The Timing of Computer Search Warrants When It Takes the Government Several Years To Guess The Password

Ex ante restrictions are back, and they're still causing trouble, now in United States v. Kopankov.

In a decision handed on Friday, United States v. Kopankov, the U.S. District Court for the Northern District of California (Jacqueline Scott Corley, J.) suppressed the fruits of a computer warrant search because it took the government too much time to bypass the device's encryption.  Specifically, the magistrate judge who issued the warrant had imposed an extra limit on the warrant requiring the government to forensically search the seized computer quickly, and to request extensions from the court asking for more time if it needed longer.  But the government could not bypass the encryption on the computer — an Apple iPhone X — other than by trying a "brute force" attack to guess all the possible passwords.  The government did get one extension giving it more time.  But it ended up taking three years for the brute force attack to guess the correct password.  By that time, the extension had itself expired.

In the new ruling, Judge Corley suppresses the fruits of the search because the brute force attack did not succeed until after the extension had expired.  Specifically, the government mirrored the decrypted device (generating a copy to be searched) before applying for another search warrant to search the device. Judge Corley concludes that the mirroring was a warrantless search that requires suppression of the evidence found on the warrant.

I think this ruling is wrong.  Not only should the evidence not be suppressed; there was no legal violation at all.   The government had a valid search warrant, and there is no principle of law that makes a defendant's ability to slow down a search by using encryption a legal basis for suppressing the evidence when the search eventually succeeds.  In this post, I will explain why.

I. Background on Ex Ante Restrictions on Computer Warrants

First, some context.  I have written over the years about ex ante search restrictions in computer search warrants.  These are limits sometimes added to computer warrants that purport to control ex ante the details of how the warrant is executed.  With traditional warrants, the warrant authorizes the search, and Fourth Amendment doctrine regulates the reasonableness of the warrant's execution.  With ex ante restrictions, though, the warrant itself will include detailed limits on how the warrant will be executed.  The limits might be on who can search the device, or when, or where.  It might be about what steps are taken when the warrant is executed.  It's all up to the discretion of the magistrate judge.

One of the issues that has come up from time to time is why or whether ex ante restrictions matter. In particular, if the government violates an ex ante restriction, what is the remedy?

I have argued that there is no remedy.  In my view, as explained in detail here, the Fourth Amendment does not permit magistrate judges to impose ex ante restrictions on warrants.  The law of executing warrants has to be based on Fourth Amendment law, not individual-warrant-condition-by-individual-magistrate law.  As a result, in my view, the government is entirely free to disregard ex ante restrictions and there is no legal wrong, or legal remedy, if they choose to do so.  The government has to follow the law of Fourth Amendment reasonableness, of course.  But individual warrant restrictions don't determine reasonableness; Fourth Amendment law does.

If that seems odd to you, you should read the Supreme Court's decision in Richards v. Wisconsin, on whether a warrant can be executed as a no-knock warrant.  Richards held that the fact that the issuing magistrate had said the warrant could not be executed as a no-knock warrant was irrelevant to whether it could be.  That wasn't a decision for the magistrate judge to make, so the magistrate judge's determination was entitled to zero deference.  Reasonableness was determined by the facts that existed when the agents executed the warrant, Richards held, not the magistrate's view of how the warrant should be executed when reviewing the warrant application.  In my view, that same standard naturally applies to ex ante limits in computer warrants.

II. The Nicholson Precedent in the Eleventh Circuit

A recent decision of the Eleventh Circuit came at least somewhat close to this position. In United States v. Nicholson (2022), the magistrate judge required that the computer to be seized must be forensically searched within 60 days of the warrant being issued.  The government searched the computer after 60 days had passed, however.  The Court ruled that this did not violate the Fourth Amendment, as there was no Fourth Amendment limit on when the forensic search occurred after the computer was seized.  So far, so good.

Nicholson erred, though, in my view, at the next step.  Instead of saying that there was no remedy at all, however, the court (per Brasher, J.) stated that the ex ante warrant violation was "comparable to a violation of Rule 41 of the Rules of Criminal Procedure, which contains a temporal limitation similar to the magistrate judge's addendum."  This is, to my mind, rather puzzling. We normally base remedies on the source of the law violated, not whether the violation resembled a violation of some other authority that serves a sort of similar function as the one at issue.  But that led the court to look at whether there was an intentional violation of the ex ante restriction,  part of the Rule 41 suppression standard.  Because the violation of the ex ante restriction was unintentional in that case, there was no suppression of the evidence.

