Posts by tom dial

Re: I don't quite get it...

Stipulating that this is correct, because it almost certainly is, there are a few things those who argue this position should explain in some detail.

How does someone who has a copy install it on a stock iPhone? There appears to be difficulty involving code signing.

What prevents someone able to install such a break from creating it right now? It is likely there are thousands in the world with the necessary knowledge, skills, and maybe equipment. Hundreds of them will be in the US, and some of them will be on payrolls at the FBI, NSA, or a similar organization in another country.

If someone (not Apple) can create a package like what the US court has demanded, and someone else (also not Apple) can install it, is there a significant probability that they will get together?

Given plausible answers and corresponding success probability numbers, does the presumptive fact that the details of what Apple is supposed to provide will become known increase the total risk to iPhone security by a meaningful amount?

Re: One of the implications NO ONE want's to talk about

The answer to the first question is that companies probably could be required by law to provide for law enforcement access. In the US, based on the Constitution and over 200 years of additional history, using the legal authority would require a warrant based on probable cause and so on. Other nations would have other constraints (or not).

Second question: Maybe, like the first, but there would be no reason for law enforcement agencies to care about the details of the method.

Third: probably not, but they probably could be prohibited from selling noncompliant equipment and might find it in their interest to do so.

"NSA" here should be replaced by "the government" or something similar. The NSA is not a police agency and operates in a gray area where the applicability of US law depends on citizenship and location. The same would be true of similar agencies of other sovereign nations. A good deal of its activities are quite illegal somewhere, and they rely methods and techniques that go far beyond what Apple has been ordered to do. The FBI is a police agency, and its history includes instances of serious overstepping. However, J. Edgar Hoover has been dead for over 40 years and it might be time to cut them a wee bit of slack and not assume that their institutional goal involves routine and widespread infringement of civil rights. Their objective is to be able to access any iPhone for which they have a valid search warrant. That is an objective that they share with every other law enforcement agency in the country, and very likely the world, as problematic as that may be for some of them.

Re: Pew Research Center

That only a fraction of the population (and apparently quite a small one) is willing to participate in polls is a serious problem for those engaged in the business. It is difficult to be sure whether the willing and unwilling are alike enough that the willing can stand in for the others.

The sample size here was 1002 if I recall correctly, large enough for the results to be meaningful, and the results are so nearly uniform across the demographic classifications that nonresponse bias probably is not significant. It would be useful to those whose occupation includes design and analysis of surveys, to know the exact texts of the questions asked, but Pew has a decent reputation and it is reasonable to assume they were not biased beyond what follows from putting it in the context of "terrorist." It would be interesting if the survey were repeated with "terror*" substituted by something like "serious crime" possibly with a list of examples that covered more of the types of crime likely to lead to demands for search warrants against cell phones.

Recent elections (e. g., the last UK general election) have cast a lot of doubt on survey reliability, but in this case the only notable discriminator was (Republican-leaning-independent) vs (Democratic-leaning-independent). This may be understood best as a result of independents being less informed compared to other groups (both generally and on the specific issue) and deriving their expressed attitude from what they think are the likely opinions that go with their "leaning." (It is well documented that those describing themselves as independent are likely to be deficient in politically relevant knowledge compared to strong identifiers with any established political party).

Re: FUD and nonsense

@chris17: The article at Trail of Bits suggests that current Apple devices are vulnerable to similar, although different and somewhate more complcated, procedures.

I would not consider, and do not know personally any other programmer who would consider, making a moderate number of changes to a moderat number of OS modules to be "creating a new os" even though making single character change to a single module might, in a few contexts, be so described.

The FBI did not make this request to Apple, but to the US Attorney, who asked for and received an order from a US court. The procedure would be approximately the same for any other order from any other government agency, three-letter or not. For the NSA, it probably would have to come directly from the US Attorney General's office, and that might also be the case for DHS.

It should be possible to discuss the technical and legal issues around this without engaging in hyperbole and using loaded language, as both the FBI and Apple, as well as a great many of those who comment here and elsewhere have done. And that was my original point.

Re: FUD and nonsense

@ Charles9: A court could not order that (and expect not to be overturned rather quickly on appeal). Requiring design changes would require legislation, passage of which would be uncertain at best and subject to presidential veto and later court consideration as to constitutionality. A recent Pew poll result suggests it might be possible, but extrapolation of poll results to context different from the one in which they were obtained is very uncertain.

