Judge forces Apple to unlock iPhone

[Kwatt]

Yes. Honestly, with what I'm sure are big contracts on government purchases of phones, I don't know how this has apparently not been addressed in some fashion already.

As far as I am concerned the owner should be able to access their own equipment. That is how it has been for every company I have worked for.

That should be worked out with the phone manufacture in advance.


.

 

[CZroe]

From what I read this phone is an earlier device without Secure Enclave, like their newest models, so what Apple is being asked to do is nothing new as evidenced by the seventy times they have done it in the past for earlier models. This isn't about their newest model with SE, nor are they being asked to circumvent encryption.

They are just being asked to remove the 10 pass attempt limit.

"Secure Enclave" isn't even part of the phone's data. That's part of the TouchID component. Just because the phone doesn't have TouchID doesn't mean it isn't running the latest security from iOS that encrypts the file system by default.

 

[Darwin333]

My ideal scenario is Apple/gov would use encryption on government phones, entirely separate from civilian products, that specifically wouldn't need to be cracked by law enforcement because they'd have access available to them that's just a warrant away to begin with. Does anyone arguing against Apple stepping in here really want government phones used by government employees/officials for government business to be one password change away from the reach of the courts and law enforcement?

Your ideal scenario would be that only the .gov could have products that have secure encryption?

Why not make it much easier and have Congress pass a law that outlaws any encryption that the government can't crack or have some sort of "backdoor" to? Again, why not have .gov cameras installed in everyones home that they promise only to access if you commit a crime?

If you have nothing to hide then whats the problem?

 

[Victorian Gray]

From this ABC story linked earlier:

http://abcnews.go.com/US/san-bernar...passcode-changed-government/story?id=37066070

"The Justice Department acknowledged in its court filing that the password of Syed Farook's iCloud account had been reset. The filing states, "the owner [San Bernardino County Department of Public Health], in an attempt to gain access to some information in the hours after the attack, was able to reset the password remotely, but that had the effect of eliminating the possibility of an auto-backup."

and

"The auto reset was executed by a county information technology employee, according to a federal official. Federal investigators only found out about the reset after it had occurred and that the county employee acted on his own, not on the orders of federal authorities, the source said."

It's now been claimed that the FBI requested that the password be changed:

"The San Bernardino County government on Friday night said the FBI told its staff to tamper with the Apple account of Syed Farook""The development matters because the change made to the account – a reset of Farook’s iCloud password – made it impossible to see if there was another way to get access to data on the shooter’s iPhone without taking Apple to court.

“The county was working cooperatively with the FBI when it reset the iCloud password at the FBI’s request,” read a post on San Bernardino County’s official Twitter account."
http://www.theguardian.com/technology/2016/feb/20/san-bernadino-county-fbi-gunman-apple-account

A case of the FBI getting just a bit too 'cute' and now getting caught at it?

 

[bozack]

From this ABC story linked earlier:

http://abcnews.go.com/US/san-bernar...passcode-changed-government/story?id=37066070

"The Justice Department acknowledged in its court filing that the password of Syed Farook's iCloud account had been reset. The filing states, "the owner [San Bernardino County Department of Public Health], in an attempt to gain access to some information in the hours after the attack, was able to reset the password remotely, but that had the effect of eliminating the possibility of an auto-backup."

and

"The auto reset was executed by a county information technology employee, according to a federal official. Federal investigators only found out about the reset after it had occurred and that the county employee acted on his own, not on the orders of federal authorities, the source said."

It's now been claimed that the FBI requested that the password be changed:

"The San Bernardino County government on Friday night said the FBI told its staff to tamper with the Apple account of Syed Farook""The development matters because the change made to the account – a reset of Farook’s iCloud password – made it impossible to see if there was another way to get access to data on the shooter’s iPhone without taking Apple to court.

“The county was working cooperatively with the FBI when it reset the iCloud password at the FBI’s request,” read a post on San Bernardino County’s official Twitter account."
http://www.theguardian.com/technology/2016/feb/20/san-bernadino-county-fbi-gunman-apple-account

A case of the FBI getting just a bit too 'cute' and now getting caught at it?

Thats reaching, sounds like either one of them is in CYA mode, find it hard to believe the FBI would instruct them to do that instead of having their techs do it themselves...if in that position I wouldnt want some county IT guy touching that thing.

