Apple Faces Yet More 'Right To Repair' Backlash Over iPhone 13 Screen

from the do-not-pass-go,-do-not-collect-$200 dept

Apple has never looked too kindly upon users actually repairing their own devices. The company's ham-fisted efforts to shut down, sue, or otherwise imperil third-party repair shops are legendary. As are the company's efforts to force recycling shops to shred Apple products (so they can't be refurbished and re-used), and Apple's often comical attacks on "right to repair" legislation, a push that only sprung up after companies like Apple, Microsoft, Sony, John Deere, and others created a grass-roots counter-movement via their attempts to monopolize repair.

And if the construction of the iPhone 13 is anything to go by, Apple has learned absolutely nothing in the last five years of heated debate, legal wrangling, and bipartisan anger. According to iFixit, the iPhone 13 is harder to repair than ever. The screen technically can no longer be replaced at all without the use of a microscope and special software. If you try to do it yourself, it disables the iPhone's Face ID identification technology. That's something that's been confirmed by both iFixit and numerous independent repair shops:

iFixit isn't impressed:

"This is a dark day for fixers, both DIY and professional. One of the most common phone repairs that could once be done with hand tools now requires a microscope. This means you won’t be able to fix your iPhone screen yourself without sacrificing major functionality. It also has huge implications for the professional repair industry, for which Apple is the dominant brand to service. Small shops could be shuttered, forced to choose between spending thousands on new equipment or losing a major source of income."

After complaints bubbled up, Apple told The Verge it would eventually release a software update that doesn't require you transfer the microcontroller to keep Face ID working after a screen swap. Though that update isn't here yet, there's no guarantee it won't come without caveats, the screen is still very difficult to repair, and making the decision in the first place (after several years of very public right to repair backlash) speaks volumes. It's also still part of an overall trend at Apple to monopolize repair.

If an independent repair shop wants to survive, they now have to join (assuming they're even allowed) Apple's problematic independent repair program. Otherwise, independent repair shops lose a ton of revenue every time these policy choices are made (which from Apple's perspective is the whole point). Apple will routinely claim they're only concerned about consumer privacy and security, but it's possible to be pro-privacy and security and pro-environment, pro-consumer, and pro-independent repair simultaneously.

Historically, the more companies like Apple, Sony, or John Deere attempt to monopolize repair, the bigger the bipartisan coalition of annoyed consumers grows. That increases the risk of state or federal legislation blocking their efforts, a bit of mathematics they'll eventually be forced to take to heart.

Filed Under: face id, independent repair, iphone, iphone 13, right to repair, screen
Companies: apple

Apple Patches Up Devices In Response To The Exposure Of Yet Another NSO Group Exploit

from the soon-they-will-make-a-board-with-a-nail-so-big-it-will-destroy-them-all dept

Israeli digital arms merchant NSO Group continues to sell its malware to a wide variety of governments. The governments it sells to, which includes a bunch of notorious human rights abusers, continue to use these exploits to target dissidents, activists, journalists, religious leaders, and political opponents. And the manufacturers of the devices exploited by governments to harm people these governments don't like (NSO says "criminals and terrorists," long-term customers say "eh, whoever") continue to patch things up so these exploits no longer work.

The circle of life continues. No sooner had longtime critic/investigator of NSO Group's exploits and activities -- Citizen Lab -- reported the Bahrain government was using "zero click" exploits to intercept communications and take control of targeted devices then a patch has arrived. Apple, whose devices were compromised using an exploit Citizen Lab has dubbed FORCEDENTRY, has responded to the somewhat surprising and altogether disturbing news that NSO has developed yet another exploit that requires no target interaction at all to deploy.

Apple released a patch Monday against two security vulnerabilities, one of which the Israeli surveillance company NSO Group has exploited, according to researchers.

