No, A Judge Did Not Just Order Apple To Break Encryption On San Bernardino Shooter's iPhone, But To Create A New Backdoor

from the slightly-different... dept

So... have you heard the story about how a magistrate judge in California has ordered Apple to help the FBI disable encryption on the iPhone of one of the San Bernardino shooters? You may have because it's showing up everywhere. Here's NBC News reporting on it:

A federal judge on Tuesday ordered Apple to give investigators access to encrypted data on the iPhone used by one of the San Bernardino shooters, assistance the computer giant "declined to provide voluntarily," according to court papers.

In a 40-page filing, the U.S. Attorney's Office in Los Angeles argued that it needed Apple to help it find the password and access "relevant, critical … data" on the locked cellphone of Syed Farook, who with his wife Tashfeen Malik murdered 14 people in San Bernardino, California on December 2.

And you'd be forgiven for believing that the court has now ordered Apple to do the impossible. After all, for well over a year, the DOJ has been arguing that the All Writs Act of 1789 can be used to force Apple to help unlock encrypted phones. And that's an argument it has continued to make in multiple cases.

Many people are now mocking this ruling, pointing out that with end-to-end encryption it's actually impossible for Apple to do very much to help the FBI, which makes the order seem ridiculous. But that's because much of the reporting on this story appears to be wrong. Ellen Nakashima, at the Washington Post, has a more detailed report that notes that Apple is actually required to do something a little different:

The order does not ask Apple to break the phone’s encryption, but rather to disable the feature that wipes the data on the phone after 10 incorrect tries at entering a password. That way, the government can try to crack the password using “brute force” — attempting tens of millions of combinations without risking the deletion of the data.

The order, signed by a magistrate judge in Los Angeles, comes a week after FBI Director James B. Comey told Congress that the bureau has not been able to open one of the killers’ phones. “It has been two months now, and we are still working on it,” he said.

In other words, the order does not tell Apple to crack the encryption when Apple does not have the key. Rather, it is asking Apple to turn off a specific feature so that the FBI can try to brute force the key — and we can still argue over whether or not it's appropriate to force Apple to disable a key feature that is designed to protect someone's privacy. It also raises questions about whether or not Apple can just turn off that feature or if it will have to do development work to obey the court's order. In fact, the same report notes that there is no way for Apple to actually do this:

According to industry officials, Apple cannot unilaterally dismantle or override the 10-tries-and-wipe feature. Only the user or person who controls the phone’s settings can do so. The company could theoretically write new software to bypass the feature, but likely would see that as a “backdoor” or a weakening of device security and would resist it, said the officials, who spoke on the condition of anonymity to discuss a sensitive matter.

So you could argue that this is effectively the same thing as asking Apple to break the encryption, since it (apparently) has no direct access to turning off that feature. However, the specifics do matter -- and most of the kneejerk responses to the order (and the reporting on it) are suggesting something very different than what the court order seems to say.

I think it's still perfectly reasonable to argue that this order is highly problematic, and not legally sound. However, it is still quite different than what most are claiming. It also seems like something that could be quite dangerous. Apple is being pressured to write code that undermines an important security feature, and will probably have little time to debug or test it overall, meaning that this feature it is being ordered to build will almost certainly put more users at risk.

Update: Okay, we've got the full order and it is, indeed, troubling. Here's the key part:

Apple's reasonable technical assistance shall accomplish the following three important functions: (1) it will bypass or disable the auto-erase function whether or not it has been enabled; (2) it will enable the FBI to submit passcodes to the SUBJECT DEVICE for testing electronically via the physical device port, Bluetooth, Wi-Fi, or other protocol available on the SUBJECT DEVICE and (3) it will ensure that when the FBI submits passcodes to the SUBJECT DEVICE, software running on the device will not purposefully introduce any additional delay between passcode attempts beyond what is incurred by Apple hardware.

