CALEA’s reach... provides renewed confirmation that Congress has not acceded to the FBI’s wishes, and belies the government’s view that it has possessed such authority under the All Writs Act since 1789.

In fact, in a footnote, Apple goes even further in not just blasting the DOJ's suggestion that Congress didn't really consider a legislative proposal to update CALEA to suck in requirements for internet communications companies, but also highlighting the infamous quote from top intelligence community lawyer Robert Litt about how they'd just wait for the next terrorist attack and get the law passed in their favor at that point.

The government’s attempts to minimize CALEA II, saying its plans consisted of “mere[] vague discussions” that never developed into a formal legislative submission ..., but federal officials familiar with that failed lobbying effort confirmed that the FBI had in fact developed a “draft proposal” containing a web of detailed provisions, including specific fines and compliance timelines, and had floated that proposal with the White House..... As The Washington Post reported, advocates of the proposal within the government dropped the effort, because they determined they could not get what they wanted from Congress at that time: “Although ‘the legislative environment is very hostile today,’ the intelligence community’s top lawyer, Robert S. Litt, said to colleagues in an August [2015] e-mail, which was obtained by The Post, ‘it could turn in the event of a terrorist attack or criminal event where strong encryption can be shown to have hindered law enforcement.’ There is value, he said, in ‘keeping our options open for such a situation.’”

Next Apple goes through the arguments for saying that, even if the All Writs Act does apply, and even if the court accepts the DOJ's made up three factor test, Apple should still prevail. It notes, again, that it is "far removed" from the issue and reminds the court that the order sought here is very different from past cases where Apple has cooperated:

The government argues that “courts have already issued AWA orders” requiring manufacturers to “unlock” phones ... but those cases involved orders requiring “unlocking” assistance to provide access through existing means, not the extraordinary remedy sought here, i.e., an order that requires creating new software to undermine the phones’ (or in the Blake case, the iPad’s) security safeguards.

It also mocks that weird argument from the DOJ that said because Apple "licenses" rather than "sells" its software, that means Apple is more closely tied to the case:

The government discusses Apple’s software licensing and data policies at length, equating Apple to a feudal lord demanding fealty from its customers (“suzerainty”). ... But the government does not cite any authority, and none exists, suggesting that the design features and software that exist on every iPhone somehow link Apple to the subject phone and the crime. Likewise, the government has cited no case holding that a license to use a product constituted a sufficient connection under New York Telephone. Indeed, under the government’s theory, any ongoing postpurchase connection between a manufacturer or service provider and a consumer suffices to connect the two in perpetuity—even where, as here, the data on the iPhone is inaccessible to Apple.

From there, Apple dives in on the question of how much of a "burden" this would be. This is the issue that Judge Pym has indicated she's most interested in, and Apple goes deep here -- again and again focusing on how the DOJ was blatantly misleading in its motion:

Forcing Apple to create new software that degrades its security features is unprecedented and unlike any burden ever imposed under the All Writs Act. The government’s assertion that the phone companies in Mountain Bell and In re Application of the U.S. for an Order Authorizing the Installation of a Pen Register or Touch-Tone Decoder and a Terminating Trap ..., were conscripted to “write” code, akin to the request here... mischaracterizes the actual assistance required in those cases. The government seizes on the word “programmed” in those cases and superficially equates it to the process of creating new software..... But the “programming” in those cases—back in 1979 and 1980—consisted of a “technician” using a “teletypewriter” in Mountain Bell ..., and “t[ook] less than one minute” in Penn Bell... Indeed, in Mountain Bell, the government itself stated that the only burden imposed “was a large number of print-outs on the teletype machine”—not creating new code..... More importantly, the phone companies already had and themselves used the tracing capabilities the government wanted to access.... And although relying heavily on Mountain Bell, the government neglects to point out the court’s explicit warning that “[t]his holding is a narrow one, and our decision today should not be read to authorize the wholesale imposition upon private, third parties of duties pursuant to search warrants.” ...This case stands light years from Mountain Bell. The government seeks to commandeer Apple to design, create, test, and validate a new operating system that does not exist, and that Apple believes—with overwhelming support from the technology community and security experts—is too dangerous to create.

Seeking to belittle this widely accepted policy position, the government grossly mischaracterizes Apple’s objection to the requested Order as a concern that “compliance will tarnish its brand”..., a mischaracterization that both the FBI Director and the courts have flatly rejected. [See Comey] (“I don’t question [Apple’s] motive”);... (disagreeing “with the government’s contention that Apple’s objection [to being compelled to decrypt an iPhone] is not ‘conscientious’ but merely a matter of ‘its concern with public relations’”). As Apple explained in its Motion, Apple prioritizes the security and privacy of its users, and that priority is reflected in Apple’s increasingly secure operating systems, in which Apple has chosen not to create a back door.