The updated iOS software patches against a zero-click exploit that uses iMessage to launch malicious code, which in turn allows NSO Group clients to infiltrate targets — including the phone of a Saudi activist in March, researchers at Citizen Lab said.

The backdoor being closed involves a pretty clever trick of the trade. Since links require clicks and images don't, the exploit utilizes a tainted gif to crash Apple's image rendering library, which is then used to launch a second exploit that gives NSO customers control of these devices, allowing them to browse internal storage and eavesdrop on communications.

It's not the first time NSO has developed a zero-click exploit that affects iOS devices. It's just the latest exposed by Citizen Lab's incredible investigation efforts. Thanks to Citizen Lab, more Apple device users around the world are better protected against malicious hackers… working for a company that sells exploits to government agencies. And whatever can be nominally exploited for good (the terrorists and criminals NSO continues to claim its customers target, despite an ever-growing mountain of evidence that says otherwise) can be exploited by governments and malicious hackers who don't even have sketchy "national security" justifications to raise in the defense of their actions.

The arms race continues. It appears marketers of exploits will continue to do what they've always done: maintain over-the-air superiority for as long as possible. And while it may seem this is just part of the counterterrorism game, NSO Group's tacit approval of the targeting of dissidents, journalists, and others who have angered local governments (but have never committed any terrorist or criminal acts) shows it's not willing to stop profiting from the misery of people being hunted and harmed by repressive regimes.

Filed Under: ios, iphone, malware, patches, surveillance
Companies: apple, nso group

On The Same Day The FBI Claimed No Vendor Could Crack IPhones, Another Way To Crack IPhones Made The News

from the way-to-stay-ahead-of-the-news-cycle,-Chris dept

At the same time the FBI director was claiming the private sector (other than Apple) couldn't help agents break into encrypted iPhones, the private sector was once again demonstrating it could do exactly that. Chris Wray's remarks to the press centered less on the underwhelming news that the FBI had conclusively linked the Pensacola Air Base shooter to al Qaeda than on Apple's supposed unhelpfulness.

The FBI claimed it had found a way to access data on the shooter's phones, but provided no details on its method. Maybe agents brute forced a passcode. Maybe they just found a side door that allowed them to exfiltrate the data they were looking for. Whatever it was, it wasn't something provided by a vendor. In fact, Chris Wray went so far as to claim the media was misleading the public about the availability of encryption-breaking/bypassing tech.

We canvassed every partner, and every company, that might have had a solution to access these phones. None did, despite what some claimed in the media.

Within a few hours of this assertion by Wray, the media was again reporting on another tech solution for encrypted iPhones. Here's Olivia Solon for NBC News:

[A]nother tool, previously unknown to the public, doesn't have to crack the code that people use to unlock their phones. It just has to log the code as the user types it in.

Software called Hide UI, created by Grayshift, a company that makes iPhone-cracking devices for law enforcement, can track a suspect's passcode when it's entered into a phone, according to two people in law enforcement, who asked not to be named out of fear of violating non-disclosure agreements.

The software is deployed by existing GrayKey devices -- the same ones Grayshift claims can crack iPhone passcodes by installing a user agent to bypass Apple's lockout countdown. This would be the same software/hardware Chris Wray claims can't do any of these things, despite extensive reporting on claims the manufacturer itself makes.

After dropping the surreptitious tracker on the targeted phone, the phone is returned to the suspect in hopes that they'll input their passcode.

For example, a law enforcement official could tell the suspect they can call their lawyer or take some phone numbers off the device. Once the suspect has done this, even if they lock their phone again, Hide UI will have stored the passcode in a text file that can be extracted the next time the phone is plugged into the GrayKey device. Law enforcement can then use the passcode to unlock the phone and extract all the data stored on it.

The software also disables airplane mode and disables wiping of the device. A snapshot of the system is taken to track any attempted deletion of phone contents.

