Apple v FBI

[Texas Proud]

I just want to point out to the people talking about getting info from other phones to stop some terrorist plot.... this is a strawman in this context.

The reports say that after Apple unlocks the phone they can destroy the code that is necessary to get in.... so the ability would not be there in time to stop a plot... unless of course they are lying about what they want...

 

[NW-Bound]

M. Paquette, to get to the heart of your question: The older I become, the more I desire that the government spend big money on the prevention of embarrassing leaks. I am certain that I am also speaking for many other older Americans, both men and women, whom wish to reclaim at least some portion of their dignity.

Nice argument there my friend redduck, but you are not speaking on my behalf, I would like to add.

 

[explanade]

It's craven because the FBI and other agencies would be trying to deflect blame from their failures to smart phone makers.

The past couple of years they've been pushing this propaganda about needing encryption back doors to keep the children safe. So pure demogoguery.

Gee when there's a shooting spree, nobody blames the gun makers or the NRA. Guns kill, smart phones do not.

 

[harley]

Gee when there's a shooting spree, nobody blames the gun makers or the NRA. Guns kill, smart phones do not.

While I agree with your main point, I would like to point out that tons of people blame the NRA and gun makers. Luckily, ineffectively so far.

 

[MichaelB]

How about we leave guns and the NRA out of this, eh?

 

[explanade]

Well the FBI and other agencies chose to put the onus on the maker of information and communication devices, rather than on the makers of weapons which greatly facilitates the upping of fatalities in these situations.

 

[Chuckanut]

FWIW, I heard a security expert state that iPhones have a safe guard built into them to prevent being attacked via an altered version of the OS or use of an older more vulnerable version of the OS.

Every iPhone has a unique key that Apple keeps stored away. It's not part of an algorithm that can be figured out, so, in theory, Apple could possibly maybe find a way to get into a unique phone while not creating anything that would threaten the security of all iPhones [-]If[/-] when it gets out into the wild.

 

[M Paquette]

FWIW, I heard a security expert state that iPhones have a safe guard built into them to prevent being attacked via an altered version of the OS or use of an older more vulnerable version of the OS.

Every iPhone has a unique key that Apple keeps stored away. It's not part of an algorithm that can be figured out, so, in theory, Apple could possibly maybe find a way to get into a unique phone while not creating anything that would threaten the security of all iPhones [-]If[/-] when it gets out into the wild.

Alas, this won't be a 'one and done' sort of thing.

Customer Letter - FAQ - Apple

Law enforcement agents around the country have already said they have hundreds of iPhones they want Apple to unlock if the FBI wins this case. In the physical world, it would be the equivalent of a master key, capable of opening hundreds of millions of locks. Of course, Apple would do our best to protect that key, but in a world where all of our data is under constant threat, it would be relentlessly attacked by hackers and cybercriminals.

This becomes a set of full time jobs at Apple opening locked phones for every law enforcement officer able to rub case law and a magistrate together.

 

[NW-Bound]

Apple can set up a secure computer room for this purpose, the same as the DoD or its contractors use for classified data processing. Then, they can charge good money for unlocking phones captured from criminals, and make some money doing it.

Note that this kind of unlocking is forensic work after a criminal or suspect has been apprehended, not something that a FBI agent is going to do out in the field to snoop on innocent people in real time.

About leaking the code, I am sure that software houses like Microsoft and Apple would know how to protect their source codes, as they have been doing it all these years to keep proprietary software from falling into competitors' hand. And here, the forensic lab involves even fewer people, unlike production software.

 

[samclem]

Apple has complied with these legal requests to bypass the lock on iPhones many times in the past (about 70 times, according to this NPR report). Apple designed security features that are more difficult to bypass in their newer iPhones (using iOS9), and they'd need to come up with new software/procedures to allow them to do the same thing for their iOS9 phones as they've done before, but they aren't claiming they can't do it.

The argument that another government (China, etc) might ask Apple to unlock an iOS9 phone if they do it for the USG, and that this is a reason not to assist in this US investigation, appears fairly weak. Another government could demand that Apple do that anyway, and refuse to allow Apple to sell phones in those countries if they won't comply.

