back to article Apple must help Feds unlock San Bernardino killer's iPhone – judge

Apple must assist the FBI in unlocking the passcode-protected encrypted iPhone belonging to one of the San Bernardino shooters in California. US magistrate Sheri Pym says Cupertino has to find a way to supply software that prevents the phone from automatically annihilating its user data when too many password attempts have …

Page:

  1. Anonymous Coward
    Anonymous Coward

    It's appalling that law enforcement types are having to get a court order to compel Apple to do this. A severe crime has been committed, and it should be a privilege for a company like Apple to help the investigation. Instead Apple seems to want to obstruct it.

    I wonder how obstructive they'd be if someone that Tim Cook was very fond of had been killed in the attack?

    Sooner or later companies like Apple, Facebook, etc are going to have to realise that their public image and reputation will ultimately depend on cooperation with law enforcement. For example, Facebook are now known as having hosted child porn without having done anything about it. That can't be something a certain new father called Zuckerberg is happy about.

    How big does a content hosting organisation like Facebook have to be for it to be able to avoid criminal responsibility for hosting such material? It would be crazy if no one at Facebook was prosecuted.

    Presumably Apple with their encrypted iCloud are probably hosting such material too, but have no way of knowing. That may change now. If they are forced to develop this tool for law enforcement it may be that they're going to be regularly exposed as having given offenders the means of committing their crimes. Now that's not going to look good in the papers.

    1. DryBones

      Really? I seem to recall a certain number of companies that were offering all sorts of goodies for exploting phones, surely one of them included device imaging. Then they could brute force it all they wanted. No?

      No latex finger trick? Surely they have the prints of the owner. If this is reality for the FBI / CIA / NSA, they're really not very good, are they?

      1. Mark 85

        Fingerprint won't work in this case. Apparently they tried it according to some spot reports on other sites. It needs the PIN.

        According CNN, they destroyed their personal phones and the hard drive from their computer hasn't been found. This phone was his work phone issued by the county.

        I'm a tad surprised that the county didn't put in a back door code into it since we put in a way to get into the company's encrypted PC's, phones, tablets, etc. if someone dies or terminates (voluntary or involuntary).

        1. Anonymous Coward
          Anonymous Coward

          I'm not surprised at all. I'm also not surprised at the court order being approved. Where it gets tricky is when this gets in front of the 9th Circuit Court of Appeals. Riverside is notoriously conservative while the 9th CCA is extremely liberal.

        2. werdsmith Silver badge

          Fingerprint won't work in this case. Apparently they tried it according to some spot reports on other sites. It needs the PIN.

          Fingerprint won't work simply because it's a 5C and doesn't have a fingerprint reader.

          1. Tom 13

            @werdsmith

            If it had a fingerprint reader would it necessarily work? Or to frame the question even more clearly: Do YOU trust fingerprint readers on mobes to work?

            I sure don't and I don't really keep anything on my phone that NEEDS protecting. Instead I use a PIN I can easily remember.

        3. Tom 13

          Re: his work phone issued by the county.

          I hadn't heard that. You're quite right, that makes this an even more interesting case.

          I work for a government agency and part of securing the phone is installing software that does allow the user to reset the PIN in case they forget it. Most of the time we in IT can't use that route because the reset is tied to the email of the person owning the phone, but in a case like this we could be authorized to change that password so we could perform the PIN reset. It's not entirely foolproof since the agency does allow people to use personal Apple ID accounts, but even then you should be able to find the appropriate account, get the court order to reset that password, then proceed with the PIN reset.

      2. NotArghGeeCee

        [Tin_Foil] Or possibly they are good, they have already cracked it, have the information they want, and are launching this lawsuit to make it look like use of Apple gear is safe-for-terrorists-so-go-right-ahead-and-use-it all-you-want-with-impunity(tm)[/Tin_Foil]

        1. Anonymous Coward
          Holmes

          Or possibly they are adequate, they cracked the sham crapto easily and quickly, have the information they want, have completed the resultant investigations and are launching this lawsuit to make the data they've been using admissible as evidence against those it implicates - without broadcasting the reality of their decraption methods to the world.

