A Message to Our Customers - Apple

[jyl]

Good one, FBI. Give the Chinese cover.

[Hugh R]

I'm sure I can trust the Gubmit just like they secured the SSA, GSA, and IRS from hacking. Yeah that's the ticket.

[motion]

Originally Posted by stomachmonkey

This is not about the phone, it's a stick being used to beat tech companies into compliance.

Prescience, my friends. Prescience.

[wdfifteen]

My thoughts.

This whole episode is a lot of sound and fury over not much.

The San D. killers took pains to cover their tracks in every other way. It’s not likely that there is any useful information left on the phone.

I think Apple should have written the code (if it really didn’t have it already) but never hand it over to anyone. The FBI should have been required to get a court order to have the phone sent to Apple to be decrypted.

I understand the paranoia about our government having too much power, but that’s just one government in a big world. We may be giving the bad guys a tool that we won’t have. In the US we are in a unique position to have and voice opinions about what our government does and have the government respond. No president of the US can successfully decree that all non-decryptable phones be confiscated. But that is a real possibility in many big phone markets.

Right now it's just between Apple and a judge. If Cook gets his way and congress writes a law, it won’t stop at decrypting just one phone, and may not stop at only decryption. What if congress writes law that makes non-decryptable phones illegal? It’s not likely to happen here in the US (at least we wouldn’t be the first), but would Cook give up sales in the middle east and China for his principles if their dictators outlaw encryptable phones? Would Cook build a special encryptable iPhone just for the US market?

But really, it will all be moot soon.

This episode has brought email security to public attention. Self destructing email is here now (Dmail) and may become so popular and widespread that this whole controversy will be moot in a few months. It’s long term implications are that there will be no value in decrypting a phone to get to email.

[stomachmonkey]

Going to agree and disagree on a couple of points Patrick.

1st I also don't believe there is squat on that phone. It's not logical.

I think Apples position is correct. This is about far more than one phone.

I have not found an English language source for this legislation but from the way the article reads what Apple has done is a loophole for China's legislation.

How can Apple be forced to comply? They can't hand over any keys because they don't have them.

China Passes Law to Require Encryption Keys from Tech Companies, Cites American Precedent - Breitbart

It's more than just email.

Smart phones have become the wallet / purse / bank accounts / safe deposit boxes / credit cards / payment systems / medical records / address and phone book / keys to secure our homes and businesses / security system monitors / lifelines for the elderly and disabled / etc...

We are around the same age and embrace technology but we are in transition. We still rely to some degree on the older "analog" systems.

Our kids, completely different story.

Millennials. whether we agree with it or not, will be using current and future tech in ways we can't even imagine.

Security and integrity of data is IMHO the single most critical issue.

Big tech, Apple, google, they all know this and they are acutely aware that once government gets their foot in the door it won't be long till they are flopping on the couch eating all the food and drinking all the beer and the only way to get them to leave will be to burn the house down.

This is a really huge deal.

[pcardude]

I wish more companies would do this. This site has been used in a few lawsuits iirc they even got deleted account info. It's a shame big brother is such a bully.

[GH85Carrera]

Originally Posted by stomachmonkey

Smart phones have become the wallet / purse / bank accounts / safe deposit boxes / credit cards / payment systems / medical records / address and phone book / keys to secure our homes and businesses / security system monitors / lifelines for the elderly and disabled / etc...

We are around the same age and embrace technology but we are in transition. We still rely to some degree on the older "analog" systems.
This is a really huge deal.

I have a iPhone 6S 128 gig model and am a somewhat tech savy.

I indeed have tons of personal data on my phone. My address book is large and has every doctor and business I deal with. All my friends and much more.

I have a lot of email synced and many other things I would never want any government agency or business to have free access to it. I backup data files from my home computer to my iPhone and tons of photos. I have my spreadsheets, investments and lots of my "stuff" on there. I call it my second brain.

And yes the files are password protected.

There is little doubt Google and the NSA can track my movements. They will be bored to tears. Look, Glen went to work, then he went to lunch, back to work and back home. Ohh wow, they went to eat Mexican food for dinner. I still don't want to be tracked like that.