Apple's reasonable technical assistance may include, but is not limited to: providing the FBI with a signed iPhone Software file, recovery bundle, or other Software Image File ("SIF") that can be loaded onto the SUBJECT DEVICE. The SIF will load and run from Random Access Memory and will not modify the iOS on the actual phone, the user data partition or system partition on the device's flash memory. The SIF will be coded by Apple with a unique identifier of the phone so that the SIF would only load and execute on the SUBJECT DEVICE. The SIF will be loaded via Device Firmware Upgrade ("DFU") mode, recovery mode, or other applicable mode available to the FBI. Once active on the SUBJECT DEVICE, the SIF will accomplish the three functions specified in paragraph 2. The SIF will be loaded on the SUBJECT DEVICE at either a government facility, or alternatively, at an Apple facility; if the latter, Apple shall provide the government with remote access to the SUBJECT DEVICE through a computer allowing the government to conduct passcode recovery analysis.

If Apple determines that it can achieve the three functions stated above in paragraph 2, as well as the functionality set forth in paragraph 3, using an alternate technological means from that recommended by the government, and the government concurs, Apple may comply with this Order in that way.

The order also sets out that:

To the extent that Apple believes that compliance with this Order would be unreasonably burdensome, it may make an application to this Court for relief within five business days of receipt of the Order.

I would imagine that Apple will be taking the court up on that...

Filed Under: all writs act, backdoor, break encryption, encryption, fbi, going dark, privacy, san bernardino attacks, sheri pym
Companies: apple

Clueless Press Being Played To Suggest Encryption Played A Role In San Bernardino Attacks

from the gotta-try dept

As law enforcement and their friendly politicians have used the attacks in San Bernardino to renew a call to undermine and break encryption, the mainstream press has been an easy target for politicians looking to get out whatever message they want. Take, for example, the following set of stories that popped up for me in a simple Google News search: Note that the first story -- the one claiming the San Bernardino attackers had encryption actually came out before the second story saying they did not. Incredibly, if you read the full text of both stories, neither fully agrees with its own headline. The ABC story is ridiculously vague:

The couple who launched the terrorist attack in San Bernardino, California, last week had devices with some form of encryption, making it difficult for authorities to access all potential information on phones and perhaps other devices, two senior U.S. officials told ABC News.

"Some of their digital media we have been able to exploit. Some of it we have not,” one official said.

The story at The Hill that claims there's "no evidence" instead has lots of quotes from people suggesting that they just haven't found it yet, and Senator Richard Burr saying it doesn't matter because "we've still got a big problem out there that we're going to have to deal with and it's called encryption." This is the same Richard Burr who, just a couple of months ago, was warning about the dangers of "cyber" attacks in pushing CISA. Does he not realize that encryption helps protect against those attacks significantly more than the ridiculous CISA bill he supported?

Anyway, it appears the same anonymous "senior US officials" who were whispering in ABC's ear were doing the same to CBS, which posted a ridiculously vague tweet, without any followup story (that I can find): Others have since run with it. The International Business Times wrote an entire story about the encryption the attackers used, with CBS's tweet as its sole source. And a local Fox affiliate ran a similar story that also is ridiculously vague, with a title breathlessly declaring "ISIS Encryption Used By San Bernardino Shooters." Even that headline goes beyond anything else I've seen, since no one had specifically claimed "ISIS encryption." But then you read the full article and it doesn't either. Here's the entire discussion of the San Bernardino attackers in the first paragraph:

Lawmakers say the San Bernardino shooters may have used encrypted communications in an attempt to hide their activities. This type of encryption has been seen before, however.

The rest of the article deals with the FBI's new claims that one of the Garland, Texas, shooters used encryption, not the San Bernardino attackers. And then it just mentions that ISIS has its own form of encryption at the end of the article, never tying it back to the San Bernardino attackers. A headline like that seems like journalistic malpractice.

Thankfully, Joshua Koopstein at Vice's Motherboard throws some cold water on this kind of idiocy, noting that every phone these days has some "built-in encryption" and that the press running with this story are being ridiculous.

