The FBI Might Not Need Apple's Decryption Help
The FBI says a mysterious "outside party" has found a way to unlock San Bernardino shooter Syed Farook's iPhone without assistance from Apple.
Well, that was odd. On Monday, the U.S. government suddenly pressed pause in its encryption battle with Apple—a case that stands to make or break a precedent for building a government "back door" into secure technologies. FBI lawyers requested that a court hearing originally scheduled for today be postponed until after April 5. The reason? An unknown "outside party demonstrated to the FBI a possible method for unlocking [San Bernardino shooter Syed Rizwan] Farook's iPhone" that would "eliminate the need for the assistance from Apple."
On Wednesday, it was revealed that Israeli mobile forensic software provider Cellebrite was likely the firm enlisted to help the FBI unlock Farook's iPhone. According to Reuters, the firm is split into two companies: one that provides forensic systems to law enforcement and intelligence agencies like the FBI and another that provides technology for mobile retailers. If the FBI's version of events is correct, Cellebrite contacted the FBI "out of the blue" just before the agency was heading into a difficult court case. Talk about good luck.
Until now, the FBI has been pushing for Apple engineers to purposefully break certain iPhone security features so federal agents can access data on Farook's phone. Virtually all of Silicon Valley stands with Apple, viewing the order to build a "back door" for government access as a major threat to strong cybersecurity and a worrying overreach of state power. But the FBI has argued that all this clucking about "network security, encryption, back doors, and privacy" is a mere "diversion" from the just cause of prosecuting terrorists.
FBI's Legal Reasoning Is Shaky
The FBI's initial legal argument for conscripting apple's engineers was based on a broad interpretation of the All Writs Act of 1789 (AWA). That centuries-old law says U.S. courts may issue all legal orders "necessary and appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law." Traditionally, the AWA has allowed courts to facilitate lawful legal procedures when the precise means needed was not on the books. Subsequent legal interpretations forbid the government from using the AWA to compel an entity "far removed" from a situation to act or compelling actions that pose an "unreasonable burden" or "adversely affect" a party's "basic interests."
Apple responded that the AWA is nowhere near as expansive as the FBI would like it to be. Besides, the FBI's demands are expressly prohibited under the AWA anyway, as complying would cause Apple to suffer "unreasonable burdens" that would "adversely affect its basic interests." What's more, the AWA is superseded by the Communications Assistance for Law Enforcement Act (CALEA). This 1994 law explicitly prohibits law enforcement from compelling companies to "decrypt, or ensure the government's ability to decrypt, any communication unless… the carrier possesses the information necessary to decrypt the information" (i.e. the private key) or for the government to "dictate to providers or electronic communications services… any specific equipment design or software configuration."
On March 10, the FBI fired back. While Apple portrays the AWA as "dusty and forgotten," the feds feel that the old girl is "a vital part of our legal system that is regularly invoked in a variety of contexts." And as Apple is one of the largest and most cash-rich companies in the world, it shouldn't be a big deal to comply with the government's modest request.
Last week, Apple's attorneys filed its response to the FBI response. In it, Apple asserted that "the Founders would be appalled" by the FBI's use of the All Writs Act "an all-powerful magic wand."
Furthermore, Apple takes strong objection to the FBI's claim that it only seeks access to one specific device rather than a precedent for future cases. The filing points to comments by FBI Director Comey at his recent congressional testimony that this case "will be instructive for other courts"—suggesting that the agency did indeed expect a beneficial precedent.
So Much for That Precedent
But Monday's shock announcement made all of this legal sparring irrelevant—at least for now.
Throughout this entire brouhaha, many have speculated that the FBI was not solely interested in the data that might be on Farook's work iPhone. After all, Farook did not even go through the trouble of attempting to destroy this phone, which was issued to him through his work and possibly monitored by his employer—how important could info on it be? Yet as a means for law enforcement to establish a legal precedent to get around secure encryption, this situation is ripe for opportunity.
Of course, should precedent to be established in the opposite direction—should the courts side with Apple's arguably more comprehensive case against the government—the FBI would have one less means by which to access secure technologies. The agency would have to slink back to Congress, empty-handed, and re-start the ignoble process of pushing an unpopular statute through an already-gridlocked body.
This is not to say that the legal fight ends here. After all, the order was only stayed, not terminated. If this cracker-jack hack of the FBI's falls short, the FBI may very well revisit the issue after its April 5 status report.
Additionally, it's important to keep in mind that while the fight between Apple and the FBI over the San Bernardino shooter's phone is the most high-profile, it is hardly the only such case. Apple alone is fighting at least 12 similar orders to break secure technologies for law enforcement. The San Bernardino case just happens to be the most emotionally compelling of these because of its ties to terrorism. The vast majority of the government's other issues with encrypted data—few though they may be—deal with investigations regarding the wildly unpopular War on Drugs.
Vulnerabilities and Vigilance
Not much is known about the FBI's new "method for unlocking Farook's iPhone." Perhaps it's employing methods proposed by a handful of technologists to get around the iPhone's security without conscripting Apple engineers as hacker slaves.
Another possibility is that the FBI will execute one of the federal government's cache of "zero day vulnerabilities" to crack the iPhone. Zero days are software bugs that are unknown to all but the discoverer. Ideally, such vulnerabilities would be quickly reported to relevant parties so that bugs get patched and all of us can enjoy a more secure computing environment. But zero days are frequently employed by nation states and malicious hackers to exploit their monopolies on security vulnerability.
Technologists will be watching very closely to determine whether and to what extent the FBI may be engaging in this dangerous zero-day trade.
The FBI, for its part, says that it is "cautiously optimistic" about this serendipitous new method to access data from Farook's infamous iPhone without conscripting Apple. We should all be cautiously vigilant about the FBI's next move in its war against secure technologies.