The argument that Apple shouldn't assist in this case because that will just unleash a flood of questionable requests from other US authorities seems to ignore the fact that these agencies have already been requesting this assistance for years and Apple has been providing it without any apparent abuses or difficulties.

Apple is not being asked to add a new back door to their phones or anything that will make them easier to hack. They are being ordered to provide technical assistance in a lawful US investigation. If Apple develops a technical means to bypass the security measures that they have engineered into their phones/OS, presumably they will have a darn good business reason to keep those tools/methods well secured. Apple has all kinds of sensitive data already (their proprietary source code, customer financial data, etc), keeping this new software and procedures secure would require the same measures they already use to protect this other information.

As a practical matter, dissidents, criminals, terrorists, or just common citizens who want to communicate without being observed by a government probably shouldn't depend on Apple or any other corporation to protect their secrets against requests by these governments ("good" governments or "bad" governments).

IMO, Apple is using this as a marketing opportunity. If they prevail, they have proven themselves to be champions of privacy (never mind their past actions). If they lose, they get to say that they are assisting only after fighting the good fight.

For comparison/background, here's a fairly concise summary of the types of information Google supplies to US authorities under various circumstances. There's nothing unusual about US companies being compelled to assist in lawful investigations. The degree of assistance requested in the case of Apple and the Farook investigation may be unusual, but that's what it is--just a matter of degree, not new legal ground.

Apple is not being asked to help the US government oppress citizens or illegally spy on people. They are being asked to assist the FBI in getting information off a government-owned phone (County of San Bernardino) as part of a legitimate criminal investigation. There may be other future cases where their similar assistance keeps innocent people put of jail, prevents future crimes, etc.

 

[Texas Proud]

Samclean...

I saw a few people on the cable channels talking about this and there was one with a former FBI agent and someone else... both indicated that it IS new or different legal grounds...


I cannot say for sure, but because most people talking are saying it is going to the Supreme Court no matter what the lower courts say would indicate it is different.... if it were settled law it would not go that far...

 

[samclem]

I saw a few people on the cable channels talking about this and there was one with a former FBI agent and someone else... both indicated that it IS new or different legal grounds...

As I understand it, Apple's contention is that the All Writs Act, which has been the legal justification for previous instances in which Apple (and other) tech companies have been compelled to provide assistance for many years, is not a sufficient justification for this activity. If I've got that right, there's no new law or a new technical wrinkle, it's just that the Apple is now objecting to the existing law and the traditional interpretation of it.
If the SCOTUS rules on the case, we'll possibly have clarification on this point. The government will have an opportunity to defend their position (citing previous courts' upholding of this interpretation of the All Writs Act, as well as a host of other laws that support their position).

Apple has been building these communication devices for years, and this need to assist authorities in legitimate investigations is just part of that business. Apple has accepted that until now, they've bypassed the locks on scores of iPhones at the request of authorities. They have now decided, for whatever reason, that it's a part of their business that they no longer want to do. It seems to me that the only ways they can rid themselves of it are:
-- Get a judge to say they don't have to do it anymore. That's what they are trying to do now. It's the cheapest approach and probably worth a try from their perspective.
-- Stop making these devices
-- Make devices that cannot be unlocked/cracked by anybody (including Apple)--some type of quantum-based encryption, etc. This is the holy grail of cryptographers and Apple isn't likely to succeed where others have not. But if they could do it, Apple would just say that what the government is asking is impossible.
-- Make devices with security features that are strong and which Apple has no technical advantage over anybody else in unlocking. Apple is being compelled to assist because they have technical experience and unique knowledge of their proprietary OS that allows them to make the information on a phone (clear text or encrypted) available to investigators. If, instead, Apple's phones relied on software/encryption entirely external to the phone and Apple's unique areas of proprietary expertise, then the government has no case to compel Apple to assist--because Apple would not be in an advantageous position to provide assistance. For example, if Apple's phone just enables the user to access a public-key infrastructure network, the data is kept on the phone in an encrypted state, and knowledge of Apple's OS provided no advantage in accessing or decrypting the data or accessing the keys, then the government has no standing to single out Apple to provide investigatory assistance. I would think this is the best route for Apple to go, if they want to be "clean" of assisting authorities.