As many in the security world quickly pointed out, the claim is both vague and nonsensical: Every phone and computing device currently sold in the US has “levels of built-in encryption.” If they didn't, criminals would still be able to easily intercept your calls when your phone connects to a cell tower, and a common thief who steals your device would get access to your bank account info, login details, pictures, and any other sensitive data you stored on it.

In other words, saying you found “built-in encryption” in a modern cellphone is about as meaningful as saying you found a battery and a touchscreen.

And, even more on point, Marcy Wheeler points out that "encryption" has just become law enforcement and the intelligence community's buzzword of choice for "failing to achieve omniscience."

But this is the second attack in a row, with Paris, where Burr and others have suggested that their lack of foreknowledge of the attack makes it probable the planners used encryption. Burr doesn’t even seem to be considering a number of other things, such as good operational security, languages, and metadata failures might lead the IC to miss warning signs, even assuming they’re collecting everything (there should have been no legal limits to their ability to collect on Malik).

We’re not having a debate about encryption anymore. We’re debating making the Internet less secure to excuse the IC’s less-than-perfect-omniscience.

Indeed, that's why we pointed out that the Paris attacks were an intelligence failure, not an encryption problem. And it explains why the law enforcement and intelligence communities are so quick to blame encryption. They don't want people looking back at their own failures, so they might as well blame the technology.

But, really, none of that really matters in the long run. There certainly will be attacks where encryption is used for planning -- why wouldn't there be? But the debate shouldn't be about that so much as looking at the overall setup of the world and computer security. And the simple fact is that more people are made safer by the widespread adoption of encryption than are made safer by undermining that encryption to let the FBI peek in on your communications.

Filed Under: encryption, journalism, san bernardino attacks

AP's Ted Bridis Fact Checks His Own Bogus Claims, Now Being Repeated By Others, Admitting They're False

from the wait,-what? dept

Earlier this week, we wrote about an absolutely ridiculous Associated Press story by reporter Ted Bridis, claiming that law enforcement investigating the San Bernardino shootings are being somehow held back because of the close of the NSA's Section 215 phone records program. There were all sorts of problems with that story, so it's great to see the Associated Press ask one of its enterprising young reporters -- a guy who goes by the name Ted Bridis -- to do a "fact check" piece on Republican Presidential candidates who are now repeating the very claims that Bridis himself made earlier in the week.

This "other" Ted Bridis (along with Ken Dilanian) suddenly notices that the claims that Ted Bridis of earlier this week reported are magically false when repeated by others:

In the wake of the California shootings, Republican presidential candidates Marco Rubio, Jeb Bush, Chris Christie and Lindsey Graham are complaining that U.S. intelligence agencies have lost their authority to collect phone records on Americans under a controversial National Security Agency surveillance program. They want the government to bring that program back.

All four candidates have overstated their case.

Their comments fail to acknowledge key provisions of a new U.S. law. While the new law ended the bulk collection of phone records, it still allows the government to obtain records on a case-by-case basis with court approval.

The new "fact check" piece even admits that Rubio, at the very least, cited Bridis' earlier report, but then tries to pretend he just didn't read it right. Except that's bullshit. The problem was with the article, which had a giant headline reading: "California terror investigators can't view NSA phone records" and includes ominous descriptions like the following:

Under a shutdown order by the Foreign Intelligence Surveillance Court, the government was prohibited from collecting phone records in wholesale ways starting Nov. 29.

"After November 28, 2015, no access to the BR (business record) metadata (phone records) will be permitted for intelligence analysis purposes," U.S. District Judge Michael W. Mosman of Portland ruled. "Hence, queries of the BR metadata for the purpose of obtaining foreign intelligence information will no longer be permitted."

The California shootings happened four days later. The court revealed the order publicly just hours before the shootings.

The clear -- but totally bullshit -- implications of this are that the shutting down of the Section 215 records collection somehow harms the investigation. To then come back a day or so later and pretend that politicians running with this clear implication of your own article are somehow the ones to be shamed is pretty ridiculous.

Filed Under: fact check, journalism, nsa, san bernardino attacks, section 215, surveillance, ted birdis
Companies: associated press