Government Uses 227-Year-Old Law To Force Apple To Unlock Terrorist's iPhone

The U.S. Department government has used a law created in the 1700's to force Apple Computer to break into an iPhone used by a terrorist last year. The New York Times reported that on Tuesday:

"... Magistrate Judge Sheri Pym of the Federal District Court for the District of Central California ordered Apple to bypass security functions on an iPhone 5c used by Syed Rizwan Farook, who was killed by the police along with his wife, Tashfeen Malik, after they attacked Mr. Farook’s co-workers at a holiday gathering. Judge Pym ordered Apple to build special software that would essentially act as a skeleton key capable of unlocking the phone... The Justice Department had secured a search warrant for the phone, owned by Mr. Farook’s former employer, the San Bernardino County Department of Public Health, which consented to the search... the F.B.I., instead of asking Congress to pass legislation resolving the encryption fight, has proposed what appears to be a novel reading of the All Writs Act of 1789... The government says the law gives broad latitude to judges to require “third parties” to execute court orders. It has cited, among other cases, a 1977 ruling requiring phone companies to help set up a pen register, a device that records all numbers called from a particular phone line..."

So far, Apple has refused to comply. Excerpts from a statement by Apple:

"The United States government has demanded that Apple take an unprecedented step which threatens the security of our customers. We oppose this order, which has implications far beyond the legal case at hand. This moment calls for public discussion, and we want our customers and people around the country to understand what is at stake... Compromising the security of our personal information can ultimately put our personal safety at risk. That is why encryption has become so important to all of us. For many years, we have used encryption to protect our customers’ personal data because we believe it’s the only way to keep their information safe... But now the U.S. government has asked us for something we simply do not have, and something we consider too dangerous to create. They have asked us to build a backdoor to the iPhone. Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession. The FBI may use different words to describe this tool, but make no mistake: Building a version of iOS that bypasses security in this way would undeniably create a backdoor. And while the government may argue that its use would be limited to this case, there is no way to guarantee such control... The government is asking Apple to hack our own users and undermine decades of security advancements that protect our customers — including tens of millions of American citizens — from sophisticated hackers and cybercriminals. The same engineers who built strong encryption into the iPhone to protect our users would, ironically, be ordered to weaken those protections and make our users less safe. We can find no precedent for an American company being forced to expose its customers to a greater risk of attack. For years, cryptologists and national security experts have been warning against weakening encryption. Doing so would hurt only the well-meaning and law-abiding citizens who rely on companies like Apple to protect their data."

This is not the first use of the All Writs Act against Apple. NPR reported:

"Last fall, the Justice Department, using the All Writs Act, tried to force Apple to unlock an iPhone running iOS 7 in a case involving a suspected methamphetamine dealer. Apple responded that it might be technically capable of unlocking that phone (since iOS 7 has fewer security features than later operating systems) but said the cost to the company's reputation — and resulting harm to its business — would pose an "undue burden." That case is still pending.."

The NPR news story also mentioned:

"In 2014, at the Justice Department's request, a federal court in New York used the law to order a phone-maker to unlock a password-protected device. The Justice Department says various other companies have been ordered under the All Writs Act to provide otherwise inaccessible information to investigators."

This is huge news. It highlights several privacy issues:

1. Has the government over-reached by using a 1789 law?
2. How can the government force a company to build something -- software, malware -- that doesn't exist? This Atlantic article describes the coercion slippery slope.
3. Can Apple successfully build a back door for a single iPhone?
4. If #3 is not technically impossible, does the back door place all iPhones at risk?
5. Are back doors the best way to fight terrorism? Like you, terrorists read the news and will simply switch to other products without built-in back doors.
6. Are back doors really needed? The law enforcement community is split over this.
7. Are back doors a benefit or a risk?
8. How does the government ensure that criminals, terrorists, and other governments' hackers don't use the same "back doors" it uses? After all, the Federal government has had massive data breaches.
9. Do "back doors" prevent businesses from adequately protecting their proprietary trade secrets, processes, and private information?
10. Why haven't other technology companies resisted the government's demands for back doors, as Apple has? This Wired article discusses why Apple's position (including encryption and strong privacy protections) is good for business.
11. What does this mean for consumers' privacy? Some iPhone users have already built a website for protests.

Regarding item #1, the American Civil Liberties Union (ACLU) wrote in December 2015:

"The All Writs Act permits a court to issue an order to give effect to a prior lawful order or an existing grant of authority, and has been used for such things as ordering a prisoner be brought before a court. The Act does not allow a court to invest law enforcement with investigative tools that Congress has not authorized — like the extraordinary and unconstitutional conscription of a third party into obtaining information the third party does not possess or control... it’s even more troubling to consider that the government, by its own admission, has invoked it successfully in at least 70 cases."

The ACLU, the ACLU of Northern California, and the Center for Internet and Society (CIS) at Stanford Law Scvhool, filed a Freedom of Information Act (FOIA) request in December to understand the government’s use of the All Writs Act to force device manufacturers to unlock devices. It is important to known the full scope of the government’s use of a 227-year-old law. The Electronic Frontier Foundation (EFF) announced that it will file an amicus brief supporting Apple.

