Preliminary thoughts on the Apple iPhone order in the San Bernardino case: Part 2, the All Writs Act

Yesterday, I posted my first set of thoughts on the pending Apple challenge to the iPhone assistance order in the San Bernardino case. This is the second post in the series. It focuses on the existing law on whether a court has the power under All Writs Act to order Apple's assistance. I had hoped also to address the policy questions raised by the case, but this post turned out to be long enough. I'll save the really interesting policy questions for a future post and focus here only on the issue of existing law.

Apple's challenge will likely focus on the scope of a judge's power under a federal law called the All Writs Act (AWA). This post explores what we know and don't know about whether the AWA authorizes the Apple order. Because this post is long, I'll repeat now what I say in the conclusion: The scope of authority under the AWA is just very unclear as applied to the Apple case. This case is like a crazy-hard law school exam hypothetical in which a professor gives students an unanswerable problem just to see how they do.

I. Introduction to the AWA

The AWA has been around for a long time. It was passed as part of the Judiciary Act of 1789. Here's what it says:

[A federal court] may issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.

The historical idea of the AWA is that when a federal court has jurisdiction over a matter, the court has the power to issue additional orders ("writs," in the ancient language of the English common law) to assist the court in adjudicating the matter properly. Historically, it acted as a catch-all authority to make sure federal judges could keep the trains running on time.

Some suggest that because the All Writs Act is 227 years old, it shouldn't be relevant to a case involving modern high-tech surveillance. Whatever you think of the AWA, the focus on its age seems misplaced. The AWA is still part of the United States Code. Its role in the Apple case is framed by a 1977 Supreme Court case, United States v. New York Telephone, which I'll address in detail below. That 1977 case is, of course, binding on lower courts.

If you'll allow me a point that is more thematic than doctrinal, it's also interesting that the AWA was enacted the same week that Congress proposed the Fourth Amendment. The Judiciary Act of 1789, which included the AWA, was signed into law by George Washington on Sept. 24, 1789. The next day, on Sept. 25, Congress passed a joint resolution proposing the Bill of Rights that included the Fourth Amendment. In my experience, those who say the AWA is too old to be relevant also tend to believe that the Fourth Amendment should be interpreted expansively in our technological age. But it's not obvious why one ages like a fine wine while the other ages more like milk.

But what does the AWA actually do? To answer that, we need to take a closer look at New York Telephone.

II. The New York Telephone Case: The Second Circuit's Decision

In United States v. New York Telephone, the federal government had a warrant to monitor the phone usage of a group suspected of illegal gambling. The warrant authorized the installation of a "pen register," a device that recorded the outgoing numbers dialed from a particular phone line. The government couldn't figure out where to install the pen register without tipping off the suspects. In response, the court used the authority of the AWA to order the phone company to lend the FBI a telephone line and to help them install the monitoring device at the phone company.

The phone company refused to assist, mostly out of fear that the government would engage in "indiscriminate invasions of privacy" if the government had access to the network.

Before the case reached the Supreme Court, the Second Circuit ruled that federal courts should not compel innocent third parties such as the phone company to render assistance in such cases, at least "in the absence of specific and properly limited Congressional action." There was no natural stopping point to such a power if authorized under the All Writs Act, the Second Circuit ruled. Such an order would interfere with the phone company's autonomy and was insufficient to protect privacy. Here's the key passage from the Second Circuit's opinion:

Perhaps the most important factor weighing against the propriety of the order is that without Congressional authority, such an order could establish a most undesirable, if not dangerous and unwise, precedent for the authority of federal courts to impress unwilling aid on private third parties. We were told by counsel for the Telephone Company on the oral argument of this appeal that a principal basis for the opposition of the Telephone Company to an order compelling it to give technical aid and assistance is the danger of indiscriminate invasions of privacy. In this best of all possible worlds it is a law of nature that one thing leads to another. It is better not to take the first step.

While the Congress can clearly limit authorization for such orders to specific types of assistance and to federal law enforcement investigations of certain specified crimes, limitations by the courts cannot so easily be drawn, as our authority must be derived from the very general All Writs Act or the even more amorphous notion of inherent judicial power. We must be concerned not only with the Fourth Amendment rights of those whose telephone calls are monitored by pen register surveillance, but with the privacy rights of those third parties, communication common carriers and private parties alike, who might be called upon to aid the Government in its law enforcement endeavors. While a court may immunize such a third party from criminal or civil liability for its technical assistance, there is no assurance that the court will always be able to protect that third party from excessive or overzealous Government activity or compulsion. The potential dangers inherent in such a judicial order, and the future orders it spawns, compel us to conclude that if indeed the Government requires technical assistance, it is far better to have the authority for ordering that assistance clearly defined by statute.