This seems to do all the things the FBI claims no one can actually do. Sure, it won't scale -- especially since it requires a fair bit of subterfuge on the part of investigators and relies on the trust of criminal suspects who might find it suspicious their seized phone has suddenly been returned to them. But no technique for bypassing encryption ever will. And none of them should.

Asking a suspect for the combination to a safe will only unlock that safe, not every safe seized during searches. Phones are as unique as the individuals carrying them. So are the circumstances surrounding the attempted searches. One size should not fit all and the encryption backdoors Chris Wray wants only ensure everyone -- criminal or not -- will be negatively affected by law enforcement's newly-greased wheel.

Then there's the secrecy surrounding this tech. The NDAs Grayshift force on law enforcement customers means judges, defendants, and defense lawyers aren't being told what's being used to open up phones and search their contents. We've spent years detailing the opacity shrouding the deployment of Stingray devices -- something that has allowed law enforcement to avoid having warrant requirements imposed on them. The same thing is happening here. There's a legal way to do this. But the secrecy imposed by the tech provider tends to provide the cover officers need to operate these unlawfully. Here's the best case scenario, followed immediately by the most likely scenario.

“Law enforcement use of this ‘agent’ keylogger feature can be legal, so long as the warrant the government gets to search and seize the device spells out that the investigators are permitted to use it,” said Riana Pfefferkorn, associate director of surveillance and cybersecurity at Stanford Law School’s Center for Internet and Society. “In general, I don't think that magistrate judges authorizing search warrants would expect that the government plans to implant malware on a device it has seized.”

There are solutions out there. And they're not legislative mandates compelling assistance breaking encryption or backdoors for law enforcement. There are ways to bypass or crack what Bill Barr and Chris Wray have decided to call "warrant-proof encryption." Pretending there isn't while using an investigation press conference as a grandstand for Apple bashing isn't moving the conversation forward. It's just giving everyone one more reason not to trust Bill Barr or Chris Wray.

Filed Under: chris wray, cracks, encryption, fbi, hide ui, iphone
Companies: apple, grayshift

FBI Holds Press Conference To Claim Apple Prevented It From [Checks Notes] Verifying Attribution In The Pensacola Air Base Shooting

from the what-a-compelling-argument-for-broken-encryption dept

The FBI held a very performative press conference to announce it had finally gained access to communications and data originating from the Pensacola Naval Air Station shooter. The coup, apparently, is that the FBI was able to -- after months of fighting iPhone encryption -- um... nail down attribution. Here's CNN's report on the FBI's press conference:

The Saudi military trainee who killed three US sailors and wounded several others in a terror attack last year on a military base in Pensacola, Florida, was in touch with a suspected al Qaeda operative, according to multiple US officials briefed on the matter.

US investigators uncovered the al Qaeda connection after the FBI broke through the encryption protecting the Saudi attacker's iPhones, the officials said.

So, the FBI discovered that a shooter who al Qaeda claimed to be one of theirs was actually one of theirs. I'm sure the FBI found a few more leads to investigate -- potentially targeting US persons involved with the terrorist group -- but it's far from the wealth of evidence the agency continually asserted was definitely present on the phones agents weren't able to access.

It's big news in a smaller way.

If Alshamrani was directed or trained by al Qaeda, it would mark the first time since 9/11 that a foreign terrorist organization had done so in a deadly attack in the US, according to New America, a think tank.

That's an 18-year gap between foreign terrorist group-directed attacks on US soil. Not much to write home about, but the FBI seems to feel we all should be writing about it. Hopefully, this isn't the FBI's linchpin argument, because something that happens once every other decade is hardly worth the broad undermining of encryption the agency seeks.

CNN's report says something the FBI doesn't actually say: the "FBI broke through the encryption" statement. Chris Wray's remarks at the press conference don't actually state that the FBI broke the phones' encryption. (And nothing is said about the iPhone that was damaged by a bullet, which possibly rendered it completely useless.)