I sure don't want any police agency to have access to my phone. I don't do anything even slightly illegal, but it is my personal stuff and they don't get to see it.

[jyl]

I would guess that a future update of iOS will require a PIN for subsequent updates of the OS, and repeated wrong PIN entries will slow and ultimately wipe the phone.

[wdfifteen]

Originally Posted by stomachmonkey

How can Apple be forced to comply? They can't hand over any keys because they don't have them.

As I said, a government can forbid a phone company into its market unless there is a built-in back door. I'm not saying they should, but they can. Again, I don't think Cook is going to give up all future sales in, say China, for this principle.

Originally Posted by stomachmonkey

Smart phones have become the wallet / purse / bank accounts / safe deposit boxes / credit cards / payment systems / medical records / address and phone book / keys to secure our homes and businesses / security system monitors / lifelines for the elderly and disabled / etc...

All the more reason to make them accessible, or somehow change 200 years worth of laws. Our laws are written so that we don't have the level of privacy claimed for smart phones. There are whole lists of records the courts can currently demand access to that can be hidden behind a smartphone firewall.

Originally Posted by stomachmonkey

We are around the same age and embrace technology but we are in transition. We still rely to some degree on the older "analog" systems.

True enough. And I'm way behind you.
I don't trust smartphone manufacturers or telecom networks any more than I trust the government. I think I'm more at risk from some hacker than from the FBI.

[GH85Carrera]

Originally Posted by jyl

I would guess that a future update of iOS will require a PIN for subsequent updates of the OS, and repeated wrong PIN entries will slow and ultimately wipe the phone.

Current iPhones are pretty much that way now. To update the OS you have to log on with the pin or a thumbprint.

If you don't use a pin to access your phone then all bets are off because anyone can use it.

One of the biggest reasons I upgraded to a 6S was the thumbprint log on. I understand that is the cops had me and the phone in custody they could press my finger or thumb and have access. That is not likely to happen.

[foxpaws]

Originally Posted by wdfifteen

All the more reason to make them accessible, or somehow change 200 years worth of laws. Our laws are written so that we don't have the level of privacy claimed for smart phones. There are whole lists of records the courts can currently demand access to that can be hidden behind a smartphone firewall.

Actually the Supreme Court gave cell phones the same level of privacy as our homes in Riley v California.

[stomachmonkey]

Originally Posted by wdfifteen

I think I'm more at risk from some hacker than from the FBI.

That's the point.

Forcing Apple to create something that defeats it's own security puts you at far greater risk from both.

Think of it as a tool that makes the locks on your doors useless, disables your alarm system, opens your safe, and makes the guy breaking in invisible.

[wdfifteen]

Originally Posted by stomachmonkey

Think of it as a tool that makes the locks on your doors useless, disables your alarm system, opens your safe, and makes the guy breaking in invisible.

That's exactly what I think phone manufacturers can have any time they want. They may have it now. As I said, I don't trust them any more than I trust the FBI.

[wdfifteen]

Originally Posted by foxpaws

Actually the Supreme Court gave cell phones the same level of privacy as our homes in Riley v California.

Then what's all the fuss about?
Yes, you can get a court order to have an expert open your wall safe. Apparently you can't get one to open your iPhone.

[stomachmonkey]

Originally Posted by wdfifteen

That's exactly what I think phone manufacturers can have any time they want. They may have it now. As I said, I don't trust them any more than I trust the FBI.

That's what Apple would have if they create the tool that the FEDs want and exactly why they have not done so as of yet.

They intentionally created a system that by design not even they could access.

[foxpaws]

Originally Posted by wdfifteen

Then what's all the fuss about?
Yes, you can get a court order to have an expert open your wall safe. Apparently you can't get one to open your iPhone.

It is like giving the fed the ability to crack all safes - and beside the front 'door' all safes have a back panel, and although it too has a combination lock, the fed can access it. If the feds pick you up, and you have the safe in your back seat and they take it - they may be able to access it without your knowledge - it may be you don't even know that the fed has been in your safe when they finally give it back to you...

What the court order says is that the 'hacking' of this particular phone has to be done at a government facility - where no doubt the government will own everything that happens there - or, they have to be 'remotely attached' and they will have access to the recovery process ...

