DOJ Using Antiquated 1789 'All Writs Act' To Try To Force Phone Manufacturers To Help Unlock Encrypted Phones

from the any-and-all-methods dept

With the ongoing fight over mobile encryption in the last few months, it's no secret that law enforcement has been pushing for new laws that require backdoors into encrypted offerings. However, the Wall Street Journal also noted another little trick that the Justice Department appears to be testing out: dumping the problem back on the phone manufacturer, by using a centuries old law to require the [nameless] phone manufacturer to help law enforcement decrypt a phone. And, Ars Technica then found another example of it being used on the very same day in a different case to try to pressure Apple into helping to decrypt a phone.

Specifically, the DOJ used the All Writs Act -- a 1789 law, that is now codified as 28 USC 1651. It's pretty straightforward (and broad):

(a) The Supreme Court and all courts established by Act of Congress may issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.

(b) An alternative writ or rule nisi may be issued by a justice or judge of a court which has jurisdiction.

The case the WSJ found is not at all clear in the details. An order was issued to a phone manufacturer -- whose name is redacted to [XXX] Inc. -- saying that it needed to help the DOJ unlock the phone. Federal Court Magistrate Judge Gabriel Gorenstein (in the Southern District of NY) agreed, but issued the public ruling on it, perhaps recognizing that this is diving into slightly questionable territory. While noting that the All Writs Act was also the basis for so called "pen register" orders (recording phone numbers dialed by certain phones based on court orders), Gorenstein points out that this is a similar situation:

the Supreme Court held that a district court had authority under the All Writs Act to issue an order requiring a telephone company to provide technical assistance to the Government in its effort to install a "pen register" — a device for recording the numbers dialed on a telephone.... Thus, we conclude that it is appropriate to order the manufacturer here to attempt to unlock the cellphone so that the warrant may be executed as originally contemplated.

However, Gorenstein points out that the All Writs Act isn't without its limits, and thus he provides the phone manufacturer a chance to protest, arguing that the request is too burdensome:

The Government has provided a proposed Order that directs the manufacturer to provide "reasonable technical assistance" in unlocking the device. The proposed Order omits, however, any mention of a process by which the manufacturer may seek to the challenge the Order. Courts have held that due process requires that a third party subject to an order under the All Writs Act be afforded a hearing on the issue of burdensomeness prior to compelling it to provide assistance to the Government.... To the extent the manufacturer believes the order to be unduly burdensome or that it should be reimbursed for expenses, the manufacturer should be given clear notice that it has the opportunity to object to the Order.

It's unclear if the manufacturer did object to the order or not. In the other case, in the Northern District of California, Magistrate Judge Kandis Westmore doesn't hide Apple's name, noting that the FBI has the phone and wants Apple's help to decrypt it under the All Writs Act. The request, filed on the same day as the ruling in NY, notes that "in other cases, courts have ordered the unlocking of an iPhone under this authority." In other words, it looks like the DOJ wasted no time using the ruling in NY to suggest this was a common way of forcing the phone manufacturer to help decrypt phones. Though, as others have pointed out, other courts have actually pushed back on attempts by the feds to use the All Writs Act to spy on people like this.

Either way, Westmore doesn't go as far as Gorenstein, and rather notes that Apple only need provide "reasonable technical assistance" but "is not required to attempt to decrypt, or otherwise enable law enforcement's attempts to access any encrypted data." Instead:

Apple's reasonable technical assistance may include, but is not limited to, bypassing the iOS Device's user's passcode so that the agents may search the device, extracting data from the Device and copying the data onto an external hard drive or other storage medium that law enforcement agents may search, or otherwise circumventing the Device's security systems to allow law enforcement access to Data and to provide law enforcement with a copy of encrypted data stored on the iOS Device.