On the topic of innovation—I want to thank and congratulate the men and women at the FBI who devoted months of hard work to accessing these devices. They successfully tackled a problem that required tenacity, creativity, and technical expertise. Those qualities are valuable in any organization—so I know how fortunate we are, and how fortunate the American people are, that we have so many people with those qualities at the Bureau. That’s why we work to recruit the kind of people we do.

The magnitude of the challenge they faced is hard to overstate.

[...]

Unfortunately, the technique that we developed is not a fix for our broader Apple problem—it’s of pretty limited application. But it has made a huge difference in this investigation.

This doesn't clarify anything. This just says the FBI was finally able to access some of the contents, which means it could have found a way to exfiltrate or recover some data without actually breaking encryption.

What I've excised in this quote shows that this press conference wasn't about announcing these findings. It was an anti-encryption pep rally pretending to be a dry announcement about an ongoing investigation. The FBI's ulterior motives made their way to the forefront, starting with this:

We received effectively no help from Apple.

Wrong. The FBI received all the help Apple could give it. Apple was compliant with turning over all data and communications it could access. What it didn't do was offer to break the encryption on the seized devices. And while Wray may talk about delays and (no, seriously) agents "toiling through the pandemic," it was the FBI that sat on this investigation, waiting a month before asking Apple for assistance.

Then there's this statement, in which Wray says everyone's been misinformed about encryption-breaking tools sold by a handful of vendors.

We canvassed every partner, and every company, that might have had a solution to access these phones. None did, despite what some claimed in the media.

"What some claimed in the media" is a fucking disingenuous statement. This is what was claimed by vendors offering tools that bypassed Apple's built-in protections to provide access to iPhone contents. The media didn't spin this. If vendors over-promised and under-delivered, that's on them, not the journalists reporting on the latest in encryption-breaking tech.

This is twice as disingenuous when you remember the FBI refused to seek outside options in the San Bernardino shooter case because it really would rather have had legal precedent. While the FBI and DOJ went after Apple in court, vendors tried to offer their assistance. When the FBI finally decided to work with a still-undisclosed vendor to obtain the (useless) contents of the shooter's iPhone, FBI officials were upset this had derailed their attempt to obtain judicial blessing for compelled decryption. This is pure spin and it was delivered by the head of the FBI solely to portray Apple as an enemy of the rule of law and the public's safety.

Flow my collective tears, the federal policeman said.

Public servants, already swamped with important things to do to protect the American people—and toiling through a pandemic, with all the risk and hardship that entails—had to spend all that time just to access evidence we got court-authorized search warrants for months ago. Our engineers and computer scientists working to access these phones were also needed on other, pressing, national security and criminal investigations.

But the delay getting into these devices didn’t just divert our personnel from other important work. It’s also seriously hampered this investigation.

Finally getting our hands on the evidence al-Shamrani tried to keep from us is great. But we really needed it months ago, back in December, when the court issued its warrants.

Needed it for what? Confirming what al Qaeda said after the shooting? If that's all there is, it really isn't worth undermining the security of millions of encryption users, including those who work at the FBI. And it sure as hell didn't stop the FBI from performing an investigation. Wray states the FBI interviewed 500 people and obtained all the evidence it could from sources other than the locked iPhones. The investigation continued and personnel still worked round-the-clock "through a pandemic" to put this case together. Apple's contribution (or lack thereof) is only a footnote, but Wray insists it's the headline.

Don't be swayed by Wray's cheap shots. This press conference was held to directly (in Apple's case) and indirectly smear every US company that offers encryption to their users. If the FBI had held an intellectually honest press conference, it simply would have noted it found evidence linking the Pensacola shooter to al Qaeda and left it at that. (It also might have explained why it still hasn't updated its count of encrypted devices in its possession.) Instead, Wray grabbed a bunch of nails and hung his agency on the cross, punctuating every hammer strike with oblique assertions that a refusal to create encryption backdoors may result in another foreign-directed terrorist strike on the homeland sometime in the next twenty years. When the facts alone aren't compelling, the rhetoric has to make up the difference. And all we have here is a lot of anti-encryption filler.

