Apple has formally appealed the court ruling that the FBI obtained in February that would force Apple to comply with the governments investigations, by decrypting the iPhone at the heart of a terrorism investigation via a signed OS update.
In a parallel case Apple appears to have the support of a federal judge, who has ruled that the law the FBI is citing is not applicable. Whether the written ruling helps Apple win its appeal remains to be seen, but Apple has appealed to a higher court and asked the original judge to vacate her ruling.
Syed Farook and his wife Tashfeen Malik killed 14 people and wounded 22 in a mass shooting on December 2nd 2015. There has been no concrete link to an external terrorist organization. The two appear to have been self-motivated and self-supplied. The FBI are convinced, at least in a public-facing manner, that the work iPhone might explain why the atrocity was committed.
Farook worked for San Bernandino County, and was provided with an iPhone 5C. At some point, the FBI asked the county IT department to reset the password of the iCloud account, which has now meant that the FBI can’t get at the data on the phone by way of the iCloud storage, as they can’t access the phone to update to the new iCloud password. Due to this, law enforcement need to access the phone directly in order to look for data that might explain the attack.
There are a number of issues with the phone itself, which will be explored below, but as we expected, this was not the first time that the US government has demanded Apple decrypt a phone as part of an investigation. It turns out that the “just this once” argument has been made around 80 times, in cases mostly involving drug dealers and hidden courts, and Apple has now demanded to know whether the law that the government claims compels it to do so is actually applicable.
To date, the FBI has used the All Writs Act from 1789 (unbelievably not a typo), which allows courts to demand that individuals provide information to authorities during investigations, to force Apple to decrypt iPhones. Apple has now asked federal judge James Orenstein for a clarification of the reach of the 1789 AWA, and Orenstein has not been kind to the government:
“I conclude that under the circumstances of this case, the government has failed to establish either that the AWA permits the relief it seeks or that, even if such an order is authorized, the discretionary favors I must consider weigh in favor of granting the motion. After reviewing the facts in the record and the parties’ arguments, I conclude that none of those factors justifies imposing on Apple the obligation to assist the government’s investigation against its will. I will therefore deny the motion.”
Orenstein is very critical of the AWA’s use, arguing that the government aims to contend that any court, with no legislative authority other than the 227-year-old act, can compel Apple to “create a brand-new product that impairs the utility of the products it is in the business of selling.”
“It is also clear that the government has made the considered decision that it is better off securing such crypto-legislative authority from the courts (in proceedings that had always been shielded from public scrutiny) rather than taking the chance that open legislative debate might produce a result less to its liking.” That’s pretty damning, but I’m not sure we should expect much else from most governments that are still struggling to get a grip on the threats they perceive stem from the citizenry using end-to-end encryption in their consumer electronics and associated services.
With iOS 8, Apple decided that it was going to fully encrypt its devices by default, so that only the passcode set by the user could unlock the device. This meant that Apple could not comply with requests to unlock phones. It could supply encrypted iCloud data to law enforcement, but couldn’t decrypt the device itself. Pragmatically, this should have reduced Apple’s legal workload, but now it is dealing with the US government’s attempts to bypass the protections it has included in its products.
This move drew the ire of law enforcement at the time, and this case can be read as revenge for this move to fully encrypted devices. With the advent of the fingerprint reader and the associated secure hardware element in the phones, the strength of the device security increased, but luckily for the FBI in this case, the 5C predates the 5S – which introduced Touch ID to the iPhone lineup.
Orenstein comes to the defense of Apple in this regard, noting that “Apple is not ‘thwarting’ anything – it is instead merely declining to offer assistance. There may well be some for whom the distinction between a third-party’s active obstruction of law enforcement and its passive refusal to help is meaningless as a matter of policy. But it is hardly meaningless as a matter of legal analysis.”
To this end, Apple has already provided the iCloud backup of the iPhone to the FBI – which the agency can definitely bruteforce without triggering an erasure mechanism. The FBI’s issue is that this backup dates from six-weeks before the attack, and so it wants access to the phone in the off-chance it contains useful information.
But the two attackers destroyed their personal devices, and this work phone is unlikely to contain useful information derived from that six-week window. In addition, the FBI will have access to all the usage data of the phone that is provided by the cellular carrier and the ISPs that handled its WiFi connections – so the end-result is that the FBI almost certainly won’t gain any useful data from this device.
Something that further complicated the investigation was the local law enforcement’s aforementioned changing of the iCloud user password at the behest of the FBI. This means that the phone now won’t backup to iCloud, so the FBI can’t bypass the passcode in order to access the data via an iCloud backup – which might have provided some evidence, even though the iCloud backups aren’t exact images of the device.
This screams ineptitude, but for the purposes of this argument, you can already suppose that the iCloud backup from six-weeks ago has been imaged, virtualized, and bruteforced. If the US government can’t crack an iCloud backup, or find a hardware-workaround that would allow it to exceed that ten-attempt limit, that’s a pretty big PR win for Apple.
However, with only a little bit of cynicism needed to guide your reasoning, most can see this argument as a future-looking endeavor – aiming to set a legal precedent that would give law enforcement access to encrypted devices on an as-needed basis. After all, this is a post-event request. The FBI can’t stop this attack from happening by gaining access to the locked phone, and it doesn’t look like cracking the phone is going to prevent a future attack. Instead, law enforcement stands to benefit from this setting a legal precedent; the beginning of an ice-coated slippery slope in Apple’s eyes, which would help them bypass encryption in the future.
So what the FBI initially asked for was a custom piece of software that would put the iPhone 5C into an update mode, which would then allow the software running inside the RAM to update the iPhone’s operating system so that the FBI could bruteforce the passcode – bypassing the risk of total erasure after ten incorrect attempts, as well as the mechanism that requires longer time delays between entry attempts.
Crucially, this requires the software to be cryptographically signed by Apple, so that the iPhone will accept the update. That creates all sorts of constitutional headaches in terms of legal arguments surrounding free speech in the US, but the move could eventually lead to an end-game in which a governmental agency would have control over the credentials.
Government agencies have been consistently shown to be very poor at keeping things private, just look at the Snowden fallout or the more recent Office of Personnel Management breach (which leaked the security clearance and associated personal info of nearly all federal workers), and so a backdoor that bypasses all encryption would inevitably be exploited by criminals and foreign states to gain access to any device. The impact of that would be huge – very bad for the consumer, and crippling for governments. A backdoor for one is a backdoor for all, and we already know that nation states are hunting for un-spotted vulnerabilities.
In terms of arguments in favor of the FBI, the agency did ask for a piece of software was that unique to the specific device, and which couldn’t (in theory) be used on other phones. But if a court ruled in its favor here, the FBI would be able to demand the same of every phone manufacturer (or any encrypted device for matter) from here on in. This would eventually end up with the FBI pushing for a masterkey of sorts, in order to scale with the amount of demands for access that law enforcement would inevitably file. This is the slippery slope that many in the technology industry fear.
The US has a history of seeking backdoors. The recent controversy surrounding Cisco and Juniper networking gear containing a compromised version of the random number generator used in the encryption is particularly notable – which appears to originate from the NSA. The RSA elliptic curve algorithm works as intended, but the systems’ random numbers are actually the complete opposite of random, which allows people in the know to decrypt all the traffic passing through them.