Whatever you think of Nicholson, at the very least it should be clear, from Richards, that ex ante restrictions are not themselves binding and are not themselves Fourth Amendment law.  A magistrate judge can add any restriction they want to the warrant, at least in theory.  Maybe the restriction is that the forensic process can only be executed if the forensic expert's middle name is Herbert, or if it's Tuesday between 2:00 and 2:07pm, or if the forensic expert is listening to John Coltrane's "A Love Supreme."  These are not restrictions on reasonableness, as reasonableness is already provided by Fourth Amendment law; all the ex ante restrictions can do is add non-Fourth-Amendment-limits outside reasonableness.

III. The new decision in United States v. Kopankov

In the new case, the  government seized the defendant's iPhone on the defendant's arrest on April 3, 2019.  On April 9, 2019, six days later, it obtained a warrant to search the phone.  The local forensics lab couldn't break into the phone, though, so the phone was sent to the FBI.  In 2020, the FBI started a brute force attack on the phone to try to get in, repeatedly guessing combinations of 6-digit passcodes.  The brute force attack succeeded three years later, on May 2, 2023.

What's the problem?  The 2019 warrant had an attachment, Attachment C, in which the warrant had a condition that the government had to execute the warrant in a certain number of days.  In particular, there was a time limit on how quickly the government had to make a mirror image of the phone to begin the search. When the brute force attack began, the government applied for and obtained an extension of that time, until June 20, 2021.  But the brute force attack didn't succeed until almost two years later, in May 2023, at which time a mirror image was made before the government applied for another warrant to search the image.

So what's the legal relevance of the violation of the ex ante restriction?  Judge Corley treats the violation of the ex ante restriction as if it nullified the existence of the warrant.  Because the government did not get another extension, and the brute force attack did not succeed until after the extension had expired, any search that occurred after the extension expired was warrantless and therefore violated the Fourth Amendment.  Judge Corley puts this starkly: "The government got a warrant. But it expired."

As I explained above, that is completely wrong, in my view.  See Richards, etc. But with that faulty premise as the foundation, Judge Corley then looks to whether the government engaged in a post-expiration search.  The government argues that it made the mirror-image but did not search the phone before it applied for another warrant.  But Judge Corley concludes that making an image is actually a search:

The examiner declared he "physically took the device, unlocked the device using the passcode, and plugged it into a GrayKey device (which resembles a small box), using the DEVICE's 'lightening' port." (Dkt. No. 304-5 ¶ 33.) And he did so to download the contents of Defendant's phone onto a USB drive. (Id. ¶ 32.) Put differently, that physical invasion into Defendant's constitutionally protected device downloaded "the privacies" of Defendant's life. Riley, 573 U.S. at 403. That physical invasion constitutes a search. Cf. United States v. Sam, No. CR19-0115-JCC, 2020 WL 2705415, at *2 (W.D. Wash. May 18, 2020) (powering on a phone to take a photo of the phone's lock screen constituted a physical search).

Because it was a search, it was a warrantless search, and the evidence found on the phone is a fruit of that unlawful mirror image should be suppressed:

The examiner effectively stood on Defendant's doorstep and tried fitting different keys into his front door lock for years after the warrant expired. Then, when the door finally opened, the government entered the threshold and seized the information therein and reviewed some (but admittedly not all) of it. Now the government asks to excuse this unlawful entry because the government "had been hoping for the phone to be accessed for years." (Dkt. No. 304 at 8.) Maybe so. But they only got a warrant after the illegal search yielded the information they hoped for. Put differently, if the government's conduct were excused here, [the list of ex ante restrictions], which was expressly part of the warrant, would become a nullity because its carefully calculated time limits would be meaninglesss.

