U.S. Gov't Orders Apple to Backdoor iPhone

Zelig said:

"There’s nothing preventing the FBI from writing that hacked software itself, aside from budget and manpower issues. There’s every reason to believe, in fact, that such hacked software has been written by intelligence organizations around the world."

Click to expand...

This guy is a fine security expert, I'm sure, but not necessarily a legal expert. An intelligence agency that just wants the information wouldn't be constrained, but a law enforcement organization that may want to use the information as evidence has to obtain it legally. While I have no doubt that the FBI could hack the phone to extract the data, their warrant to examine the data doesn't extend to performing an illegal activity in the process.

If they hacked the phone themselves and found me in there I would challenge the admissibility of the evidence if I could show they transgressed IP law in obtaining it. Just like a search warrant issued to examine the contents of my car wouldn't authorize my local PD to break into and trespass in someone else's garage if it were stored there.

The owner of the garage would get a very similar order, and would have nothing like the grounds for non-compliance that Apple has. But that order would still be required for the product of the search to be usable, unless I'm missing something.

I agree with the general sense that this is a situation chosen for the setting of precedent, by the way, even if I disagree with some of the details.

The problem however is prosecutors and the police may sometimes go back and get the evidence they need again via "legal" means after first acquiring it unlawfully, without informing anyone how they first acquired the evidence.

It's common enough that there is a term for this tactic, but I can't remember it and my google-fu is weak this morning, apparently.

Have legal authorities ever been thwarted in evidence gathering on IP grounds?

Like copyright etc? No.

Ajidica said:

I'm not seeing the huge issue with this. The FBI asked Apple to do the following:

http://www.bbc.com/news/technology-35601035

From what I have seen so far it sounds like the FBI is doing a standard document request through the proper channels during a criminal investigation that is a bit wonky because they are entering unfamiliar territory due in part to Apple deciding to make phones encrypted by default. This isn't the government wanting a backdoor installed on all phones so they can listen in whenever the urge gets them - this is part of a criminal investigation.

Part of me wonders how many people would be supporting Apple if the situation was reversed. That is, if a criminal case was opened up against an FBI agent who killed people and Apple was refusing to comply with court instructions to open up the Agent's phone which was believed to have relevant information on it.

Click to expand...

I don't think Apple's argument - that creating a back-door for legitimate use means it's there for illegitimate people to find - actually holds. From what I've gathered, they're only asking them to design software to handle this particular phone, which would rely on some sort of weakness already being there. The dangerous thing might be admitting that such a weakness exists, but then I imagine hackers and criminals all over the world are already proceeding on the assumption that it does and trying to find it.

Flying Pig said:

I don't think Apple's argument - that creating a back-door for legitimate use means it's there for illegitimate people to find - actually holds. From what I've gathered, they're only asking them to design software to handle this particular phone, which would rely on some sort of weakness already being there. The dangerous thing might be admitting that such a weakness exists, but then I imagine hackers and criminals all over the world are already proceeding on the assumption that it does and trying to find it.

Click to expand...

1. Yes, your understanding is generally correct, but techcrunch covers the reason for opposing it pretty well: Why Apple Is Fighting Not To Unlock iPhones For The Government

The final condition there is the scariest, and the one that Apple objects to the most. Don’t get me wrong. Cook’s letter clearly states that Apple is opposed to all of the conditions, but that last one is different. It is asking Apple to add a vulnerability to its software and devices, not just ‘remove’ a roadblock.

Click to expand...

The fact that the act is being used to try to make Apple do a lot of work to modify iOS and to add functionality that would significantly weaken its products and their security will likely be at the core of Apple’s defense when this gets to the courts. It’s a huge ballooning of the scope of the AWA, and it sets a precedent for allowing the government to force Apple or other companies to modify their systems to allow access to your private data.

Click to expand...

If I had to bet, Apple is probably working double time to lock it down even tighter. Its reply to the next order of this type is likely to be two words long. You pick the two.

The point is that the FBI is asking Apple to crack its own safe. It doesn’t matter how good the locks are if you modify them to be weak after installing them. And once the precedent is set then the opportunity is there for similar requests to be made of all billion or so active iOS devices. Hence the importance of this fight for Apple.

This is why the debate around this particular order should not focus overmuch on the technical aspects — but on the fact that the government would be weakening the security of a private company’s product, potentially impacting the civil liberties of American citizens and foreign nationals worldwide that use those products.

Click to expand...

Once that method exists, there is absolutely, positively, no way for it to be kept solely for the use of the government. It also raises the question of how any international user of an iPhone would ever feel safe — especially given what we now know about the government’s electronic surveillance capabilities and its willingness to use them.

Apple is choosing to fight this battle now, rather than later. Cook’s letter draws a line out on the beach, where we’re still talking about allowing brute force cracking of iPhone passwords — rather than right up against the fortress, where we will be fighting for our right to secure encryption.