Filed Under: al qaeda, chris wray, encryption, fbi, iphone, pensacolar, phones, terrorism
Companies: apple

As The DOJ Continues To Complain About Encryption, Cellebrite (Again) Announces It Can Crack Any IPhone

from the do-y'all-not-get-the-internet? dept

On Monday, June 17, Deputy Attorney General Jeffrey Rosen said this during his speech to the National Sheriffs' Association:

In recent years, criminals have become more and more adept at using technology to avoid law enforcement in what we call “going dark.” While “going dark” has many manifestations, some of its greatest impacts are in the areas of encryption, in assuring the security of information. But, as you well know, encryption also allows criminals to frustrate law enforcement's access to evidence — even where a neutral judge has found probable cause and ordered that we have access to that evidence.

I guess the "going dark" crowd doesn't get out much.

On Friday afternoon, the Israeli forensics firm and law enforcement contractor Cellebrite publicly announced a new version of its product known as a Universal Forensic Extraction Device or UFED, one that it's calling UFED Premium. In marketing that update, it says that the tool can now unlock any iOS device cops can lay their hands on, including those running iOS 12.3, released just a month ago. Cellebrite claims UFED Premium can extract files from many recent Android phones as well, including the Samsung Galaxy S9. No other law enforcement contractor has made such broad claims about a single product, at least not publicly.

It was announced very publicly. This wasn't a press release sent only to government agencies or the byproduct of leaked internal documents. It was announced on the company's Twitter account, letting everyone know Cellebrite is apparently beating almost every device maker at their own encryption game. Like GrayKey's offering, Cellebrite's updated encryption-breaker is hardware that can be used on site by purchasers, allowing law enforcement agencies to perform their own cracking and extraction.

Sure, the flaws used to bypass device security will be patched, and Cellebrite and its competitors will keep digging around in device hardware/software to find holes to exploit. The security vs. insecurity war will continue. But for all the weak arguments made by the head of the FBI -- especially the ones about Apple, etc. "profiting" from locking out law enforcement -- it would seem companies like Cellebrite are more likely to directly profit from device encryption. Encryption on phones is a standard offering, not a selling point. Tools that break encryption? Now, that's where the real money is.

Cellebrite, along with companies like GrayKey, are providing the solutions the FBI and DOJ think device manufacturers should be creating for them. We don't hear much from FBI officials about third party offerings because this agency would prefer a permanent fix delivered by Congress and the courts, rather than spend any of their own money and time trying to find a solution. The FBI has been misleading and dishonest for the entirety of its "going dark" campaign, all the while claiming tech companies would willingly give the FBI what it wants -- encryption backdoors -- if they would just engage in an "honest" conversation about the issue.

Filed Under: doj, encryption, fbi, going dark, ios, iphone
Companies: apple, cellebrite

Fifth Circuit Says Apple Can't Be Held Liable For A Car Crash Caused By Someone Reading Text Messages

from the texting-while-litigating dept

Seeking to hold tech companies responsible for the actions of their customers and users is a national federal court tradition. Law firms like *checks notes* 1-800-LAW-FIRM and Excolo Law have made a cottage industry of this, scoring dismissal after dismissal of their lawsuits seeking to hold Facebook, Twitter, and YouTube responsible for the violent actions of terrorists around the world.

Seeking justice -- or at least compensation -- for wrongs committed against you and the ones you love is a natural instinct. Issues only develop when you take the fight to a third party only tenuously connected to the wrong that was committed. A lawsuit against Apple has been dismissed for the second time. The Fifth Circuit Court of Appeals is no more impressed with the arguments that failed to make an impact at the lower level.