 

[bozack]

So Apple loads the new firmware onto said iPhone. Then they give the FBI the handset with the new/special firmware loaded? Meaning Apple gets to keep this new firmware, only they don't?

From what I have read in the past phones were sent to Apple, they would then unlock them and copy the relevant data on to external media, and then only send the media back to the Feds.

 

[bozack]

Did they have to develop entirely new software by order of the government in the past or did they use tools/software that they already had in order to comply? There is a huge difference between the two. Hell even if they voluntarily worked for the government and did develop new software in the past unless they are contractually bound to continue working for them they have the power to decline. I have ran many construction projects for the .gov before but that doesn't mean they can force me to work on their next project. I completed my contractual requirements and as such they can no longer compel me to do additional work for them on a separate project. They can entice me by offering me more money but they have no legal basis to force me.

It's like the government compelling a lock manufacturer to give them specific details on a specific lock, like the key code or it's design so they can hire a locksmith to exploit the vulnerabilities versus compelling the same lock manufacturer to design and make a master key that will unlock all of the locks they make. In the former they are demanding something that already exists and in the latter they are demanding the company to design and produce something that does not exist which is literally forced labor. Forced labor was abolished when the Thirteenth amendment was ratified and adopted. Its irrelevant how many times the company previously helped the .gov. They are allowed to hire Apple, or any other company, to develop new software but using the force of law to compel them to do so is, and should remain, beyond the scope of the judicial systems power.

From what I have read Apple developed a mechanism to disable the pass code entirely but now are reluctant to do so as it would seriously impact them financially given they have put so much into the marketing around the security of their products.

And who is to say Apple doesn't already have this developed and in use for development/testing....you're assuming they are being honest whereas others can assume that might not be entirely true....

It will be interesting to see how the courts rule on this but I still feel Apple weakened their position by assisting in the past.

 

[lopri]

Forcing someone to develop and produce a product that does not exist against their will by force of law is the very definition of involuntary servitude. Unless of course Apple has been convicted of some related crime that I am not aware of?

I do not know where to begin to answer this. How about a simple truth that Apple is not "forced" to do business in the United States, for starters?

And while there are no Fourth amendment issues with this particular case you are foolish if you think that it doesn't have future implications. It would be akin to the government requiring cameras that they have access to in everyones house but they promise to only turn them on after you have been accused of a crime. You may trust them with that kind of power but I sure as hell don't and history has shown time and time again that they will abuse it. Regardless of the Fourth amendment concerns which I am sure you will argue, how do you circumvent the Thirteenth?

I do not trust the government. I argued in the past that we were giving up to much liberty interests to terrorism. There were lively discussions here and elsewhere, but the bottom line is that American people chose to live with the surveillance at the cost of their liberty. If Americans thought otherwise, Patriot Act would have been repealed; NSA would have been defunded; Edward Snowden would not have had to flee; FISA court would have been shut down and the judges who wrote secrete opinions would have been impeached; Guantanamo Bay would have been a history. The list goes on.

When it comes to security and privacy, the question comes down to where we draw the line. It is a compromise, and we redraw the line as needed. There will never be an absolute line. (the 4th Amendment speaks of reasonableness) The hypo you imagine is, in some circumstances, already a reality; All cars sold in the U.S. must be equipped with GPS, and the government can monitor the GPS with court-issued warrants, thus tracking the movement of the drivers. But I highly doubt we will have to wear cameras in our homes anytime soon, if ever. Why? Because I am confident Americans will not tolerate such a law and its enforcement.

So the situation in which I find myself is not something I hoped, but it nevertheless is what my fellow citizens decided in an ongoing debate in which I participate. I continue to advocate for greater privacy against government's watchful eyes, like you do.

None of this gives Apple a privilege to be exempt from the laws that you and I are subject to. And I trust Apple even less than the government. Case laws dictate that those who facilitate crimes, even if they are not guilty themselves, are are required to produce evidences as necessary. This is why there is no "Swiss bank" in the United States.