Further, the good faith exception applies because deterrence is needed to make sure the government stays focused on getting lots of extensions for phone warrants over the years to allow brute force attacks to go on:

The government claims this situation is unlikely to reoccur. But the evidence is to the contrary. The government's declarations describe "entire racks of phones" undergoing "brute force attacks for years." (Dkt. No. 304-4 ¶ 11.) So this not only can, but will happen again unless the government ensures it has a valid—and generally required warrant to peer inside those phones. Riley v. California, 573 U.S. 373, 386 (2014). Exclusion here will ensure greater care is taken with such devices.

IV.  My View

I think Judge Corley's decision is wrong, and that it's wrong in a way that points out the absurdity of ex ante search restrictions. Think about it.  The government had a search warrant based on probable cause.  The Fourth Amendment permitted the government to search the phone.  If the government had been able to break into the phone quickly, that would have been legally fine.  The government was trying to execute the warrant, but the only way to get in was a brute force attack that could —and did— take years.  Under prevailing caselaw, there is no Fourth Amendment limit I'm aware of on how long the government has to execute the warrant by trying to break into the seized phone.

But under the new decision, the evidence found on the phone is suppressed because the brute force attack happened to take longer than the date the magistrate judge listed as a new date when the government obtained the extension.   This seems pretty bananas to me. The magistrate judge doesn't know anything about computer forensics or how long the brute force attack is going to take.  Why should the magistrate judge get to say if the government is allowed to continue its efforts to execute the warrant?  The Fourth Amendment requires the government to have a warrant, of course. And the government had a warrant here, that it was earnestly doing its best to execute.  Requiring the government to exercise "greater care" to make sure it is keeping up with a series of requests to continue to make the brute force attack on a bunch of seized phones — requests not required by the Fourth Amendment, which is the law that should count in the first place — seems exceedingly odd to me.

I realize that some will say, well, the magistrate judge sets the rules.  They are the Law Lords and, from on high, they decide what is authorized under the warrant.  But again, that's the exact opposite of what the unanimous U.S. Supreme Court held in Richards v. Wisconsin. There, the magistrate's decision that the warrant could not be executed as a no-knock warrant was not only not binding; it was 100% irrelevant.  To me, it seems exactly the same with ex ante restrictions on warrants.  How the government executes warrants is up to appellate courts and the Fourth Amendment law of reasonableness, as adjudicated ex post.  It is not up the whims of individual magistrate judges as imposed ex ante.

Comments

[John F. Carr]

While the government's action here is not explicitly allowed by Rule 41, the intent of the drafters appears to be that it should be allowed. Rule 41(e)(2)(B):

A warrant under Rule 41(e)(2)(A) may authorize the seizure of electronic storage media or the seizure or copying of electronically stored information. Unless otherwise specified, the warrant authorizes a later review of the media or information consistent with the warrant. The time for executing the warrant in Rule 41(e)(2)(A) and (f)(1)(A) refers to the seizure or on-site copying of the media or information, and not to any later off-site copying or review.

The warrant applies to the physical device, not copies of it, and the time limits are for obtaining the data and not for using it.

[Orin S. Kerr]

The comments made by the Advisory Committee can help shed light on ambiguities in the Rules. But they are not the enacted Rules, and they certainly don't change the meaning of the Fourth Amendment. (In any event, I explain in the linked to article why that passage from the comments doesn't change anything.)

[Noscitur a sociis]

I'm not sure I understand - isn't that quotation directly from the enacted text of Rule 41?

[Orin S. Kerr]

Oh, sorry, I assumed you were quoting the commentary that talked specifically about ex ante warrant restrictions. As for the Rule, this is off-site review; no one claims the rule applies to limit the timing of this.

[Noscitur a sociis]

Well, I didn't quote anything. But I take John F. Carr's point to be that the rules seem to expressly contemplate no time limit and that it accordingly seems odd for the magistrate judge to try to impose one.

[Gandydancer]

On the contrary. The “Unless otherwise specified…” bit seems to assume that Kerr is wrong to say that the issuing judge cannot do more than issue the warrant and that the conditions of its execution are thereafter only subject to such restrictions as the Constitution may impose.

[Orin S. Kerr]

I’ll refer interested readers to my discussion of these issues in the 2010 article I link to above, which as I recall we debated at great length in prior Volokh comment threads.

[mse326]

I read the "unless otherwise specified..." language to be about searching the seized device. Recall it has been made clear that probable cause to seize a device does not necessarily mean probably cause to search the device. The language is saying the warrant allows the search unless the judge says otherwise.