In this case, the appellants sued Apple for a car crash caused by a driver reading text messages on her iPhone 5. Maybe the driver turned out to be judgment proof -- especially after being convicted on two counts of criminally negligent homicide. The appellants -- who lost two family members in the auto accident -- feel Apple is liable because it did not implement a lock-out process it had patented in 2008.

The appellants claim Apple recognized the texting-while-driving problem but failed to do anything about it. The Appeals Court says [PDF] a Pavlovian response to incoming texts cannot be Apple's fault, not even at the state level.

This case asks us to decide whether, under Texas law, a driver’s neurobiological response to a smartphone notification can be a cause in fact of a car crash. Because answering in the affirmative would entail an impermissible innovation or extension of state law, we answer in the negative.

The court goes on to point out that the cases cited by the appellants dealing with vicarious liability all have one thing in common: reasonable expectations.

The Texas cases on which Appellants rely make clear that acceptance of their causation theory would work a substantial innovation in Texas law. These cases present garden-variety theories of causation that ordinary minds would readily accept, so they have little to say about the present case. One is Dover Corp. v. Perez, which concerned a heater pumping carbon monoxide into an apartment due to its negligent manufacture and installation... No useful analogy exists between a smartphone’s effect on users and a heater generating carbon monoxide. Others are Dew v. Crown Derrick Erectors, Inc., 208 S.W.3d 448, 449–50 (Tex. 2006), about a worker who fell through an opening in an oil derrick platform left unprotected, and Rio Grande Regional Hospital, Inc. v. Villareal, 329 S.W.3d 594, 603–04 (Tex. App.––Corpus Christi 2010), about a nurse who left a psychiatric patient unattended with razor blades. No worthwhile analogies suggest themselves here either. Appellants also cite a case about Ford’s decision not to install a seatbelt for the middle seat in the Ford Bronco’s rear row. Ford Motor Co. v. Cammack, 999 S.W.2d 1, 8–9 (Tex. App.––Houston [14th Dist.] 1998). An analogy may perhaps be drawn between a distracting phone and a car seat without a seatbelt, but it does not get us very far. A user of the former can make it safe for driving by silencing or switching it off; no such simple fix exists for the latter.

The court's condensed take appears at the bottom of the footnote appended to this paragraph.

None of the causes alleged in these cases strains the sensibilities of a reasonable person, nor does any resemble the cause advanced by Appellants here.

The court also notes that Texas laws governing distracted driving place the onus on the driver -- not the cellphone provider nor the vehicle manufacturer, no matter what safety features may have been bypassed or never implemented.

Under state or federal precedent, the outcome is the same: the cause of the crash was the driver, not the cellphone manufacturer.

No Texas case has addressed whether a smartphone manufacturer should be liable for a user’s torts because the neurobiological response induced by the phone is a substantial factor in her tortious acts. To our knowledge, informed by submissions to us, no court in the country has yet held that, and numerous courts have declined to do so. As such, no authority indicates to us that Texas courts, contemplating reasonable persons and ordinary minds, would recognize a person’s induced responses to her phone as a substantial factor in her tortious acts and therefore hold the phone’s manufacturer responsible.

As frustrating as it can be for those who've experienced a tragedy, the person who has wronged you is responsible for their actions -- not their cellphone provider or their social media platform of choice.

Filed Under: 5th circuit, ashley kubiak, iphone, liability, texas, texting
Companies: apple

Prosecutors Charge Suspect With Evidence Tampering After A Seized iPhone Is Wiped Remotely

from the lots-of-missing-info-here dept

Going on little more than their belief a phone may contain evidence in a drive-by shooting case, prosecutors in Schenectady, New York are charging a suspect with destroying evidence.

A cellphone seized by police as part of an investigation into a drive-by shooting last month was remotely wiped by its owner, authorities said this week.

Police believe Juelle L. Grant, 24, of Willow Avenue, may have been the driver of a vehicle involved in an Oct. 23 drive-by shooting on Van Vranken Avenue, near Lang Street, so they obtained her phone, according to police allegations filed in court. No one was injured in the shooting.