The power conferred by the Act extends, under appropriate circumstances, to persons who (though not parties to the original action or engaged in wrongdoing) are in a position to frustrate the implementation of a court order or the proper administration of justice.

https://supreme.justia.com/cases/federal/us/434/159/

P.S. Again, I really am not sure if you are serious about your slavery argument.

 

[Jaskalas]

Still don't hear anyone realizing that our government can crack that phone themselves. Surely with physical possession you can break open the phone, separate the data from the hardware, and use your own VM to bypass brute force protection.

It'd be in everyone's best interests if they stopped f'ing around and developed a process for doing that.

 

[Nebor]

Still don't hear anyone realizing that our government can crack that phone themselves. Surely with physical possession you can break open the phone, separate the data from the hardware, and use your own VM to bypass brute force protection.

It'd be in everyone's best interests if they stopped f'ing around and developed a process for doing that.

Already covered earlier in the thread.

 

[K1052]

From what I have read Apple developed a mechanism to disable the pass code entirely but now are reluctant to do so as it would seriously impact them financially given they have put so much into the marketing around the security of their products.

And who is to say Apple doesn't already have this developed and in use for development/testing....you're assuming they are being honest whereas others can assume that might not be entirely true....

It will be interesting to see how the courts rule on this but I still feel Apple weakened their position by assisting in the past.

No, they had tools that could pull unencrypted info off of older devices. They told the feds that these would no longer work with newer versions of iOS. Also they handed over iCloud data when required (since they possessed it). I can't think why they would develop such a specific tool to circumvent the security they just added and think it's highly unlikely that they did.

The FBI and other law enforcement agencies have been stymied by the increasing level of security on Apple's devices. This case is their strongest bid yet to start disassembling that for the government's benefit. I think Apple has a strong argument from the code is protected first amendment speech perspective but this is going to head all the way to the top.

 

[bozack]

Gotta love articles like this and the way things work when it comes to the blame game...

So the iphone hadn't backed up in months, and the county suggested to the FBI that they could get access to data if they reset the icloud password, the FBI ok'd them to go ahead and now that is completely on the FBI's shoulders...

http://www.msn.com/en-us/news/us/fb...ter’s-phone-backup/ar-BBpKLye?ocid=spartandhp

 

[Kwatt]

Starting to sound like a case of:

READY FIRE AIM !

.

 

[Gonad the Barbarian]

Your ideal scenario would be that only the .gov could have products that have secure encryption?

No, reread what I wrote, and maybe take a calming deep breath first.

 

[waggy]

From this ABC story linked earlier:

http://abcnews.go.com/US/san-bernar...passcode-changed-government/story?id=37066070

"The Justice Department acknowledged in its court filing that the password of Syed Farook's iCloud account had been reset. The filing states, "the owner [San Bernardino County Department of Public Health], in an attempt to gain access to some information in the hours after the attack, was able to reset the password remotely, but that had the effect of eliminating the possibility of an auto-backup."

and

"The auto reset was executed by a county information technology employee, according to a federal official. Federal investigators only found out about the reset after it had occurred and that the county employee acted on his own, not on the orders of federal authorities, the source said."

It's now been claimed that the FBI requested that the password be changed:

"The San Bernardino County government on Friday night said the FBI told its staff to tamper with the Apple account of Syed Farook""The development matters because the change made to the account – a reset of Farook’s iCloud password – made it impossible to see if there was another way to get access to data on the shooter’s iPhone without taking Apple to court.

“The county was working cooperatively with the FBI when it reset the iCloud password at the FBI’s request,” read a post on San Bernardino County’s official Twitter account."
http://www.theguardian.com/technology/2016/feb/20/san-bernadino-county-fbi-gunman-apple-account

A case of the FBI getting just a bit too 'cute' and now getting caught at it?

this comes as no surprise. The whole password situation really made no sense.

 

[DCal430]

Apple position is 100% wrong. This was NOT a personal device, this was a government issued phone, and under California law all information on the phone is a public record. Apple is not being asked to hack into someone private information.

 

[CZroe]

Apple position is 100% wrong. This was NOT a personal device, this was a government issued phone, and under California law all information on the phone is a public record. Apple is not being asked to hack into someone private information.

Except that the hack would work on everyone's personal phones too. You can't break the security for just that one phone. You ARE asking them to break security on every phone.