          Like the little brother of their parallel construction policy - only the methods faked and they'll actually present genuine data. Would be something of an improvement, wouldn't it?

          1. tom dial Silver badge

            The police may need to have a warrant in order to use any search products as evidence in a prosecution, although there may be uncertainty about whom it should be directed to. But Apple does not own the phone, so assistance they provide in searching the phone probably is not relevant to admissibility of anything obtained as evidence. However, they may want to be seen as properly guarding customer data and have insisted on being compelled to assist. This may benefit the government as well by leaving it somewhat uncertain whether they actually have the ability to break encryption on phone data, and if they can, how quickly.

            This has nothing to do with parallel construction as sometimes has been used to obscure use of foreign intelligence information to obtain warrants.

        2. Spleenmeister

          Quite the opposite, I suspect. They are using a false-flag attack to finally get Crapple to release the keys to the (encryption) kingdom on iPhone. Mainly so they can rifle through everyone's phones, at will, for anything they damn well please. No tin foil necessary. It's happening along with plenty of other shenanigans commonly cited as "tin foil" worthy.

      3. CapnBob

        If the 5c had a fingerprint reader that might even work.

    2. Eddy Ito

      Why shouldn't law enforcement have to follow the rule of law and get a court order? Is there some magical level of crime that automatically eliminates proper procedures we require law enforcement to undergo? Who gets to draw the line that says if the crime is "X" bad LEOs can do whatever they damn well please to get information? How long do you think it will be before that line moves far enough to make the Stasi look like reasonable folk?

      1. LucreLout

        @Eddy Ito

        Why shouldn't law enforcement have to follow the rule of law and get a court order?

        That's exactly what they have done. You may disagree with their being awarded access to the data, or not, but you can't argue they didn't follow the legal process via the courts.

        1. Eddy Ito

          @LucreLout

          I was not making any comment about what has transpired but responding to the OP's statement; which was

          It's appalling that law enforcement types are having to get a court order to compel Apple to do this.

    3. jonathanb Silver badge

      Other parts of the FBI want Apple to make it impossible to do this so that phones are useless when stolen, and therefore people don't steal them. If Apple can overcome their own security, anyone else can.

      1. David 138

        If someone stole you phone they would probably just wipe it and the encrypted data. Encryption gives most people little or no useful protection in this case. However it does benefit criminals. Apple are just protecting their marketing not their customers.

    4. Spleenmeister

      You are so missing the point it's funny. Never mind the myriad of reports from the scene while this tragedy was unfolding that point the finger of suspicion diametrically away from these two losers. Some people will believe anything, which is what US law enforcement and the US Govt depend on, I suppose.

      1. LucreLout

        @Spleenmeister

        You are so missing the point it's funny. Never mind the myriad of reports from the scene while this tragedy was unfolding that point the finger of suspicion diametrically away from these two losers.

        *yawn* another tin foil hatter; just what the web needs.

        Ok, I'll bite. One, just one, credible news agency reporting "from the scene while this tragedy was unfolding that point the finger of suspicion diametrically away" from the two dead losers. No? But then, there never is.

    5. Triggerfish

      @OP

      Because rather than them wanting just this information, they seems to be using it as an excuse to force password cracking on Apple phones so they can play around with all your information, possibly without warrants.

      As far as I am concerned Apple are doing the correct thing.

    6. Graham Cobb Silver badge

      ...it may be that they're going to be regularly exposed as having given offenders the means of committing their crimes. Now that's not going to look good in the papers.

      Why? It doesn't seem to do car companies, electricity companies, or grocery stores any problem that they are used by criminals as well as non-criminals. What makes you think it would be a problem for Apple?