Re: FUD and nonsense

The FBI almost surely had in mind the emotional appeal of "because of terrorism" in choosing this case, although they probably really do want to search the phone. The case at hand is not intrinsically tied to terrorism, and the first case like it that Apple opposed had to do with guns and illegal drugs.

Re: FUD and nonsense

No, I dd not say that, and it is not true that a government win would open the (back) door for a demand to modify OS or device security going forward. That would require enactment of a law, which is possible but certainly not a slam dunk.

The law generally cannot order what is not possible, and courts cannot order under the All Writs Act actions that would be excessively burdensome, something that would, as in this case, be subject to argument in court. This case might set a precedent for determining that burden, and it surely would set a precedent for hundreds (more likely thousands) of very similar individual demands for assistance. The Manhattan (NY) district attorney has stated publicly that he presently has 175 waiting. It probably also would be followed by a comparable number of similar demands from other countries, with which Apple might be required to comply by treaty arrangements or its commercial interest. There is no reason, however, that those foreign request could not be made now or later, irrespective of the outcome of this case.

The chance that a court would issue such an order is zero, as is the chance that the Congress would enact a law requiring it.

Almost anything is more important than the Super Bowl.

Repealing the All Writs Act would be a possibility. It could result in courts sometimes being unable to enforce orders they reasonably and lawfully issue, such as the search warrant for San Diego County's iPhone; that might not be a good thing.

An alternative would be to remove search warrants from the scope of the All Writs Act by enacting a law explicitly authorizing the government to require individuals and companies to provide reasonable technical assistance, to the extent they can, in executing search warrants and other lawful court orders.

Re: This is despicable.

Exactly so. It is not about search, or about surveillance, or privacy, or encryption. It is about authority, in the sense of the power to issue commands and expect obedience. The All Writs Act is a catch all meant to cover cases similar to this one where the government needs help that the laws do not otherwise provide for to do something a court authorized it to do.

Have an upvote for seeing the difference.

Irrespective of the circumstances, the requirement for a search warrant to search a cell phone, reinforced in Riley v. California in 2014, still rules. Granting of a search warrant does not carry with it a legal presumption of guilt; the legal presumption is innocent until determined otherwise by a guilty plea or a trial. The presumption for a search warrant is "reasonable cause," and is considerably more relaxed.

Re: This is despicable.

More than a bit over the top here, as in this case the government has both a constitutionally allowed search warrant and the phone owner's permission to search the phone. There might be a case somewhere, but it is not here.

Under the laws in play here, a court can order (under the All Writs Act) actions in support of its other lawful orders. If a court could issue a lawful order that required a biological weapon to carry out, it might be able to order a company to produce the necessary biological weapon. It is pretty doubtful that a court could issue a lawful order that required a biological weapon.

In this case the court issued an order for assistance in carrying out a search warrant that nobody claims is not lawful. Whether it requires Apple to create something new might be something reasonable people could disagree about. As the order reads, it seems plausible that it would require a moderate number of relatively minor changes to the code modules that limit the number and speed of pass code attempts and restrict input of such codes to the touch screen. In one day many years ago I wrote (by copying and modifying previous code) five or six different subprograms to validate and post transactions in a payroll system; I did not then, and do not now, think of that as "creating" the programs so much as coding the details of a decently thought out general plan.

Should the appeals go against Apple, my guess is that they will create or modify the code as required; and if they continue to refuse they probably would be assessed a fine.

The FBI probably, and to a near certaint another government agency that we all could name, has the requisite expertise to develop what the government demands of Apple. It is likely that they could not do that as easily, cheaply, and safely as Apple, but more importantly they cannot (or so the FBI agent said in the application for the order) sign the code using Apple's secret key so that the modified memory image demanded would load and execute.

The government does this based on a 227 year old law intended to give the federal courts effective power to ensure that lawful court orders are carried out when other laws do not do so adequately. It has been used with some frequency, but not often because most orders are issued in conjunction with existing legal requirements. Amendments to the law, and court decisions about it, have somewhat restricted its scope and limited what a court can order to a "reasonable burden ," however that may be defined in a particular case. There is indication, in the order's requirement that Apple provide cost information, that Apple is not expected to do the work without compensation (similar to payments made for PRISM and other similar activities). It is somewhat interesting, but probably irrelevant, that the FBI or the San Bernardino County agency that owns the phone made errors. Their position, and the court's, is that irrespective of the reason, they require the help now.