I don't see it as applying to the time limitation part because that is a completely new sentence. There doesn't seem to be anything linking the two such that the modifier crosses.

[Gandydancer]

If merely "powering on a phone to take a photo of the phone's lock screen constituted a physical search", then merely continuing the brute force attempts to access the device's memory after the warrant expired was a violation of the terms of the warrant. In the event, the search was not successfully performed and the data was not "obtained" until after the warrant had expired.

I am unconvinced that the judge that issues the warrant based on the reasonableness of the search requested cannot apply any conditions to the continued reasonableness of the search he has authorized.

[mse326]

That is where you make your mistake. The judge doesn't issue a warrant based on reasonableness but on whether there is probable cause for a search.

[santamonica811]

I take it that the same rationale would apply to written documents that were written in a very sophisticated code. The govt (Orin argues, I think), should be allowed to photocopy all the pages, and then have an unlimited amount of time to try and break the code. (While also, I gather, returning the original documents to the defendant, after some point in time.)

I’m not saying I agree or disagree with the govt’s position. (I see pluses and minuses on both sides.) I’m just trying to make sure I understand what the govt is arguing for.

Also, one more question: If the govt does indeed make a copy of a phone, or of written documents, etc etc; is the govt then legally required to immediately return the original(s) to the suspect? Does it have a week to return them to the suspect? A month? A year??? If the govt now has an identical copy, what would be the legal justification for keeping the original data or object even one additional day?

[Gandydancer]

No, in this case the “photocopying” could take place only AFTER the government had continued to attempt to execute the warrant beyond the term allowed by the warrant.

As to when seized evidence that the government can no longer examine because a warrant has, by its own terms, expired needs to be returned to its owner… that is a more general issue. There’s a recent SCOTUS case where a retrial of an individual twice convicted of procuring a murder for hire where a complaint about the way the case was handled included the fact that cash owned by the victim was “prematurely” returned to the victim’s family. The police had indeed been derelict in properly recording information about the cash and the envelopes in which it had been stored in the victim’s car’s trunk, but it is not at all clear to me if the appropriate way to treat that evidence was to have kept the cash for examination by the defense in the third trial now ordered, a quarter century later. It’s not like the victim’s family (and their creditors — the motel at which the murder took place went bankrupt) didn’t need the money and weren’t entitled to it (though ink on some of it indicated it might have been the proceeds of a robbery, LOL!)

[Rossami]

Uh, no. That's not the way a forensic collection works. You snapshot the encrypted drive, copy it onto new hardware, then attempt decryption, keeping your "master" copy of the original encrypted content intact. Anything less could be counted as spoliation.

That may be less true for cloud-stored information that is comingled with other content not subject to the warrant but anything on a separate drive is definitely copied first, then decrypted.

[Noscitur a sociis]

I take it that the same rationale would apply to written documents that were written in a very sophisticated code. The govt (Orin argues, I think), should be allowed to photocopy all the pages, and then have an unlimited amount of time to try and break the code.

What possible argument is there that the government wouldn't have the authority to do this?

If the govt now has an identical copy, what would be the legal justification for keeping the original data or object even one additional day?

The legal authority is the warrant itself, of course. The practical need is that the government may not have accurately copied everything it wanted to, and also may have an interest in preserving the original in case the authenticity of the copy is challenged. (That's not true in every case, of course, and it's not uncommon for property to be returned after it's copied. But that's why a blanket rule wouldn't be appropriate.)

[Gandydancer]

Again, the analogy is inapplicable. The copy of the memory could not be made until the passcode had been already obtained, and the FBI did not succeed in doing that until it had already let the warrant expire.

All the FBI had to do to keep attempting entry to the phone was to get the issuing judge to extend the warrant's expiration date. If there was any delay they could merely remove the phone from the rack until they got permission to continue. How hard is that?

[Toranth]

The standard practice is to take a copy of the encrypted data, and then attempt decryption. Copies are a backup, a chain-of-custody item, a proof of work, and a multiple work target all in one.

[Noscitur a sociis]

Further, the good faith exception applies…

*Does not apply, surely?