  2. Anonymous Coward
    Anonymous Coward

    Squeal like a pig

    Don't the ruling classes squeal long and hard when they can't get something THEY want?

  3. Phil Kingston

    " This code must only work on Farook's phone, identified by its serial numbers, and no other handset."

    Gonna be hard to test then.

    1. Anonymous Coward
      Anonymous Coward

      This implies it is possible to reflash the phone without unlocking it first.

      Presumably this means you just power cycle, enter into the boot loader, and the boot loader will happily reflash firmware without any confirmation that you are the owner of the phone.

      I can understand why this is done - the main firmware may be non-functional and you need a reflash to fix it.

      However the fact that the boot loader is unaware of the locking/unlocking mechanism sounds like a weakness to me. The only protection you have is that the boot loader will only flash signed firmware. But what if you took someone's phone, and loaded an old version of firmware with known vulnerabilities?

      1. LucreLout
        Gimp

        @AC

        However the fact that the boot loader is unaware of the locking/unlocking mechanism sounds like a weakness to me. The only protection you have is that the boot loader will only flash signed firmware. But what if you took someone's phone, and loaded an old version of firmware with known vulnerabilities?

        But what if instead of all that you just hit them with a $5 wrench until they give you the code?

        https://xkcd.com/538/

        I'm not sure requiring unfettered physical access to something you can then break into counts as much of a weakness. It works for all physical world applications of security, from locks to safes etc.

        I'm no Apple fanboi, but I think if the only way to get in was with a court order and Apples help, I'd consider my phones security good enough.

        1. cantankerous swineherd

          the threat model here is a democracy under the rule of law. the xkcd threat model is of a fascist dictatorship or a bunch of gangsters, in which case all bets are off. hth. hand.

  4. Phil Kingston

    Correct me if I'm wrong, but isn't it a bad thing for the court to have published serial and IMEI numbers?

    Good to see some common-sense at the end of the court order though - which I read as, if they genuinely try but somehow stuff it up and the data goes bye-bye that's OK.

  5. ShadowDragon8685

    This is an absolutely chilling, apalling thing for a court to order.

    If this works, I hope and expect that their next step in the security of people's devices is "your device doesn't trust anyone, not even us, unless you tell it to." IE, no bypass, and some kind of tamper sensors that fry the phone completely if someone tries.

    I really, really hope that they either appeal it successfully, or (and this is unlikely, I admit,) take a principled stand, say "okay," and whatever they give the FBI is an uber-bricking nuke that completely melts the phone, and then tell the FBI to see them in court, before a jury of twelve.

    [e]Even if they lose the court case, any fine the FBI can levvy will be annihilated in the good press (and sales) resulting from making it clear that they will not under any circumstances comply with any outrageous demand to bypass the security on someone's phone.

    1. tom dial Silver badge

      It would be interesting to see an explanation of the rather extreme claim that "this is an absolutely chilling, apalling thing for a court to order." It is not materially different from a case in which a locksmith might be asked to assist in opening a safe to assist police in executing a search warrant.

      1. Robin

        "It is not materially different from a case in which a locksmith might be asked to assist in opening a safe to assist police in executing a search warrant."

        Isn't the analogy more like the feds asking a locksmith to provide a skeleton key that will open any safe? It's not like they're going to only use it this one time, once they have the facility.

        p.s.

        [After walking in unannounced to Dutch's office]

        Dutch Gunderson: Who are you and how did you get in here?

        Frank: I'm a locksmith. And, I'm a locksmith.

        1. D@v3

          @ Robin

          The way I understand it, from the article is that they want a tool that will only work with a device who's serial numbers match the one in their possession. Which, if they then wanted to use it on another phone, would require them going back to apple, with a new serial number, for them to create a new 'key'.

          With the locksmith analogy, to me, it is more like the police going into a locksmiths, with a safe, and the locksmith somehow making a new key from the inside of the lock. They can then use that key, to open that lock, but it won't do them any good with any other safes.