After police took her iPhone X, telling her it was considered evidence, "she did remotely wipe" the device, according to police.

"The defendant was aware of the intentions of the police department at the conclusion of the interview with her," according to court documents.

Grant now faces three felonies: two counts of evidence tampering and one count of hindering prosecution. One count of evidence tampering related to the alleged phone wipe. The other two counts listed are related to concealing the shooter's identity and disposing of the weapon used.

Grant purchased a new iPhone some time after her other one was seized. It could be her logon from a new device erased files on her old one, but that seems unlikely and the dates don't really line up. Her lawyer says she got a new phone "days after" the cops took her first one, but the documents alleging evidence tampering says it happened less than 24 hours after the alleged drive-by. Supposedly, Grant isn't a "computer-savvy person," according to her attorney, but it's not all that tough to do even for someone with limited tech skill

The easiest method for remote wiping would be using Apple's "Find My iPhone" feature, which has "Erase iPhone" right on the landing page. This seems to be the likeliest explanation for what happened, although it may be Grant herself did not trigger the remote wipe.

And there are unanswered questions about law enforcement's handling of the seized iPhone. Have they not heard of Faraday cages/bags? That exact question was posed to law enforcement by The Daily Gazette. The first answer was a deflection:

Asked last Wednesday evening if such technology was available to city detectives, police spokesman Sgt. Matthew Dearing said he did not know but would check with detectives. He indicated late Thursday afternoon that he had yet to hear back from them.

One week later, there's still no answer.

A message Monday morning asking Dearing if he had yet heard back from detectives was not immediately returned.

Finally, there's another question that needs to be answered by law enforcement as it moves forward with these charges: how likely is it that there's evidence of a drive-by shooting on a person's phone? That probability -- an essential part of "probable cause" -- seems a little low. Sure, cops might have found a judge willing to believe a person's phone is just something that collects evidence of any and all criminal activity until law enforcement needs it, but there's always a chance the judge might actually demand justification for searching a phone seized from a drive-by shooting driver.

With the alleged "evidence" now allegedly maliciously deleted, law enforcement might be off the probable cause hook. But it shouldn't be. It should have to justify its original search plans before it can move forward with evidence tampering charges. From what's been presented in this coverage, it doesn't appear law enforcement has a solid basis for the search it never got to perform.

Filed Under: evidence, iphone, new york, police
Companies: apple

After Being Hit With A 'Motion For Return Of Property,' Gov't Agrees To Delete Data Copied From A Traveler's Phone

from the sometimes-the-best-hand-is-the-one-you-force dept

A couple of months ago, Rejhane Lazoja, an American Muslim, sued (sort of... ) the DHS over the search of her iPhone at the border. According to her allegations, CBP officers detained her and demanded she unlock her phone for them. She refused. The CBP seized her phone and searched it anyway, copying all the data it could from her device. It returned the phone to her over three months after it had taken it.

Lazoja didn't allege civil rights violations in her courtroom motion. In fact, it wasn't even technically a lawsuit. Instead, with the help of CAIR, Lazoja filed a Rule 41(g) motion -- something normally used to challenge seizures and forfeitures. In this case, Lazoja wanted her data back -- the data CBP had copied from her phone.

Lazoja leveraged CBP's own policies against it, pointing out its internal guidelines say seized data must be destroyed unless it is determined there's probable cause to retain it. Since this search occurred at the border, it's safe to say the CBP did it because it could, not because it could be justified under the more-stringent standard required further inland.

Apparently, the CBP agrees with this assessment. Or, at least, it has decided this isn't the hill it's going seek precedent on. As Cyrus Farivar reports for Ars Technica, the government has agreed to delete -- i.e., "return" -- Lazoja's phone data.