[Jaypd]

I know you have insisted on your view of Magistrate powers for warrants for years now, but I still don't understand them. Perhaps if you did a paper on restrictions in warrants you could get me to follow you. To me- the restrictions have to do with reasonableness. I do not understand why you think that a warrant is a pure quid-pro-quo arrangement. PC affidavits go in, warrants come out. Ignoring for a moment the exclusionary rule, and just speaking of what a Magistrate can put in a warrant that governs the behavior of the government during a search/seizure, where do you come up with the concept that Magistrate cannot do that at all?

Ok- you're going to say but Richards. That's an odd choice to my mind- to me, that case is just about exigency. SCOTUS recognized that at the time the warrant was requested a magistrate couldn't know what cops at the time knew- an exigency came into existence. Arguably- with cell phones and electronic warrants, this case is ripe for overruling. But Richards didn't even end the practice of no knock warrants- are you thinking of hudson v michigan? but now we're just talking about the exclusionary rule. Fortunately where i practice SCOTUS's inability to understand that no knock warrants = death doesn't apply, we have a decent state constitution. But to say that magistrate's can't put on ex ante restrictions just.. where is this coming from?

[Orin S. Kerr]

I link to the paper three times in the post. It's here: https://www.virginialawreview.org/wp-content/uploads/2020/12/1241.pdf

[Jaypd]

Sorry i meant a newer paper. This paper was clearly wrong when it was written.
You begin by insisting, basically, on some special aspect of computer warrants.
You then claim if anything the newness of the area means magistrates should stay out.
(Great reason to rewrite this paper)
Anyway-you go on to try to show that ex ante restrictions are disfavored, but your cases say nothing of the sort. You sound like an interested party not an academic. I'm not going to go into detail you know why these cases don't back you up.
And then you go into ex ante restrictions and talk a lot of shit. But here's the thing Prof. Every single argument you make applies to the entire concept of warrants. If we take you seriously, then fuck warrants. They do all the bad things you say. Why not always do things ex post?

You want to know why professor? Because we don't want our homes destroyed by the government. You don't seem to understand, even a little, why because you're a white academic with no concept of being the target of police misconduct.

Screw you man.

[Orin S. Kerr]

" I’m not going to go into detail you know why these cases don’t back you up. Screw you man" is an interesting argument. But from what I have been told, a good number of federal magistrate judges have been persuaded by my article not to attach ex ante restrictions. If you have a counterargument, or at least one that goes beyond "Screw you man," I hope you will write it up to add to the debate over this question so those magistrate judges (and I) can reconsider their position.

[CapitalistLionTamer]

My counterargument is that a warrant is a permission slip to violate rights. (I mean, that's what's meant by "reasonable" searches. Either they're "reasonable" because the judicial part of the checks/balances system granted permission or they're "reasonable" under other parameters ["plain view," "third party doctrine," etc.]. What's reasonable about allowing the government to perform a search whenever it feels like it, even if it has a warrant?

To prevent rights violations (or at least minimize them), it makes sense to add restrictions to granted warrants. No warrant should be issued with the assumption the government can execute it whenever it wants to.

[Orin S. Kerr]

Warrants already have time limits, under the Rules. The issue here is whether an individual judge can add whatever additional time limits they personally and individually would like on top of those time limits provided by the Rules.

[Noscitur a sociis]

PC affidavits go in, warrants come out.

That is very literally what Rule 41 contemplates:

After receiving an affidavit or other information, a magistrate judge--or if authorized by Rule 41(b), a judge of a state court of record--must issue the warrant if there is probable cause to search for and seize a person or property or to install and use a tracking device.

Fed. R. Crim. P. 41(d)(1) (emphasis added).

[Gandydancer]

The judge concluded there was PC and accordingly issued the warrant. So that verbiage is beside the point.

[mse326]

(1) In General. After receiving an affidavit or other information, a magistrate judge—or if authorized by Rule 41(b), a judge of a state court of record—must issue the warrant if there is probable cause to search for and seize a person or property or to install and use a tracking device.

That is directly from Rule 41(d)(1). The rules are exactly that. The judge must issue if there is probable cause. 41(e)(2) says what it must contain. It includes a time limitation on execution but also says that only applies to seizure not the copying or searching.