The CIS responded to the recent court decision:

"The text of the court order is here. Although it does not direct Apple to break the encryption per se, it asks the company to disable features that make it more difficult to brute force the device security capabilities -- such as the function that disables (er, self-destricts) the device after multiple attempts to enter a PIN number. While that sounds innocuous enough, it is likely such access cannot be granted on a device-by-device basis upon demand by law enforcement, although some technologists believe it possible. Rather, unless Apple demonstrates the technical, economical, or temporal infeasability of complying with the judge's order or gets the order lifted, the consequence may well be an update/patch to IOS that would implement that proverbial "backdoor" feature that certain law enforcement officials -- specifically, FBI Director James Comey -- allege is needed to protect the country, citizens, and (think of the) children from Any Number of Evil-Sounding Things That May or May Not Be True(tm). By contrast, NSA Director Admiral Mike Rogers has already stated publicly there is no need for such back doors or law enforcement access, and that strong Internet security features are more of a benefit than risk to society -- despite that perennial and selectively sensational hand-wringing by prominent law enforcement and/or intelligence officials..."

The privacy-friendly DuckDuckGo.com search engine posted this tweet on Wednesday:

And former N.S.A. contractor Ed Snowden posted:

Comments

[Chanson de Roland]

It seems to me that the courts will have to decide three legal issues:

First, since Congress hasn't yet authorize the mandatory creation of backdoors into a computing device's security under any circumstances, is a writ to enforce a search warrant requiring Apple to do just that, create a backdoor in its the iPhone and iPads (I say iPads because they use essentially the same OS as the iPhone) beyond the scope of a legal search and, therefore, not within jurisdiction of any court? And being outside of a court's jurisdiction, the All Writs Act does not, by its express terms, authorize such a writ?

Second since, as a matter of well settled law, the government may not constitutionally require a private person to aid the government in performing its ministerial duties, including investigating crime, except perhaps as an incident to an otherwise constitutionally valid legal duty, may a writ constitutionally require Apple to use its art and resources to create a backdoor into its iPhones and iPads to abet the government's investigation of crime, even where, as here, only Apple would have the ability to create that backdoor into its iPhones and iPads? If so, where does that ability to conscripts a private person's art, skill, and resources to investigate crime end? Can I conscript a parent to aid in the execution of surveillance warrant against his or her child by wearing a wire? Can I conscript a waiter in a restaurant to eavesdrop on a criminal's conversation at in that restaurant? If not, why not?

Right now Apple is using all of its engineering resources to get the iPhone 7 ready for introduction to the market later this year. Those same engineers would now have to be seconded to the government's service to make a version of Apple's iOS that doesn't have important security features, which could delay the introduction of a product that generate billions in revenue. Who is going to pay for that, even if it is constitutional to order Apple to do it? And breaching iOS security--iOS is the operating system for iPhones and iPads--will cost Apple vast amounts of business and goodwill in many markets. Who is going to pay for that? Surely, the government would have to reimburse Apple for perhaps billions in lost revenues.

Third, in effect the government is arguing that the All Writs Act can be used do to more than make a party surrender what's in its/his possession and/or control but to also make Apple, and presumably anyone, its agent, its servant, to do a thing, which here is to design software to breach the iPhone and iPad's security. Can the the All Writs Act be read to constitutionally authorize an order conscripting a private person, and thus seizing that person's time, resources, and will, as the government's agent to do a thing, when existing precedent suggests that the government may only recruit volunteers and/or enter into a voluntary contract for good and/or services? Is that consistent with constitutionally prohibition against the government seizing property without just compensation and then only for a government purpose? Is that consistent with the First Amendment's freedom of association and speech? Doesn't that violates the 13th Amendments prohibition against slavery and involuntary servitude? What does the government do if Apple loses but Tim Cook refuses to order his engineers to design backdoors into the iPhone and iPad? What does the government do if Cook does give that order but his engineers refuse to obey it? Would you jail them under penalty of criminal contempt, when the most that you could do an FBI agent who similarly refused to use his skill and art to do the same thing would be to fire him, because slavery is illegal? If that happened, I suppose the FBI would seize all of Apple's relevant IP and have the NSA design and develop and maintain the iOS. That will sell really well, won't it?

If the government can expand the All Writs act to require anyone to be its use his art, skill, and resources to investigate crime or otherwise compel a person to be its agent to investigate crime, what can it not do in conscripting a person into its service to carry out its ministerial functions?

[George]

Roland:

Thanks for the detailed comment. I agree. The U.S. Congress needs to clarify things with updated laws. I went back and forth about whether to add this as a 12th item in the above list of privacy issues. I will probably discuss this in more detail in a future blog post. I didn't want to overwhelm readers, as the whole affair is complicated enough.

George
Editor
http://ivebeenmugged.typepad.com

[George]

Related reading for everyone:

The U.S. has Gone F&*%ing Mad
https://medium.com/@jamesallworth/the-u-s-has-gone-f-ing-mad-52e525f76447#.lc2gjvu60
#AppleVsFBI #surveillance #terrorism #Apple #government #guns

In Employee Email, Apple CEO Tim Cook Calls For Commission On Interaction Of Technology And Intelligence Gathering
http://techcrunch.com/2016/02/22/in-employee-email-apple-ceo-tim-cook-calls-for-commission-on-interaction-of-technology-and-intelligence-gathering/

George
Editor
http://ivebeenmugged.typepad.com

[Angel Healy]

This discussion could really go on for too long. My opinion regarding a "back door" or anything that has something to do with a capability of sneaking into someone's private device, just totally debunks the idea of having that device as your "personal" gadget. Unless, we totally get rid of our perception that these devices are as private as our own bathrooms while taking a bath.