Apple also calls out the DOJ's technical ignorance.

The government’s assertion that “there is no reason to think that the code Apple writes in compliance with the Order will ever leave Apple’s possession” ... simply shows the government misunderstands the technology and the nature of the cyber-threat landscape. As Apple engineer Erik Neuenschwander states:

I believe that Apple’s iOS platform is the most-attacked software platform in existence. Each time Apple closes one vulnerability, attackers work to find another. This is a constant and never-ending battle. Mr. Perino’s description of third-party efforts to circumvent Apple’s security demonstrates this point. And the protections that the government now asks Apple to compromise are the most security-critical software component of the iPhone—any vulnerability or back door, whether introduced intentionally or unintentionally, can represent a risk to all users of Apple devices simultaneously.

... The government is also mistaken in claiming that the crippled iOS it wants Apple to build can only be used on one iPhone:

Mr. Perino’s characterization of Apple’s process . . . is inaccurate. Apple does not create hundreds of millions of operating systems each tailored to an individual device. Each time Apple releases a new operating system, that operating system is the same for every device of a given model. The operating system then gets a personalized signature specific to each device. This personalization occurs as part of the installation process after the iOS is created.

Once GovtOS is created, personalizing it to a new device becomes a simple process. If Apple were forced to create GovtOS for installation on the device at issue in this case, it would likely take only minutes for Apple, or a malicious actor with sufficient access, to perform the necessary engineering work to install it on another device of the same model.

. . . [T]he initial creation of GovtOS itself creates serious ongoing burdens and risks. This includes the risk that if the ability to install GovtOS got into the wrong hands, it would open a significant new avenue of attack, undermining the security protections that Apple has spent years developing to protect its customers.

And, not surprisingly, Apple angrily attacks the DOJ's bogus misleading use of Apple's transparency report statements about responding to lawaful requests for government information in China, by pointing out how that's quite different than this situation:

Finally, the government attempts to disclaim the obvious international implications of its demand, asserting that any pressure to hand over the same software to foreign agents “flows from [Apple’s] decision to do business in foreign countries . . . .”. Contrary to the government’s misleading statistics ..., which had to do with lawful process and did not compel the creation of software that undermines the security of its users, Apple has never built a back door of any kind into iOS, or otherwise made data stored on the iPhone or in iCloud more technically accessible to any country’s government.... The government is wrong in asserting that Apple made “special accommodations” for China, as Apple uses the same security protocols everywhere in the world and follows the same standards for responding to law enforcement requests.

Apple also points out that the FBI appears to be contradicting itself as well:

Moreover, while they now argue that the FBI’s changing of the iCloud passcode—which ended any hope of backing up the phone’s data and accessing it via iCloud—“was the reasoned decision of experienced FBI agents”, the FBI Director himself admitted to Congress under oath that the decision was a “mistake”.... The Justice Department’s shifting, contradictory positions on this issue—first blaming the passcode change on the County, then admitting that the FBI told the County to change the passcode after the County objected to being blamed for doing so, and now trying to justify the decision in the face of Director Comey’s admission that it was a mistake—discredits any notion that the government properly exhausted all viable investigative alternatives before seeking this extraordinary order from this Court.

On the Constitutional questions, again Apple points out that the DOJ doesn't appear to understand what it's talking about:

The government begins its First Amendment analysis by suggesting that “[t]here is reason to doubt that functional programming is even entitled to traditional speech protections” ... , evincing its confusion over the technology it demands Apple create. Even assuming there is such a thing as purely functional code, creating the type of software demanded here, an operating system that has never existed before, would necessarily involve precisely the kind of expression of ideas and concepts protected by the First Amendment. Because writing code requires a choice of (1) language, (2) audience, and (3) syntax and vocabulary, as well as the creation of (4) data structures, (5) algorithms to manipulate and transform data, (6) detailed textual descriptions explaining what code is doing, and (7) methods of communicating information to the user, “[t]here are a number of ways to write code to accomplish a given task.”... As such, code falls squarely within the First Amendment’s protection, as even the cases cited by the government acknowledge...