 

[bozack]

Except that the hack would work on everyone's personal phones too. You can't break the security for just that one phone. You ARE asking them to break security on every phone.

actually try and read the request from the Justice department...I know its hard but still.

Putting my tinfoil hat on I wouldn't be surprised if Apple already had this developed or are in process of developing it now...furthermore the request clearly states that the solution be tied to this particular phone by hardware IDs and or be used by apple and controlled in their facility leaving it up to them to produce the data for the feds.

For Apple this is more about marketing than much else, would be very bad for them publicly to say our products are secure only to show everyone that yes Virginia they can work around their own security measures.

 

[LPCTech]

Apple position is 100% wrong. This was NOT a personal device, this was a government issued phone, and under California law all information on the phone is a public record. Apple is not being asked to hack into someone private information.

ah another person who likes to share their opinion but has no idea what they are talking about.

This is not about hacking a phone.

This is about whether or not the government can compel a corporation to create software that they dont already have so that the government can apply this backdoor to everyone.

And its already been shown that the FBI would have been able to get the info if not for their own incompetence OR willfull incompetence in ORDERING the county to change the password on the phone in order to create this situation.

I feel like the dumber and less informed the person is, the more interested they are in sharing their "opinion" with everyone.

 

[K1052]

actually try and read the request from the Justice department...I know its hard but still.

Putting my tinfoil hat on I wouldn't be surprised if Apple already had this developed or are in process of developing it now...furthermore the request clearly states that the solution be tied to this particular phone by hardware IDs and or be used by apple and controlled in their facility leaving it up to them to produce the data for the feds.

For Apple this is more about marketing than much else, would be very bad for them publicly to say our products are secure only to show everyone that yes Virginia they can work around their own security measures.

I still can't come up with a plausible reason Apple would develop this software which I can't conceive them needing at any point for their own purposes. In the absence of any proof their claim that they have not and would not write it in the normal corse of their business stands.

Just creating and signing the modified iOS presents a security risk from it's very existence. The fact that it would exist at all compromises product security.

 

[CZroe]

actually try and read the request from the Justice department...I know its hard but still.



Putting my tinfoil hat on I wouldn't be surprised if Apple already had this developed or are in process of developing it now...furthermore the request clearly states that the solution be tied to this particular phone by hardware IDs and or be used by apple and controlled in their facility leaving it up to them to produce the data for the feds.



For Apple this is more about marketing than much else, would be very bad for them publicly to say our products are secure only to show everyone that yes Virginia they can work around their own security measures.

I understand perfectly. Having it at all means they could be compelled to use it on other user's phones. Understand now? It is not acceptable when it was designed specifically to not be this way. It's why Lavabit shut down entirely: their entire service was offering communications that could not be intercepted and read. When the government tried to force them to put in a back door, it undermined EVERYTHING the service was intended to provide. In Apple's case it does not undermine everything but it does undermine a lot of the work they have done on securing their platform. Who knows how many man-hours and R&D dollars were spent on their current security model only to have people toss it on a legal whim.

 

[DCal430]

AGAIN,

The person who OWNS the phone, the person who the data belongs too, is NOT the shooter. It is the people, the county of San Bernardino. Apple is denying the information to the people who it rightfully belongs too. Most seem to think this is the shooters private phone and private information. It isn't, it a government phone, with information that belongs to the government.

So if I have 100,000 in bit coins stored on phone, and I forget my PW, should them mean I am SOL. No it shouldn't.

 

[Ichinisan]

AGAIN,

The person who OWNS the phone, the person who the data belongs too, is NOT the shooter. It is the people, the county of San Bernardino. Apple is denying the information to the people who it rightfully belongs too. Most seem to think this is the shooters private phone and private information. It isn't, it a government phone, with information that belongs to the government.

So if I have 100,000 in bit coins stored on phone, and I forget my PW, should them mean I am SOL. No it shouldn't.

If *I* use the security features of my phone, and then *I* get my self locked-out of it, then *I* have to wipe everything and start over. If *I* do all that, *I* cannot compel Apple to make something that gets *me* back into the existing data *my* phone. I cannot. Period.

 

[CZroe]

AGAIN,

The person who OWNS the phone, the person who the data belongs too, is NOT the shooter. It is the people, the county of San Bernardino. Apple is denying the information to the people who it rightfully belongs too. Most seem to think this is the shooters private phone and private information. It isn't, it a government phone, with information that belongs to the government.