No where does it allow the judge to insert other restrictions

[Commenter_XY]

Wait, a warrant is issued by a judge, and once that happens, there is no time limit or expiration to the warrant? If I am following this correctly, could a judge could issue a warrant in 2023, and law enforcement could delay executing the warrant for 20 years, until 2043 and that is A-Ok with 4A? That seems odd to me. Did the Founders ever debate whether a warrant should have a time limit in their debate/deliberation over 4A?

Then again, don’t we occasionally solve a cold case with old biologic specimens? That was evidence seized under warrant, and kept by law enforcement for years, decades even, and some kind of genetic connection was made to a perp. Is that a 4A violation? Is that analogous to the situation the iPhone guy ran into with the brute force crack?

(also want to say....this post by Prof Kerr was really interesting)

[Gandydancer]

It would be analogous if the warrant allowing seizure of the biologic specimens did not, e.g., require their destruction or preclude further examination after a period of time. Kerr wants to preclude such an obstacle to the collection of DNA databases, apparently. If examination of your DNA excludes you as a suspect in the crime prompting an investigation, well... hell, it was a valid warrant at the time, wasn't it? Let's just keep your DNA sequences on file forever, and the judge who issued the warrant has no say in restricting something like that.

[David Nieporent]

Wait, a warrant is issued by a judge, and once that happens, there is no time limit or expiration to the warrant? If I am following this correctly, could a judge could issue a warrant in 2023, and law enforcement could delay executing the warrant for 20 years, until 2043 and that is A-Ok with 4A?

Well, no, because there must be probable cause to believe that there's evidence in the place to be searched. If there was p.c. to believe there was evidence in a particular place in 2023, that doesn't remotely mean there's still p.c. to believe the evidence is still there in 2043. But that applies to a warrant for an ordinary physical location, where things get moved over time. But if there's p.c. on a phone, the material is still going to be there regardless of the passage of time, as long as the phone still works.

[ducksalad]

If the police are entitled, over the objections of the judge, to escalate every search into flash bang grenades and kinetic entry, then if I were a judge I wouldn't approve any warrant for anything unless it was literally worth killing people to get the evidence.

It also strikes me as both reasonable and necessary to put a time limit on how long the government can keep the seized property of people who are presumed innocent. I understand that in this case, the original had been returned, but only after the government had conducted an illegal additional search not authorized by the original warrant. They had plenty of time to ask for another warrant, they neglected to do so, and there should be consequences.

[Orin S. Kerr]

I think you're missing the key point: Fourth Amendment law already strictly limits the use of flash bang grenades. That has been decided by Article III federal court of appeals judges. So you don't need to stop that; it is stopped by the law. The issue here is whether non-Article III magistrate judges can impose whatever additional restrictions outside the Fourth Amendment that they personally want for an individual warrant search, above and beyond what those Article III judges say the law actually is that governs warrants generally.

Of course, if you want to argue that the 4th Amendment imposes limits on how long the government can try to open the locked container, then make that argument. No one in this litigation is doing so. This is about restrictions outside the 4th Amendment, not 4th Amendment law.

[ducksalad]

Thanks for the answer.

[Noscitur a sociis]

Wait, a warrant is issued by a judge, and once that happens, there is no time limit or expiration to the warrant? If I am following this correctly, could a judge could issue a warrant in 2023, and law enforcement could delay executing the warrant for 20 years, until 2043 and that is A-Ok with 4A?

There is a time limit in Rule 41 to when the execution of the warrant can start. There is no time limit on when it can end, nor would that be very realistic, since there's no way to know ex ante what the search will uncover, and thus what a reasonable amount of time to complete it will be. (I would agree that it is unlikely that 20 years would be reasonable.)

That was evidence seized under warrant, and kept by law enforcement for years, decades even, and some kind of genetic connection was made to a perp.

The seizure is complete as soon as law enforcement collects the sample. They don't need a warrant to retain the evidence once they've seized it.

Is that a 4A violation?

No.

Is that analogous to the situation the iPhone guy ran into with the brute force crack?

Not really.

[Gandydancer]

"They don’t need a warrant to retain the evidence once they’ve seized it."