III. The Supreme Court Reverses the Second Circuit

The Supreme Court disagreed. In an opinion by Justice White, the Court reversed the Second Circuit and held that the trial judge could order the phone company to assist the government. According to Justice White, the AWA authorizes "a federal court to issue such commands under the All Writs Act as may be necessary or appropriate to effectuate and prevent the frustration of orders it has previously issued in its exercise of jurisdiction otherwise obtained." The government had obtained a valid warrant, and "[t]he assistance of the Company was required here to implement" the warrant.

It was not a problem that the phone company was an innocent third party: "The power conferred by the Act extends, under appropriate circumstances, to persons who, though not parties to the original action or engaged in wrongdoing, are in a position to frustrate the implementation of a court order or the proper administration of justice, and encompasses even those who have not taken any affirmative action to hinder justice." The phone company had argued that it is "extraordinary" to force citizens to help the government. But the Court disagreed. According to the Justice White, "citizens have a duty to assist in enforcement of the laws." White cited a 1928 decision by Justice Cardozo, then a state court judge, in which he had written: "As in the days of Edward I, the citizenry may be called upon to enforce the justice of the state, not faintly and with lagging steps, but honestly and bravely and with whatever implements and facilities are convenient and at hand."

The tricky part of New York Telephone is that the Court left the actual test for what the AWA allows frustratingly murky. The Court was comparatively clear about one essential limit on a Court's power under the AWA: "We agree that the power of federal courts to impose duties upon third parties is not without limits; unreasonable burdens may not be imposed." Okay. But the rest of what the Court says is really unclear. Here's the key passage:

Turning to the facts of this case, we do not think that the Company was a third party so far removed from the underlying controversy that its assistance could not be permissibly compelled. A United States District Court found that there was probable cause to believe that the Company's facilities were being employed to facilitate a criminal enterprise on a continuing basis. For the Company, with this knowledge, to refuse to supply the meager assistance required by the FBI in its efforts to put an end to this venture threatened obstruction of an investigation which would determine whether the Company's facilities were being lawfully used. Moreover, it can hardly be contended that the Company, a highly regulated public utility with a duty to serve the public, had a substantial interest in not providing assistance. Certainly the use of pen registers is by no means offensive to it. The Company concedes that it regularly employs such devices without court order for the purposes of checking billing operations, detecting fraud, and preventing violations of law. It also agreed to supply the FBI with all the information required to install its own pen registers. Nor was the District Court's order in any way burdensome. The order provided that the Company be fully reimbursed at prevailing rates, and compliance with it required minimal effort on the part of the Company and no disruption to its operations.

The paragraph above is pretty confusing. It begins with the idea that the AWA doesn't apply to someone "so far removed" from the controversy; then turns to the need for the phone company's help; then talks about what is "offensive" to the company; and then covers the burden to the phone company, focusing on how much it cost the business and interfered with it. But the paragraph doesn't link these ideas or say how they relate to one another. It doesn't say what the standard is for each idea or how much weight to give it.

To make matters more confusing, the Court then looked beyond the AWA to see whether the order was "consistent with the intent of Congress."

The order compelling the Company to provide assistance was not only consistent with the [AWA] but also with more recent congressional actions. As established in Part II, supra, Congress clearly intended to permit the use of pen registers by federal law enforcement officials. Without the assistance of the Company in circumstances such as those presented here, however, these devices simply cannot be effectively employed. Moreover, Congress provided in a 1970 amendment to Title III that "[a]n order authorizing the interception of a wire or oral communication shall, upon request of the applicant, direct that a communication common carrier . . . shall furnish the applicant forthwith all information, facilities, and technical assistance necessary to accomplish the interception unobtrusively. . . ." 18 U. S. C. § 2518 (4). In light of this direct command to federal courts to compel, upon request, any assistance necessary to accomplish an electronic interception, it would be remarkable if Congress thought it beyond the power of the federal courts to exercise, where required, a discretionary authority to order telephone companies to assist in the installation and operation of pen registers, which accomplish a far lesser invasion of privacy. We are convinced that to prohibit the order challenged here would frustrate the clear indication by Congress that the pen register is a permissible law enforcement tool by enabling a public utility to thwart a judicial determination that its use is required to apprehend and prosecute successfully those employing the utility's facilities to conduct a criminal venture.

I find this passage confusing, too. Is the Court simply invoking the doctrine, developed in other AWA cases, that the AWA doesn't apply where there is a separate statute that addresses the issue? See Pennsylvania Bureau of Correction v. U.S. Marshals Service, 474 U.S. 34, 43 (1985) ("Where a statute specifically addresses the particular issue at hand, it is that authority, and not the All Writs Act, that is controlling."). Alternatively, is this passage some kind of pre-Scalia effort at purposivist statutory interpretation, in which the Court is trying to divine the scope of statutory law based on what it imagines Congress probably would want if it had this problem before it? Maybe I'm just missing something obvious, but I'm not sure.