Westmore's response seems somewhat limited. It basically says that Apple can help getting the (encrypted) data off the device if the FBI can't figure out how, but it shouldn't have to help to decrypt it. The NY case ruling seems much more open ended. It's unclear if the nameless manufacturer in the NY case did push back on the ruling by protesting it. If it did, the efforts are probably sealed up. However, it does suggest that the DOJ is already figuring out a variety of ways to try to pressure even those who lock down information on devices to help the DOJ break those locks.

Filed Under: all writs act, doj, fbi, gabriel gorenstein, kandis westmore, mobile encryption, phone manufacturers

Federal Judge Gives Government Open-Ended Access To All Content In A Suspect's Gmail Account

from the a-warrant-is-NOT-a-permission-slip-to-violate-the-4th-Amendment dept

Even though the government hates to get warrants for searches, sometimes it has no choice. But just because there's a warrant involved doesn't mean the search will be any less invasive. Warrant applications are supposed to contain specifics about what is being sought and where it likely resides based on the sworn statements of investigators. Unfortunately, this often doesn't seem to be the case, especially when it comes to electronic data.

Two recent pushbacks by magistrate judges have sent the government back to its desk to rewrite overly vague warrant requests. (In one case, this resulted in 'judge shopping,' rather than a rewrite. The new judge was unimpressed.) Judges willing to make the government fine tune warrant requests are still a very small minority, however. The more common approach is exemplified by Judge Gabriel Gorenstein of the Southern District of New York.

A New York judge defended a controversial order that gave the government access to all content of the Gmail account of a target in a money laundering investigation, holding that courts have long recognized the practical need for law enforcement to seize documents if only to determine whether they fall within the warrant.

As John Ribeiro's article notes, other recent decisions have found that overly broad warrant requests are stretching the Fourth Amendment to the breaking point by not limiting the time period or scope of the electronic communications being sought. The government, on the other hand, has argued (with Gorenstein echoing) that seizing months of emails is no different than cloning an entire hard drive -- another common process deployed during criminal investigations. That it's no different doesn't suddenly make it more "right" or less of a violation of privacy.

Those other decisions (one of which Gorenstein refers to in his) had no noticeable effect on the approval of this warrant, which asked for everything… and got it.

The New York court, in contrast, granted on June 11 a warrant that permitted law enforcement to obtain emails and other information from a Gmail account, including the address book and draft mails, and to permit a search of the emails for certain specific categories of evidence.

Moving on from his "lesser of two wrongs" argument, Gorenstein added that allowing the service provider to return relevant communications would likely result in important information being overlooked.

"While an agent steeped in the investigation could recognize the significance of particular language in emails, an employee of the email host would be incapable of doing so," he wrote.

While this is likely true to some extent (the decision goes on to note that criminals often use codewords to discuss illegal activity -- something private company techs may not be versed in), the warrant itself is still highly problematic.

The court did not also place any limits on the manner or time frame in which the emails should be searched or retained.

So, the government will be given a suspect's entire email account and allowed to peruse it for anything for as long as it wants to.

As we've seen just recently, this is the sort of open-ended access the government shouldn't be given. In June, the Second Circuit Court returned a decision that said the government violated a person's Fourth Amendment rights by holding onto seized information for much longer than the period stated in the warrant. Not only did the feds dig through irrelevant information (after swearing in the warrant request that it wouldn't), it continued to do so until it came across something of possible interest to another federal agency (the IRS) and forwarded the data it supposedly wasn't digging through. Gorenstein's approved warrant contains no such safeguards, which means the feds literally can't go beyond the scope of the request. It's a blank check disguised as a nod to the Fourth Amendment.

The Fourth Amendment prohibits unreasonable searches and seizures. It does not go on to say "...unless you get a warrant." The warrant process is supposed to limit unreasonable searches and seizures by forcing law enforcement to detail (in a sworn statements) the specifics of what's being sought and the efforts that will be made to limit the seizure to the scope of the investigation. There's nothing "reasonable" about this open-ended request. Gorenstein's decision places ease of law enforcement access above Constitutional rights.

Filed Under: 4th amendment, email, gabriel gorenstein, sdny, warrants
Companies: google