They do if the original warrant expires, and further search of the seized material is prohibited therein

Kerr says this is illegit, but the case allowing exigent no-knock doesn't establish that for distinguishable cases. In fact his recitation of precedents makes clear that judges routinely disagree with him.

[mse326]

"They do if the original warrant expires"

Do you have a citation for this? Because I guarantee that law enforcement isn't destroying any evidence even decades later let alone a couple of weeks

[Sam Bankman-Fried]

My password was always Assfuck69 but then they made me add a special character and so now it is Assfuck69!

[Gandydancer]

TMI.

[Don Nico]

Bye!

[nicmart]

What would be do without the blandest imaginable libertarian lite magazine and lawyers who opt for technic over liberty?

[Life of Brian]

The buried lede here is that a relatively late-model iPhone can be brute-forced in only 3 years. In this day and age there's no rational reason it should be that easy.

[Noscitur a sociis]

1. The fact that it only took three years for this phone doesn’t imply that that’s a typical result: they could have simply been lucky.

2. In my experience, most people want to use 4 or 6 digit PINs, so it’s not like Apple can invent more potential codes.

[Life of Brian]

1. The fact that it only took three years for this phone doesn’t imply that that’s a typical result: they could have simply been lucky.

The original warrant projected the forensic review would be complete within 120 days; a later extension asked for 90 more. That sort of expectation suggests 3 years is actually on the longer end.

2. In my experience, most people want to use 4 or 6 digit PINs, so it’s not like Apple can invent more potential codes.

This issue has little to do with key space. The rightful owner isn't going to try thousands of different incorrect PINs, regardless of length. There's no legitimate reason a phone should allow that long of a string of obvious guesses, or even close to it.

[mse326]

Surely a large part of the time is because the phone locks for a time after a certain amount of wrong attempts. 1,000,000 or maybe even just 10,000 permutations wouldn't take a computer that long to run through. I'm assuming the FBI isn't doing this by hand. So unless you do a permanent lock which would really tick people off, I'm not sure what else they can do.

[Noscitur a sociis]

Phones do lock the user out after a certain number of incorrect attempts. These forensic tools rely on installing software that lets them circumvent these restrictions (at least to a degree). The last trial I heard testimony on it, Graykey could guess one passcode every 15 minutes, which works out to about 28.5 years to guess every 6 digit possibility.

[Commenter_XY]

Maybe the question to ask: If the passcode were 7 digits, and not 6 digits (which took 3 years), how much longer would the FBI have had to 'brute force' the iPhone?

I am guessing it would be much, much longer, right? Lots more numeric combinations to cycle through.

[Dilan Esper]

To me, this is what we want them to do. There were other cases where the government tried to strong-arm Apple to decrypt the phone. That's what we DON'T want them to do.

[bacchys]

The government didn't have a warrant when they finally managed to gain entry into the phone. The warrant had expired. It seems disingenuous to dismiss the time frame of a warrant as "ex ante restrictions" such as prohibiting a no knock (though I think the courts were wrong on that decision, as well).

Under the reasoning you have here, Prof. Kerr, the cops who kept a man well past the time of their warrant to continually subject him to cavity searches were well within their authority because the judge couldn't set any limits on the warrant.

[tkamenick]

"the Fourth Amendment does not permit magistrate judges to impose ex ante restrictions on warrants"

That doesn't make sense. Maybe under the cases you cite, it's not a fourth amendment violation to violate ex ante restrictions, but that doesn't mean 4A prohibits judges adding them.

[CapitalistLionTamer]

"The government was trying to execute the warrant, but the only way to get in was a brute force attack that could —and did— take years."

That can't possibly be true. There's nothing on the record suggesting the government did anything else other than try to brute force its way in. There's nothing in the decision that says other methods were tried, like trying to compel password production or searching for evidence from cloud services or other online services that weren't made inaccessible by the phone's passcode. I think if the government isn't willing to exhaust its options before swearing to judges this was the *only* way to do it, they shouldn't be given a pass when the *only* thing they tried didn't work as well as the agents hoped it would.

I mean, citizens (especially prisoners) are required to exhaust all *their* options before approaching the court. I don't see why the government believes it only has to try one thing, and when that doesn't work, argue it should get a free pass for not even bothering to make a 2nd attempt to extend the timeframe of the warrant.