 

[karen1972]

All telecom companies have discussions with FBI at some point in their production. There are CALEA laws that enable taps of the equipment and include ability to unencrypt data during real-time, capturing data/messages/voice, etc. Some of it can be done, some of it can't be done. However, when they wanted this technology embedded in the software, congress had to pass laws and the govt paid the companies for the millions of dollars of development done. Different countries do it differently, but its all written into law and every telecom complies, so no secret, no special treatment, and its open so everyone knows what is being asked.

I'm on Apple's side, this warrant is above and beyond anything that would be expected. Breaking any security is a bad precedence and writing special software for the government is also something I'm not comfortable with. And it leads Apple open to being asked for special software for other governments which is even scarier.

I'm more concerned about how much this conversation has taken over the story. Ie what have they found and why is this the center of the conversation as I can't believe this phone data is the center of all investigation. These people had facebook accounts, email, phone records,etc... certainly more info would be found in those records that on the phone.

 

[samclem]

FWIW, Bill Gates has sided with the government on this issue:

In an interview with the Financial Times, Gates took the position of the government, denying the case would set a precedent. "This is a specific case where the government is asking for access to information. They are not asking for some general thing, they are asking for a particular case," the newspaper quotes Gates as saying.
"It is no different than [the question of] should anybody ever have been able to tell the phone company to get information, should anybody be able to get at bank records," Gates continued. "Let's say the bank had tied a ribbon round the disk drive and said 'don't make me cut this ribbon because you'll make me cut it many times."'

 

[MichaelB]

FWIW, Bill Gates has sided with the government on this issue:

This does not surprise me. One of the innovations MS brought to the PC world was enabling SW providers and third parties alike to download and store code and files on your computer to change, extract and communicate information about your computer and browsing (on a large scale), all without your knowledge or consent.

 

[samclem]

This does not surprise me.

Oh, I'm no fan of MS, and I don't think having Bill onboard necessarily bolsters the government's position. I was just getting the bad news out there in the spirit of full disclosure . . .

 

[MichaelB]

Oh, I'm no fan of MS, and I don't think having Bill onboard necessarily bolsters the government's position. I was just getting the bad news out there in the spirit of full disclosure . . .

Got that, it needed to be posted. Just getting in my $0.02.

Despite my personal opinion, I think he has credibility in this area and deserves to be heard. Besides, the nature of privacy may have changed with the introduction of the information era, and my views old-fashioned and out of date.

 

[CRLLS]

I've been following this issue the last few days. I generally side on Apple's side. And I really hate to say that. I'm not what you might call an Apple fan. I have but 3, unrelated comments/questions. 1) I have lost all confidence in the FBI if their people cannot break into the iPhone, 2) Why haven't we heard of this "bricking" issue before? I would think that some high school pranks or would have been played already or ex-spouse vengeance actions. (maybe but I haven't heard of them), and 3) I think the SCOTUS would be locked 4-4 on this issue until we get a new Justice. That would mean the lower court decision stands.

 

[ERD50]

<strikeout is my 'edit':

...
-- Make devices that cannot be unlocked/cracked by anybody (including Apple)--[-]some type of quantum-based encryption, etc. This is the holy grail of cryptographers and Apple isn't likely to succeed where others have not.[/-] But if they could do it, Apple would just say that what the government is asking is impossible.
-- ....

I'm pretty sure that making a device that even Apple could not unlock is not really that hard at all.

From what I recall from working with some products that were going to use Intel's 'Secure Boot' system (this was > 10 years ago, but even those concepts were around for a long time, and are probably still the basis for what is used today), some digital keys are generated at first power on, and each active component has to develop a 'handshake' based on these keys (in the most secure methods, without actually exposing the keys themselves).

If Apple were to just throw away those initial keys, which are pseudo-randomly generated, I'm pretty sure that even Apple could not get in (unless they programmed in a special 'back door' - which they claim they do not want to do anyhow).