So if I have 100,000 in bit coins stored on phone, and I forget my PW, should them mean I am SOL. No it shouldn't.

It does because that's kind of the point to the portability and securability of Bitcoin.

The fact that they would be breaking into a phone with data belonging to "the people" of San Bernardino is even more disturbing.

Go on digging this hole deeper. They wouldn't compromise security to help me recover the data off my own phone either, so who it belongs to is a silly point to make in the first place.

 

[Darwin333]

I do not know where to begin to answer this. How about a simple truth that Apple is not "forced" to do business in the United States, for starters?

Just because an entity does business in the United States does not mean you can force them to create a product that doesn't exist. I have managed many construction projects for the government but I am under no contractual obligation to do any work for them currently, should they be able to force me to work on a current project since I've done similar work for them before? Of course not, I can (and should) be able to tell them to pound sand if I so desire.

I do not trust the government. I argued in the past that we were giving up to much liberty interests to terrorism. There were lively discussions here and elsewhere, but the bottom line is that American people chose to live with the surveillance at the cost of their liberty. If Americans thought otherwise, Patriot Act would have been repealed; NSA would have been defunded; Edward Snowden would not have had to flee; FISA court would have been shut down and the judges who wrote secrete opinions would have been impeached; Guantanamo Bay would have been a history. The list goes on.

When it comes to security and privacy, the question comes down to where we draw the line. It is a compromise, and we redraw the line as needed. There will never be an absolute line. (the 4th Amendment speaks of reasonableness) The hypo you imagine is, in some circumstances, already a reality; All cars sold in the U.S. must be equipped with GPS, and the government can monitor the GPS with court-issued warrants, thus tracking the movement of the drivers. But I highly doubt we will have to wear cameras in our homes anytime soon, if ever. Why? Because I am confident Americans will not tolerate such a law and its enforcement.

And to date there is no law that requires software makers to include or provide backdoors to their encryption. Until such a law is passed by Congress I don't see how this is remotely legal and I'd still question the constitutionality of such a law. Since no such law exists that is a debate for another time.

So the situation in which I find myself is not something I hoped, but it nevertheless is what my fellow citizens decided in an ongoing debate in which I participate. I continue to advocate for greater privacy against government's watchful eyes, like you do.

None of this gives Apple a privilege to be exempt from the laws that you and I are subject to. And I trust Apple even less than the government. Case laws dictate that those who facilitate crimes, even if they are not guilty themselves, are are required to produce evidences as necessary. This is why there is no "Swiss bank" in the United States.

P.S. Again, I really am not sure if you are serious about your slavery argument.

Let's try a hypothetical, let's assume that there are two people that wrote the encryption code for IOS that the FBI wants to circumvent. These are the only two people in Apple's employ that can write the code that currently doesn't exist to comply with the FBI's request. Now let's assume that they quit Apple in protest and refuse to provide labor to circumvent the code. Does the government, in your opinion, have the power to throw those two people in jail until they agree to provide their labor to the government even though they are under no contractual obligation, have committed no crime nor has Congress, to date, passed a law that requires them to do so? If so, how is that not involuntary servitude which is expressly prohibited by the 13th amendment? If it's not involuntary servitude what exactly would you call the forcing of a person to provide their labor to the government against their will?

This would be a different story if the government could prove that Apple already developed the software and had it in their possession. I would argue that the case that you cited might work if the FBI writes the software themselves and then requires Apple's assistance to install it. In the case you cited the Feds wanted to install their own device onto existing infrastructure, everything that was "new", in this case a pen register, was provided by the Feds. Like my own personal example above, if they can force Apple to create something that doesn't exist why can't they force me to work on a future construction project? Also, does that "force" extend to the men on my crews that worked on previous .gov projects regardless if they are still my employees or not?

Another question, do you think that the Federal Government has the lawful ability to force Phil Zimmerman, the original author/developer of PGP, who no longer works on the PGP project to write and release an update that gives the FBI a backdoor to PGP? If so, what penalties do you think the government can impose if he doesn't comply? How many hours a day do you think they can, or should be able to, force him to work?