          Of course, what they say they want, and what they _actually_ want could well be very different things.

        2. tom dial Silver badge

          No, it is not asking for the logical equivalent of a skeletion or master key. It is asking for assistance to unlock exactly one phone. The appropriate analogy in the case of a locked safe is skilled assistance to circumvent a combination lock. If other posters who appear to know more than I about Apple's implementation are correct, the key depends in part on physical characteristics of the security module that are unique to each phone; there is no master key.

          It is true that the procedures, once developed, will be applicable in other cases, but law enforcement access, with a proper court order or warrant, to material in their physical possession is well within the scope of what we are used to and what was built into the US Constitution from its beginning.

      2. Anonymous Coward
        Anonymous Coward

        Explanation? Good luck with that

        "It would be interesting to see an explanation"

        The OP I'm afraid comes across as just another hysterical juvenile anti establishment SJW. Coherent arguments are not their strong point. In their deluded paranoid minds, The Man cracking a phone of a terrorist is morally equivalent to the actions carries out by that terrorist.

        1. cantankerous swineherd

          Re: Explanation? Good luck with that

          so the man's welcome to crack your phone?

          1. tom dial Silver badge

            Re: Explanation? Good luck with that

            With a warrant based on probable cause, oath or affirmation, and particularly describing what is to be obtained: yes.

            That is what we consent to under the Constitution and Bill of Rights, and is exactly what is being attempted in the case at hand.

      3. cantankerous swineherd

        the Chinese police compel a US company to break into a US device (eg that of the US ambassador that they found in a bar) on Chinese soil?

        1. Tom 13

          Re: US ambassador that they found in a bar

          Not very smart are you. The whole point of diplomatic immunity is you can't legally do anything to an ambassador. So it would actually be against international law for them to seize the phone in the first place.

          Try again.

      4. Captain Queeg

        I might be reading it differently but to me the claim stands on accessibility.

        Opening safes is a slow process - needing a trained locksmith each time or a and physical access at a physical location to a (comparatively) large static bulky object.

        Done the right way a backdoor could be blindingly fast, remotely deployed and can be more or less automated. Also, done correctly it would be invisible.

        Whatever the rights and wrongs of this one case, it's the thin end of the wedge that is chilling and appalling.

        1. ShadowDragon8685

          Exactly. Thank you. Each and every safe has to be opened, one-by-one. What they're asking Apple to do is either make, or go 95% to the way of making, a digital lightsaber that can open every safe with just a flick of the wrist.

      5. ShadowDragon8685

        Except it is. They are attempting to compel a locksmith who's staked his commercial claim in the unbreakability of his lock's security to provide them with a skeleton key which can open any of his locks. This will cause faith in his locks to take a nosedive, as there is no guarantee whatsoever that such a key, once known to be extant, will not fall into the hands of criminals, corporate competition, private malefactors and foreign intelligence services, all of whom will have vested interest in obtaining that key.

        And there is absolutely no way in hell to ensure that it will "run only on this guy's phone" and "only on Apple or FBI computers." Once a software weapon like this is created, it can be stolen, or recreated, by others.

    2. Anonymous Coward
      Anonymous Coward

      Apple has ALREADY taken that next step

      There's no bypass as of iOS 8 in Sept. 2014 - that's what has some in the government so whiny about Apple and encryption. They changed it so they don't hold the encryption key for a user's device, the only place it is stored is in the secure enclave in the phone. The only way that key can be accessed is via fingerprint (if you have that enabled) or via the password/passcode (depending on whether you use 4/6 digits or the full keyboard for an unlimited length password) Thus it is impossible for Apple to unlock, even with a special version of firmware installed on the phone.

      However, since OS updates control how many attempts you get to unlock it, they've found a loophole - compel Apple to provide them a one-off OS update that allows unlimited attempts - and I assume no delay between attempts, so they can make some poor first year agent get carpal tunnel trying 1,010,000 possible passcodes. They're lucky a password wasn't used instead, there's no brute forcing that.