Click to expand...

And the other problem:

2. "Legitimate use" covers any government in the world operating under the scope of their local laws. China allows iPhones they can't get into because nobody can get into them.

Yeah, makes sense that they'd fight this, even if they didn't care about their users' security and privacy. This makes their products less desirable, even if most people buy their products not due to the inherent security or whatever but rather the name.

illram said:

The problem however is prosecutors and the police may sometimes go back and get the evidence they need again via "legal" means after first acquiring it unlawfully, without informing anyone how they first acquired the evidence.

It's common enough that there is a term for this tactic, but I can't remember it and my google-fu is weak this morning, apparently.

Click to expand...

I too have forgotten the term for the tactic.

Police often use the Stingray Cell Phone tracking device without a warrant to catch criminals, and then hide that fact.
http://www.usatoday.com/story/news/2015/08/23/baltimore-police-stingray-cell-surveillance/31994181/

Defense attorneys assigned to many of those cases said they did not know a stingray had been used until USA TODAY contacted them, even though state law requires that they be told about electronic surveillance.

“I am astounded at the extent to which police have been so aggressively using this technology, how long they’ve been using it and the extent to which they have gone to create ruses to shield that use,” Stephen Mercer, the chief of forensics for Maryland’s public defenders, said.

Prosecutors said they, too, are sometimes left in the dark. "When our prosecutors are made aware that a detective used a cell-site stimulator, it is disclosed; however we rely upon the Police Department to provide us with that information," said Tammy Brown, a spokeswoman for the Baltimore's State's Attorney. "We are currently working with the Police Department to improve upon the process to better obtain this information in order to comply with the law.”

Click to expand...

Stingrays are hardly the only way this occurs.
http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130805

A secretive U.S. Drug Enforcement Administration unit is funneling information from intelligence intercepts, wiretaps, informants and a massive database of telephone records to authorities across the nation to help them launch criminal investigations of Americans.

Although these cases rarely involve national security issues, documents reviewed by Reuters show that law enforcement agents have been directed to conceal how such investigations truly begin - not only from defense lawyers but also sometimes from prosecutors and judges.

The undated documents show that federal agents are trained to "recreate" the investigative trail to effectively cover up where the information originated, a practice that some experts say violates a defendant's Constitutional right to a fair trial. If defendants don't know how an investigation began, they cannot know to ask to review potential sources of exculpatory evidence - information that could reveal entrapment, mistakes or biased witnesses.

"I have never heard of anything like this at all," said Nancy Gertner, a Harvard Law School professor who served as a federal judge from 1994 to 2011. Gertner and other legal experts said the program sounds more troubling than recent disclosures that the National Security Agency has been collecting domestic phone records. The NSA effort is geared toward stopping terrorists; the DEA program targets common criminals, primarily drug dealers.

"It is one thing to create special rules for national security," Gertner said. "Ordinary crime is entirely different. It sounds like they are phonying up investigations."

The unit of the DEA that distributes the information is called the Special Operations Division, or SOD.

Click to expand...

But what word best describes this technique/practice?
I know I've seen it somewhere, but I've forgotten it!
I should just call up the Special Operations Division of the DEA and ask them what word they are using for this in their office lingo.

Why not have a proper division of labor, and have a well oiled police state?
Have the feds break every single law to find criminals, then have them give "anonymous" tips to the local police about who the criminals are.
Then the police can perform normal investigations and get legal convictions much easier than currently because they start out "knowing" who's guilty.

=========================================
As for backdoors in Iphones, it's all fun and good until criminals figure out how to use the backdoor too.
Snowden on Wikileaks, how to hack anyone's IPhone, enjoy.

Maybe the Feds should be concentrating on the WHOPPING $21 billion that will be stolen from the IRS this year through fraud.
AKA the state budget in half the states in this country.

Parallel Construction is the term you're looking for.

Wasn't Obama all QQ that he couldn't have an IPhone as a president?

Another good one: Do We Have a Right to Security?

Don’t be distracted by the technical details. The model of phone, the method of encryption, the detailed description of the specific attack technique, and even the feasibility are all irrelevant.

Don’t be distracted by the legal wrangling. By the timing, the courts, or the laws in question. Nor by politicians, proposed legislation, Snowden, or speeches at think tanks or universities.

Don’t be distracted by who is involved. Apple, the FBI, dead terrorists, or common drug dealers.

Everything, all of it, boils down to a single question.

Do we have a right to security?

Click to expand...

Because that is what this fight is about, and there is no middle ground, mystery answer hiding in a research project, or compromise. I am a security expert. I have spent 25 years in public service and most definitely don’t consider myself a social activist. I am amused by conspiracy theories, but never take them seriously. But it would be unconscionable for me to remain silent when our fundamental rights are under assault from elements within our own government.