An American Muslim woman who two months ago asked a federal judge to compel border officials to erase data copied from her iPhone 6S Plus has settled her lawsuit with the government—federal authorities have now agreed to delete the seized data.

This little legal hack may come in handy for millions of travelers and visitors who encounter the CBP and its Constitutionally-unfriendly border search activities. There's been a steady exponential increase in device searches over the last few years, all performed under the guise of greater national security. The CBP has been unable to justify this increased need to paw through people's digital goods, but a long list of policies, law changes, and court decisions has ensured it will likely never need to explain itself to the general public.

With this motion, plaintiffs can at least attempt to force CBP to delete data it has harvested from their devices, as it's unlikely every one of its thousands of digital border searches can meet the probable cause standard to retain seized data. Anyone not forcing the CBP's hand should probably just assume their data resides on a government hard drive somewhere, collecting digital dust and waiting for an enterprising hacker or ill-willed government employee to take advantage of it.

Filed Under: cair, cbp, dhs, iphone

Apple Finally Shuts Down Security Flaw Used By Phone-Cracking Vendor

from the indiscriminate-protection dept

In a move that will anger law enforcement (but really isn't about law enforcement), Apple has succeeded in killing an exploit that allowed a third-party vendor to crack iPhones for investigators. A few months ago, Apple announced it was fixing the flaw that allowed products like GrayKey to bypass built-in security features to engage in brute force password guessing. Thomas Brewster of Forbes confirms the fix is finally in.

Multiple sources familiar with the GrayKey tech tell Forbes the device can no longer break the passcodes of any iPhone running iOS 12 or above. On those devices, GrayKey can only do what’s called a “partial extraction,” sources from the forensic community said. That means police using the tool can only draw out unencrypted files and some metadata, such as file sizes and folder structures.

Some in law enforcement may view this as confirmation of their "going dark" complaints and claim that Apple cares more about its customers than it does about fighting crime. As if that was bad thing. Apple should care more about what its customers want and need than government access to locked devices. A security hole is a hole that can be used by everyone who can exploit it. There's no way to prevent a flaw from being exploited by criminals even if law enforcement agencies find the exploit super-useful.

Grayshift's products are still somewhat useful, but it's going to be hard to justify a premium price for a stunted service. This new development might be Grayshift's fault. Soon after Apple announced one fix for an exploit used by Grayshift, the company bragged it could still crack phones just as easily. This appears to have prompted closer examination of the problem Apple thought it fixed with the first round of patching. The second pass has blunted the exploit's usefulness, even if it hasn't made it completely impossible to access some data contained in locked devices.

Even with the fix in play, law enforcement complaints about "darkness" are overblown. There are other technical solutions available, along with a wealth on information stored by third parties and cloud services. The more technical solutions won't scale, but that's not really something law enforcement should complain about. Security protections for phone owners shouldn't be viewed as weapons deployed against law enforcement. Phone manufacturers have an obligation to their customers to protect their personal data, and encryption is just one of the tools deployed to keep customers' information out of the hands of others. That some of the "others" are cops and investigators is just a side effect of providing solid products and service.

This won't make government critics of Apple any happier, though. And its closing of security holes is just going to lead to more demands for anti-encryption laws. Very few legislators seem interested in mandating backdoors, so these complaints aren't gaining any traction. But government agencies like the FBI have endless time and infinite resources, so the calls for backdoors will never completely cease -- not as long as there's a chance a major tragedy might prompt reckless Congressional action.

Apple's protection of its users is great, but its sincerity should be questioned when it's willing to put Chinese users' data where the Chinese government can easily access it. If it wants to be a champion for its customers, it needs to protect all of them, not just the ones it's currently convenient to protect. When you've got to explain why you're "locking out" US law enforcement but letting a foreign government walk in the front door, you're doing customer service wrong.

Filed Under: backdoors, cracks, encryption, graykey, iphone, law enforcement
Companies: apple, grayshift