      1. werdsmith Silver badge

        Re: Apple has ALREADY taken that next step

        so they can make some poor first year agent get carpal tunnel trying 1,010,000 possible passcodes.

        The FBI also want Apple to help implement a way to rapidly try different passcode combinations, to save tapping in each one manually

    3. rh587

      "This is an absolutely chilling, apalling thing for a court to order."

      No it isn't. It's the equivalent of the Feds identifying that the suspect has a safe deposit box, and getting a court order requiring the deposit company to hand it over, and render assistance in opening it (in the absence of the suspect's private key).

      For the Feds to go to a court and request this and for the courts to say "Yes, this is reasonable" is exactly how due process is supposed to work! Whether they're getting a court-signed warrant to search your house, a subpoena to compel a witness to appear in court, or a court-order for a telco to disclose your call history.

  6. Anonymous Coward
    Anonymous Coward

    Damned if you do?

    So Apple provide a back door, which I think they've previously denied is possible, and the TLA's demand it all the time, indeed, they demand it built in.

    Or.

    Apple cannot provide a back door and the TLAs howl all the way up to the highest levels about how unfair and downright dangerous it is to allow the population to have secure crypto and demand/get a ban on secure crypto.

    Don't ever forget, this is happening in a seriously fucked up country that has past history on attempting to force backdoored crypto and restricted the sale of encryption technologies as 'munitions'.

    1. Anonymous Coward
      Anonymous Coward

      Re: Damned if you do?

      Clearly the feds are going to get all the mileage they can out of this. Either "this is terrible because even in a major case like this we were unable to break Apple's encryption and access the phone" or "this is terrible because we had to go through a big hassle of getting a court order and the delay cost precious time".

      Hopefully Russ Feingold can take back the seat he lost in 2010 this fall, we need more guys like him and fewer CIA dupes from both parties like Diane Feinstein and Richard Burr who support laws requiring encryption backdoors.

  7. codebeard

    I wonder if the flash memory can simply be copied into an emulator that can rewind after every pin attempt? No need to write anything onto the firmware itself.

    Personally I think this is a reasonable request. If you "encrypt" your files with a 6 or so digit pin, that's more of an inconvenience than an actual attempt at security. For comparison, my password storage is encrypted with a random 25 character alpha + numeric + symbol password.

    6 digits = 20 bits (approximately)

    25 random characters = 155 bits (approximately)

    The latter would take 4 x 10⁴⁰ times longer to brute force.

    1. Anonymous Coward
      Anonymous Coward

      No

      The device key is actually stored in the secure enclave, which is essentially a tiny isolated computer on the SoC. If they removed the flash and copied its contents it doesn't help them, because it is encrypted with a 128 bit AES key that's unlocked via the 6 digit PIN not generated from it.

      I think if the terrorists went to the lengths of destroying their personal phones and hard drives, the fact a PIN instead of a real password was used on the work phone (and it wasn't destroyed along with everything else) means there is probably absolutely nothing useful on it.

      But that won't stop the FBI from using this as propaganda in their war against encryption.

      1. Anonymous Coward
        Anonymous Coward

        Re: No

        > If they removed the flash and copied its contents it doesn't help them, because it is encrypted with a 128 bit AES key...

        I wonder how much computing power you could crowdsource for the purpose of uncovering a group of mass murderers?

        Like the SETI thing was, but more of a search for murdering bastards rather than extra terrestrials.

        1. g e

          Re: No

          Search for

          Murderous

          Unwanted

          Gunmen

          ?

        2. Anonymous Coward
          Anonymous Coward

          Re: No

          > I wonder how much computing power you could crowdsource for the purpose of uncovering a group of mass murderers?

          Certainly not enough to try 2^127 key combinations in a feasible timescale.

          With 10 billion devices, *each* trying 10 billion keys per second, it would take about 54 billion years.

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like