But this might also mean that even Apple couldn't replace modules like the fingerprint sensor either? It has a unique ID. Maybe if they keep that ID, they can develop a replacement method that could remain secure w/o exposing the other, lower level keys, I dunno? But M Paquette has warned that a 'bad-guy-spy' fingerprint module might be able to access stuff in the phone, and if Apple has the FPR module ID's - that seems to leave a hole.

The physical equivalent would be a safe maker that is able to create a "master" combination for a line of safes, in addition to a unique combination code for the user. If the customer (say a business, buying a large order of the same safes) does not want the master combo option, the manufacturer, rather than redesigning their safes, could just program the master randomly for each safe in that order, and then destroy any evidence of the alternate combo code - better yet, never have any actual record of that code, so there is nothing to destroy. You could ask the safe mfg to break in, but they would not have any better luck than anyone else.

-ERD50

 

[ERD50]

... 1) I have lost all confidence in the FBI if their people cannot break into the iPhone, ...

No, it isn't a lack of skills on the FBI's part - security methods are extremely advanced these days. Devices are built with these security features designed into the very hearts of the silicon, it isn't just tacked on. It's part of their DNA, in effect. The device is a closed HW/SW system - It's way different from hacking an internet password (a much more open system).

2) Why haven't we heard of this "bricking" issue before?

The 'bricking issue' (error53) didn't exist until users upgraded to the new software, and then only if the software detected a problem with the finger print module (like if it was replaced by a third party, who did not have the capability of reprogramming the original ID#s into it). Or in some cases, if the FPR was defective (but still functioned as a basic 'HOME" button).

At first, Apple (and some posters here) insisted this was required to keep the phone secure. Apple later admitted it was unintended, and updated the SW so that a non-secure FPR was just ignored, rather than totally locking the phone. This fixed the 'bricking'.

-ERD50

 

[kcowan]

Despite my personal opinion, I think he has credibility in this area and deserves to be heard. Besides, the nature of privacy may have changed with the introduction of the information era, and my views old-fashioned and out of date.

I would guess that the ability to make financial money movements by relying on the device security features "might" make a difference. With a PC it was up to the secure site to protect the clients.

Apple seems to have decided to take the responsibility off the site operators (through fingerprint recognition as an example.).

 

[CRLLS]

The 'bricking issue' (error53) didn't exist until users upgraded to the new software,

Sorry if I was not clear. I meant making the iPhone useless and wiped after 10 password tries. As in, what the FBI is wanting to get past in this phone.

 

[ERD50]

Sorry if I was not clear. I meant making the iPhone useless and wiped after 10 password tries. As in, what the FBI is wanting to get past in this phone.

It might be a fairly recent thing (not sure which IOS versions this applies to), and it is an option, not default:

https://support.apple.com/en-gb/HT204060

Change your passcode or passcode settings

To change your passcode or passcode settings, go to Settings > Touch ID & Passcode. On devices without Touch ID, go to Settings > Passcode.


....

Erase Data: Choose whether to erase your device automatically after ten failed passcode attempts.

-ERD50

 

[NW-Bound]

Experimenting with a device with a self-destruct mode is not easy. When authorities capture a bomb, what do they do to disarm it? Most of the time, they just take it to a remote place and detonate it, although they would want to know how it was built. In this case, they want to keep it intact to get info.

 

[Texas Proud]

I've been following this issue the last few days. I generally side on Apple's side. And I really hate to say that. I'm not what you might call an Apple fan. I have but 3, unrelated comments/questions. 1) I have lost all confidence in the FBI if their people cannot break into the iPhone, 2) Why haven't we heard of this "bricking" issue before? I would think that some high school pranks or would have been played already or ex-spouse vengeance actions. (maybe but I haven't heard of them), and 3) I think the SCOTUS would be locked 4-4 on this issue until we get a new Justice. That would mean the lower court decision stands.

From what I hear about the SC, if they do decide 4-4 they can just shelve the case and wait for a 9th justice.... IOW, not decide it right now... I also do not think that the legal process can be fast enough where they would hear it this year anyhow... lower courts and appeals can take awhile...