Re: Does anyone believe that the next FBI request / court order wouldn't be...

If/when Apple complies with the order, they certainly can expect more such. The number probably will not be huge, simply because stored cell phone contents probably are not commonly at issue in criminal investigations and prosecutions (although it is likely that will increase going forward).

As long as Apple keeps the software signing key and the requirement for its use, potential for FBI or other misuse should not be a significant issue.

What is somewhat interesting to consider is why it should be thought different, in terms of privacy rights, whether data on a phone is or is not encrypted. Alternatively, should encryption, which expresses individual power, be thought to be a right simply because the government cannot break it? What, in principle, makes it different from data that are not encrypted or, for that matter, from data that are not only plain text but on paper and simply out of plain view? (For US) Where does the fourth amendment (and the voluminous jurisprudence that goes with it), which allows, but limits, government searches and seizures fit in; and why should encrypted data be thought legitimately exempt from disclosure (if one thinks that) while plain text data is not? Is there a reason to have different, perhaps more stringent, requirements for a search warrant involving encrypted data that for one that does not?

The subject certainly is worth discussion at length, but after quite a few centuries of US law, and before that English statutory and common law, we have a reasonably consistent understanding of what constitutes legitimate government search and other criminal investigation activity that those who argue for absolute immunity from search because it is encrypted should consider.

My own position is that encryption should not affect legitimacy of a search; that the (unencrypted or not) documents in a file drawer and the data in an encrypted iPhone on the file cabinet should have exactly the same status with respect to a search warrant. The fact that the government can read some of it directly and must expend effort or enlist help is secondary and likely not a fourth amendment issue. (There may, however, be fifth amendment issues if I am ordered to decrypt it or provide the key so that the government can do so).

Which iOS

It is reported elsewhere* that the software is iOS8, and that the phone is owned by Farook's former employer, who provided it to him. The FBI certainly will, by now, have obtained business records that show ownership.

* Either New York Times or Washington Post, as I recall from last night.

Re: A tangled web we weave....

That blanket statement probably should be changed (at least) to read

"every teeny with thumbs" who can sign Apple code "will be able to crack a device update"

And the point is?

A court order is all that is required to enter your house, search it, and arrest you. That has been true for 227 years in the US and longer, often far longer, in numerous other countries. In many places, it takes far less than a court order to do any of those things, and worse.

This is fundamentally correct, but proper to supplement with the observation that, as Apple claims, the fact that the capability exists increases the risk that someone, whether government or other, will abuse it. Given the constraints consistent with the court's order and the Apple software validation process, the risk probably is very small, but it is not zero. If it is done, it will be a sign to others that they should redouble their efforts to do the same, and it might happen that the whole system becomes compromised. The risk, again, can be made very small, but it cannot be made zero.

It is a problem, in the US maybe more than some other places, that people often are unable to evaluate risks rationally and therefore are unwilling to accept any level of identified risk. In this case, the risk to individuals who are not legitimate targets of law enforcement officials is very close to zero; indeed, it is close to zero whether the phone data are encrypted or not. Thieves, police, data brokers, and signals intelligence agencies have far more efficient ways to collect personal information than collecting it from large numbers of individual cell phones.

The risk to Apple, however, may be appreciably larger, maybe even measurable. Having claimed inability to recover lost pass codes, they cannot perform the ordered task without being shown to have lied about it.

Re: Ticking Timebomb Scenario

US courts have had the authority to require assistance for 227 years. Apple stated as much in their PR piece. Their claim that the application of that law is novel is belied by the fact, stated in the FBI application, that they routinely responded to similar writs in the past.

In addition, Apple have not stated that they cannot comply with the order; they have stated that they do not wish to do so.

Re: To my mind...

"[T]he idea that any individual's protected information can be accessed by the state by way of a court order is troubling to me."