Click to expand...

I'm less happy with that line of argument, because we already accept that the right to privacy and security is not unconditional. You have a right to keep the contents of your pockets secret from anybody else on the street, but not from a police officer when you're under arrest. At that point, you have a right to keep the contents of your home private, but you lose that if they can secure a search warrant. The same is true of all things we call rights. It's always a question of balancing the cost against the benefit of restricting them.

Flying Pig said:

I'm less happy with that line of argument, because we already accept that the right to privacy and security is not unconditional. You have a right to keep the contents of your pockets secret from anybody else on the street, but not from a police officer when you're under arrest. At that point, you have a right to keep the contents of your home private, but you lose that if they can secure a search warrant. The same is true of all things we call rights. It's always a question of balancing the cost against the benefit of restricting them.

Click to expand...

You do, however, have the right to keep silent/not incriminate yourself. It is pretty clear that the government can not force you to speak. So there is precedent for absolutely inalienable rights when it comes to security and privacy.

And as the link Zelig just posted said: In this question there is no middle ground.

Shall we have actual, real encryption on our data, which will protect it from unlawful as well as lawful demands; or shall we allow everyone, including foreign spy agencies and criminals of all kinds, to read, intercept, fiddle and manipulate the communication between you and your family, your bank, your employer, your doctor and your political affiliates?

We've never had that for those communications in the past - if I write an incriminating letter to either of those people, the police are perfectly at liberty to read it, or decode it if I encrypt it. We don't see that as a fundamental breach of privacy, I don't think. There absolutely is a middle ground.

Flying Pig said:

I'm less happy with that line of argument, because we already accept that the right to privacy and security is not unconditional.

Click to expand...

I think you're missing the point of that line of argument - the point is that our pockets and houses are not secure.

Do we have the right to build a house that is actually secure? That is, impregnable to both criminals and law enforcement.

Criminals are drastically more likely to break into your house than law enforcement - should law enforcement preserve criminals' ability to do so? (Keeping in mind that any criminals still have the tools to build an impregnable house, and there's no way for law enforcement to tell that whether a house is impregnable or not until they try to break in.)

We have a right to security if we make laws giving us such rights.

Otherwise we don't. So let's make sure such laws are in place by exercising whatever democratic powers we have.. which don't amount to much, but that's how you get rights - you have to first fight for them, and then ensure that they are written down as law of the land.

Personally I think privacy is important and something I am willing to fight for in some capacity.

Flying Pig said:

I'm less happy with that line of argument, because we already accept that the right to privacy and security is not unconditional. You have a right to keep the contents of your pockets secret from anybody else on the street, but not from a police officer when you're under arrest. At that point, you have a right to keep the contents of your home private, but you lose that if they can secure a search warrant. The same is true of all things we call rights. It's always a question of balancing the cost against the benefit of restricting them.

Click to expand...

I think the fundamental difference here is that it isn't really possible to open that door to the police without also opening it to all the potential criminals. The act of opening it to the police in and of itself opens it to the criminals.

Flying Pig said:

We've never had that for those communications in the past - if I write an incriminating letter to either of those people, the police are perfectly at liberty to read it, or decode it if I encrypt it. We don't see that as a fundamental breach of privacy, I don't think. There absolutely is a middle ground.

Click to expand...

A letter you write is a physical thing, handled by the post system. It gets into contact with few people on its route, and the post offices and transportation has enough physical security to protect the mail. Sorting through lots of physical letters to find the interesting ones is time consuming and inefficient.

Electronic communication goes everywhere. The routes between the sender and receiver are manifold and only partially known and controlled by reliable operators. Innumerable people can get in touch with the digital packets, and the signals can be copied, registered, analysed, modified and stored, all without the sender and receiver really knowing. Sorting through the interesting bits is trivial. The only thing actually protecting this communication is the mathematics used to encrypt the digital packets so that only the intended receiver can open them.

The same goes for digital storage as with communication. If a device is lost or stolen, the only way to protect the information on it is through the proper use of encryption.

Mathematics do not bend to what is convenient. Either encryption and computer security is implemented properly and both the bad and good guys are denied access, or it is implemented wrongly, and sooner or later everyone will have access.

For this problem, there really is no middle ground. We as society must make a choice.

Security and privacy, or none of it.

And make no mistake, if we choose the latter, once the Internet of Things catches on for real, we will all be in deep doo-doo.

What if Apple took possession of the phone and while being transported, the phone fell into the street and crushed by a passing semi? The legal battle might change into something more harmless.

In any case I support Apple.

Aea said:

Parallel Construction is the term you're looking for.

Click to expand...

Oh!

Thanks Aea
Yes, Parallel Construction.
https://en.wikipedia.org/wiki/Parallel_construction