IV. Applying New York Telephone

Let's finally turn to the difficulty of applying New York Telephone to the Apple case. You might think that in the 39 years since the case was handed down, there is a lot of caselaw interpreting it. Not so. Congress enacted individual assistance laws for the other surveillance statutes. As a result, they are no longer matters for the AWA. And most communications providers haven't been particularly adversarial with the government. There's just not a lot of caselaw on what the AWA allows.

We're mostly left with the uncertainty of the New York Telephone case itself. Beyond the "unreasonable burden" test, it's not clear what to make of the other matters that the court mentions. Are they all just factors in a grand multi-factor test? Are they actually parts of the undue burden standard, just not explicitly labeled that way? Are they parts of what makes the order "appropriate"?

Once you figure that out—if you can—there's the uncertainty about what each mentioned standard means.

Take the unreasonable burden test, the one test that New York Telephone clearly establishes. What does it mean? One possible answer is that the Court intended to incorporate the Fourth Amendment test used to determine when a third party's compliance with a subpoena is "unduly burdensome." As the Supreme Court summarized in See v. City of Seattle, "when an administrative agency subpoenas corporate books or records, the Fourth Amendment requires that the subpoena be sufficiently limited in scope, relevant in purpose, and specific in directive so that compliance will not be unreasonably burdensome." Is that the test?

On the other hand, at times it seems like New York Telephone treats unreasonable burden as a matter of how much the order would interfere with the third party's business affairs. Remember the language: "The order provided that the Company be fully reimbursed at prevailing rates, and compliance with it required minimal effort on the part of the Company and no disruption to its operations." Are each of those just factors to consider, or does the test not apply if any one of those tests isn't satisfied? Assume the FBI will reimburse Apple, but it would require a lot of effort on the part of the company to comply. Is that enough?

Even individual parts of this language seem confusing. Consider how you might decide how much an order "burdens" a company. Is that an absolute question? Or is it relative to the size of the company? As a company gets bigger and has more resources, does the amount of effort that can be required from it go up?

Another question is how much the application of the "unreasonable burden" standard changes if the subject company has a business strategy that includes opposing government surveillance requests. A company might intentionally design its products so that government surveillance is costly and difficult. Does the "unreasonable burden" test factor in those design decisions? Does the court measure the burden as it exists on the day that the application was made? Should a court factor in burdens that exist because the company specifically wanted them to exist? If, as here, the burden might be high in the first case but then low in later cases—once the software is created, it might be reused—do you consider just the cost in the one isolated case or do you amortize burdens over the expected future cases?

Finally, as if the picture wasn't unclear enough, some of criteria mentioned in New York Telephone appear to favor the government and some appear to favor Apple. On one hand, the government's case for necessity is strong. Apple has apparently designed its software so that Apple's help is required to disable the features that block password-guessing. If the government's worries of being observed in New York Telephone were enough to create necessity in that case, Apple's design decisions seem to have created necessity here.

On the other hand, there's a big difference between Apple's business and New York Telephone's business. Remember how the Supreme Court discussed the telephone company's view of pen registers. True, the phone company didn't want to help the government for privacy reasons. Nonetheless, the Supreme Court wrote,

it can hardly be contended that the Company, a highly regulated public utility with a duty to serve the public, had a substantial interest in not providing assistance. Certainly the use of pen registers is by no means offensive to it. The Company concedes that it regularly employs such devices without court order for the purposes of checking billing operations, detecting fraud, and preventing violations of law.

In contrast, Apple is not a public utility with a duty to serve. See also In Re Application, 1616 F.2d 1122 (9th Cir. 1980) (applying New York Telephone, and concluding that the phone company's "highly regulated, public nature" is "to a great extent" responsible for the AWA allowing an assistance order).

And perhaps more importantly, the creation of the software that the government wants Apple to write is extremely "offensive" to it. Apple does not have this software, and Apple considers it extremely important that it not be created. In Apple's view, complying even just once with the Court's order would have profound implications that would hurt its product and "undermine the very freedoms and liberty our government is meant to protect." Recall chief executive Tim Cook's open letter:

The government is asking Apple to hack our own users and undermine decades of security advancements that protect our customers—including tens of millions of American citizens—from sophisticated hackers and cybercriminals. The same engineers who built strong encryption into the iPhone to protect our users would, ironically, be ordered to weaken those protections and make our users less safe.

V. Conclusion

As I mentioned in my first post, I don't know which side should win. Part of the reason is that I'm waiting on development of the facts. But as this post has showed, part of the problem is that the scope of authority under the AWA is just very unclear as applied to the Apple case. This case is like a crazy-hard law school exam hypothetical in which a professor gives students an unanswerable problem just to see how they do.

My next post will cover some of the policy questions that the case raises. In a lot of ways, those are the most interesting parts of the case. Time permitting, I will have that up sometime next week.