The US government and subordinate state and local governments have been able to access an individual's private information lawfully for the last 227 years under the US Constitution and laws and under other laws for some centuries more than that. Nothing is particularly noteworthy or novel about granting them equivalent authority to access it when it is stored on a smart phone or other computer device. Moreover, for the same 227 years, US judges have been authorized by law to issue orders compelling cooperation in carrying out lawful warrants and other court orders; their predecessors under English law probably had roughly equivalent authority. Nothing is new there either.

What is new is the somewhat odd notion that there is an absolute individual right to designate certain information as "private" and withhold it at will and under all circumstances from all government officials. That right never existed and does not now. The government's authority to search and seize is constrained. It must be reasonable. It requires a warrant based on probable cause and supported by oath or affirmation. The warrant must describe what is to be searched or seized with some precision. Subject to those requirements, the government legitimately can obtain and try to exercise a warrant to search an individual's private information, protected or not. And under the law, the government also can direct others to help carry out the lawful search.

The fact that it cannot successfully conduct a properly authorized search because access to the information is blocked has nothing to do with the government's legitimate authority to do so, and does not confer a right that would not exist if the access were not prevented by technical means.

Re: Apple are in a no win situation.

There will be no need for more than one model, as authorities in every country will take exactly the same position as the US government: that law enforcement authorities may conduct searches as prescribed by national law and may seek, and sometimes require, assistance of private parties to do so.

Re: Another reason why you should use a password not a PIN

But by widely published reports, until iOS8, Apple retained the ability to unlock phones. My comment had less to do with the details of the implementation than with Apple maintaining a back door that enabled them to bypass it. Google, irrespective of whether you like or hate them or the robustness of the underlying encryption, did not do that. The assertion that Apple, before iOS8, was trying to do the right thing may be true, but their understanding of "right thing" changed significantly in 2014.

Re: What's the point?

I believe the laws support requiring citizens to assist police officers within reason and punishing those who refuse. It would be illuminating to see a lawyer's comment on that and other issues raised here.

Re: Explanation? Good luck with that

With a warrant based on probable cause, oath or affirmation, and particularly describing what is to be obtained: yes.

That is what we consent to under the Constitution and Bill of Rights, and is exactly what is being attempted in the case at hand.

No, it is not asking for the logical equivalent of a skeletion or master key. It is asking for assistance to unlock exactly one phone. The appropriate analogy in the case of a locked safe is skilled assistance to circumvent a combination lock. If other posters who appear to know more than I about Apple's implementation are correct, the key depends in part on physical characteristics of the security module that are unique to each phone; there is no master key.

It is true that the procedures, once developed, will be applicable in other cases, but law enforcement access, with a proper court order or warrant, to material in their physical possession is well within the scope of what we are used to and what was built into the US Constitution from its beginning.

Re: Another reason why you should use a password not a PIN

The government forced Apple's hand? Who forced Google's hand then, when they made encryption available in Android version 3, around 2011, that they did not have the key for? While Apple eventually realized that their encryption, with its back door to help their forgetful customers (and bearers of search warrants), they do not deserve much credit for closing the back door only after it became an obvious liability.

What's the point?

The direct perpetrators of the crimes are dead, but there are others, such as his friend who bought some of the weapons, who has been charged in the case, and family members with possible advance knowledge of their intent who may be under consideration for prosecution. There may also be evidence of possible involvement of others (possibly carrier business records) that suggest involvement of others.

This incident was a major crime by any reasonable standards, and there is no more reason to be concerned about searching the phone (or computer, if they had the storage) than there was about searching the Farook residence.

It would be interesting to see an explanation of the rather extreme claim that "this is an absolutely chilling, apalling thing for a court to order." It is not materially different from a case in which a locksmith might be asked to assist in opening a safe to assist police in executing a search warrant.

The police may need to have a warrant in order to use any search products as evidence in a prosecution, although there may be uncertainty about whom it should be directed to. But Apple does not own the phone, so assistance they provide in searching the phone probably is not relevant to admissibility of anything obtained as evidence. However, they may want to be seen as properly guarding customer data and have insisted on being compelled to assist. This may benefit the government as well by leaving it somewhat uncertain whether they actually have the ability to break encryption on phone data, and if they can, how quickly.

This has nothing to do with parallel construction as sometimes has been used to obscure use of foreign intelligence information to obtain warrants.

The FCC is an agency set up to make and enforce rules. That is the obvious and almost certainly correct answer to the question "why would the FCC see the need for more regulation?"