Later it points out that the DOJ's claim that since Apple can write such code however it wants it's not compelled speech, Apple points out that their argument says the exact opposite:

The government attempts to evade this unavoidable conclusion by insisting that, “[t]o the extent [that] Apple’s software includes expressive elements . . . the Order permits Apple to express whatever it wants, so long as the software functions” by allowing it to hack into iPhones.... This serves only to illuminate the broader speech implications of the government’s request. The code that the government is asking the Court to force Apple to write contains an extra layer of expression unique to this case. When Apple designed iOS 8, it consciously took a position on an issue of public importance.... The government disagrees with Apple’s position and asks this Court to compel Apple to write new code that reflects its own viewpoint—a viewpoint that is deeply offensive to Apple.

The filing is basically Apple, over and over again, saying, "uh, what the DOJ said was wrong, clueless, technically ignorant, or purposely misleading." Hell, they even attack the DOJ's claim that the All Writs Act was used back in 1807 to force Aaron Burr's secretary to decrypt one of Burr's cipher-protected letters. Apple points out that the DOJ is lying.

The government contends that Chief Justice Marshall once ordered a third party to “provide decryption services” to the government.... He did nothing of the sort, and the All Writs Act was not even at issue in Burr. In that case, Aaron Burr’s secretary declined to state whether he “understood” the contents of a certain letter written in cipher, on the ground that he might incriminate himself.... The Court held that the clerk’s answer as to whether he understood the cipher could not incriminate him, and the Court thus held that “the witness may answer the question now propounded”—i.e., whether he understood the letter.... The Court did not require the clerk to decipher the letter.

If anything, to be honest, I'm surprised that Apple didn't go even harder on the DOJ for misrepresenting things. Either way, Apple is pretty clearly highlighting just how desperate the DOJ seems in this case.

Filed Under: all writs act, doj, encryption, fbi, going dark, syed farook
Companies: apple

Senator Lindsey Graham Finally Talks To Tech Experts, Switches Side In FBI V. Apple Fight

from the a-road-to-Cupertino-conversion dept

On February 18th, Senator Lindsey Graham had this to say about the FBI v. Apple court battle.

Our nation is at war and this iPhone was used to kill Americans. We need to protect our homeland, not terrorists. To Tim Cook and Apple, cooperate with the FBI.

As surprised as we were to learn it was an iPhone that killed 14 people in San Bernardino, rather than the attackers and the weapons they wielded, Graham had yet another surprise in store for us.

Sen. Lindsey Graham (R-S.C.), who last December called on Silicon Valley to stop selling encrypted devices, expressed serious concern on Wednesday about the precedent the Department of Justice would set if it successfully compels Apple to break iPhone security features.

“I was all with you until I actually started getting briefed by the people in the Intel Community,” Graham told Attorney General Loretta Lynch during an oversight hearing in the Senate Judiciary Committee. “I will say that I’m a person that’s been moved by the arguments about the precedent we set and the damage we might be doing to our own national security.”

This is what happens when legislators stop following their gut instincts on subjects they know little about and actually seek input from those who do know what's involved and what's at stake. Graham -- without speaking to "people in the Intel Community" -- originally presented terrorism as Apple's problem. With the benefit of technically-adept hindsight, Graham is now seeing this for what it is: a push for a dangerous precedent that won't end with this one iPhone and Apple. It will move on to other manufacturers, service providers and communications platforms. Because this one iPhone (which is actually twelve iPhones) is just the foot in the door. Apple does not hold a monopoly on encrypted communications.

“One of the arguments Apple makes is that there are other companies that make encryption,” Graham said to Lynch during the hearing. “So from a terrorist point of view, you’re not limited to Apple’s iPhone to communicate are you?”

“I think the terrorists use any device they can to communicate,” the Attorney General responded.

“So this encryption issue, if you require Apple to unlock that phone that doesn’t deny terrorist the ability to communicate privately does it, there are others ways they can do this,” Graham noted.

The FBI -- which sees any communications it can't access as nothing more than a collection of smoking guns comprised of 0s and 1s -- will not stop with Apple. It already has its eyes on WhatsApp, one of the biggest messaging apps in the world -- one that also features end-to-end encryption.

The underlying point Graham is making -- having now spoken with those with the most at stake -- is that a successful push to force American companies to provide unprecedented access to law enforcement does little to stop global terrorism, while causing tremendous damage to those forced into complicity. If the FBI manages to pry open the front door, every other nation in the world is going expect Apple to hold the door open for them as well. And if they can't find a way to force Apple to do that, they may block it from selling its products in their countries. Or Apple may decide the market isn't worth the security hit. Either way, it hurts Apple, and terrorists will just move on to the next service/platform/manufacturer.

It's heartening to see Graham come around on this, especially considering he's spent the last few months coming down harshly on phone manufacturers for refusing to immediately comply with every ridiculous government demand.

Filed Under: doj, encryption, experts, fbi, going dark, intel community, lindsey graham
Companies: apple