In a battle with the FBI over demand that Apple help unlock an iPhone used by San Bernardino shooter, government insists Apple has cooperated in the past
Apple’s history of working with law enforcement agencies has never included a demand for the kind of access the Department of Justice (DoJ) is seeking now, according to a person familiar with the company’s actions and a review by the Guardian.
The company is in a very public battle with the FBI over its demand that Apple help it unlock an iPhone used by one of the shooters in the San Bernardino attack last year.
The company has never been asked, in its history of cooperation with American law enforcement, to weaken an iPhone’s passcode security, said the person familiar with their relationship. And the Guardian review of select individual cases indicates that Apple has insisted on the company itself removing data from iPhones to be searched under warrant as far back as 2008.
The distinction matters because the government and its supporters have repeatedly said that they simply want to return to a time when Apple cooperated with them – but the method of cooperation it proposes is a new one.
“I’m asking Apple to return to September ’14, a time when Apple made no complaints that the operating system it was using, iOS 7, was insecure,” said Cyrus Vance, district attorney for Manhattan during an interview last week with Charlie Rose on PBS. Vance also said that he had 175 iPhones waiting to be unlocked should the DoJ prevail in this case.
Lawyers for the government wrote that they were aware of “multiple other unpublished orders in this district [central California] and across the country” along similar lines – “orders with which Apple complied”.
But the technical changes DoJ has asked Apple to make in the case of San Bernardino killer Syed Farook’s iPhone are far different from the way it has cooperated with law enforcement in the past.
The DoJ wants Apple to allow it to enter password guesses electronically (rather than by repeatedly poking the screen), and to turn off the time-delay and self-destruct features.
Commonly used hacking software can guess a 6-digit device password very quickly, give or take the time it takes a device to remember whether the password is right or not.
Advertisement
Encryption is no better than the password protecting it, but Apple secures its simple passcodes by insisting that anyone trying to access an iPhone at least behave like a human.
In the best-case scenario for someone trying to break into a phone, after 10 guesses an iPhone demands that the user wait an hour before trying again. In the worst-case scenario, after 10 guesses the phone erases all the data on the phone.
Cryptographer Bruce Schneier has said it is possible for someone with enough firepower to build software to turn off the features that slow down attempts to guess a password instantly. “There’s nothing preventing the FBI from writing that hacked software itself, aside from budget and manpower issues,” he wrote. Schneier contradicted the assertion by the government that Apple could make software to crack open only the one device. “[T]he hacked software the court and the FBI wants Apple to provide would be general. It would work on any phone of the same model. It has to.”
The DoJ took pains in its initial filing to create a method of cooperation that might leave Apple a way to save face: the agents with Farook’s iPhone could fly to Cupertino just as they had in the past, wrote the government’s attorneys, and the government would crack the password, so Apple wouldn’t have to share proprietary secrets. The company would just make breaking into its phone it easier to do while it looked the other way.
But opening an iPhone could give the government access to parts of the device it has never had before – email and the app layer, for example.
On iPhones running iOS 7 and older systems, Apple has been very selective about the material it provides to law enforcement, presumably in an effort not to violate its terms with third-party manufacturers. “Please note the only categories of user generated active files that can be provided to law enforcement, pursuant to a valid search warrant, are: SMS, iMessage, MMS, photos, videos, contacts, audio recording, and call history,” say the company’s lawyers in Apple’s Law Enforcement guidelines. “Apple cannot provide: email, calendar entries, or any third-party app data.”
The government’s motion did not mention what would happen to the phone after the password was cracked.
It’s not clear if Apple has ever made an exception to its rule that only it can retrieve data from phones without the user’s permission (and only then with a search warrant). But the person familiar with the matter said it had been consistent with the practice since at least September 2013, when iOS 7 first rolled out.
CEO Tim Cook said Monday that reversing the advancements in technology to accommodate momentary need would result in disaster.
“Some advocates of the government’s order want us to roll back data protections to iOS 7, which we released in September 2013,” wrote Cook in an email to staff. “Starting with iOS 8, we began encrypting data in a way that not even the iPhone itself can read without the user’s passcode, so if it is lost or stolen, our personal data, conversations, financial and health information are far more secure. We all know that turning back the clock on that progress would be a terrible idea.”
Reference source:theguardian
Comments
Post a Comment