2. The SIF will be loaded on the SUBJECT DEVICE at either a government facility, or alternatively, at an Apple facility; if the latter, Apple shall provide the government with remote access to the SUBJECT DEVICE through a computer allowed the government to conduct passcode recovery analysis.

And if they can get in without your knowledge - do you really think they are going to mess with those nasty warrants all the time?

[scottmandue]

I read the first page when this started and I'm too lazy to read the additional two pages.
I believe it was stated early on (maybe by JYL?)
Why doesn't the FBI just give apple the phone.
Apple pulls off all the data and puts it on a thumb drive and hand the phone and thumb drive to the FBI?

[jyl]

I think China will sooner or later (probably sooner) force tech companies to build backdoors into all smartphones, computers, network hardware sold in China.

I'd speculate Apple will eventually have to build two types of iPhone or two builds of iOS. One that is insecure, for sale in China. One that is secure, for sale in the US. The US-spec phones will no doubt command a premium in China.

Unless the US government copies the Chinese govt and mandates phones and computers all have backdoors that will allow government access to personal data. Which some US politicians want.

[jyl]

Originally Posted by scottmandue

I read the first page when this started and I'm too lazy to read the additional two pages.
I believe it was stated early on (maybe by JYL?)
Why doesn't the FBI just give apple the phone.
Apple pulls off all the data and puts it on a thumb drive and hand the phone and thumb drive to the FBI?

Data is encrypted. Phone is locked.

FBI isn't really trying to get the data off this phone. It was the guy's work phone, issued by the County of San Bernardino. He wouldn't have used it for anything secret. He used his personal phone and computer for that, and he carefully destroyed/disposed of those before the attack. Obviously he would have done the same to his county phone, had there been any reason to do so.

FBI is using this case, because it involves a terrorist mass killer, to establish a legal precedent that it can force Apple and other tech companies to develop new ways to access data that is otherwise protected.

Before iOS 8, iPhone data was not encrypted. It was fairly easy to get data from those iPhones and Apple complied with warrants/court orders to do so. Starting with iOS 8, iPhone data is encrypted and Apple does not have the encryption key, and govt/Apple cannot brute-force guess the PIN to unlock the phone and get the decrypted data, because the phone slows down and finally wipes itself after too many incorrect PINs are tried. But govt came up with this idea that the phone can be booted from a custom version of iOS that does not have protections against brute-force PIN guessing, and got a court to order Apple to develop such a custom iOS.

Apple can keep building new protections into iPhone/iOS to make them more secure. Govt, if it has its way, will keep ordering Apple to devote engineers and resources to find ways to break the protections it built. Eventually Apple will find protections that are not, as a practical matter, breakable. Then govt will try to pass a law prohibiting those protections.

[jyl]

Arstechnica wrote

To make this order more palatable, the court and the FBI stress that the software should work only on the 5C model owned by Farook. And this is the rub that generates legitimate concern. The court order provides no guidance on how Apple engineers should enable the restriction. No doubt, there are a few different technical avenues that might make it possible. For instance, the custom iOS version might be programmed to install only on a device that matches the exact hardware ID number corresponding to Farook's phone.

But as the order is drafted now, there are no guarantees that government officials won't get access to the software. That means it's also feasible that any software Apple produces would be reverse-engineered by government engineers and very possibly private forensics experts who regularly work with law enforcement agencies. And if the past digital rights management bypasses are any guide, odds are that with enough analysis, someone will figure out a way to remove the restriction that the OS install itself only on Farook's phone. From there, anyone with access to the custom iOS version would have an Apple-developed exploit that undoes years of work the company put into securing its flagship iPhone product.

It's always risky when judges with little or no technical background make legally binding orders compelling the design of software with so many specific requirements. How can US Magistrate Judge Sheri Pym know if it's even possible for Apple to design a version of iOS that will install on only a single, designated phone? And how is anyone supposed to know that such a measure can't be bypassed the way so many other software restrictions are hacked? The answer is she can't know, and neither can anyone else.

Besides the potential for abuse, some critics argue that a court-ordered exploit sets a dangerous example on the international stage. "This move by the FBI could snowball around the world," Sen. Ron Wyden (D-Ore.) told The Guardian. "Why in the world would our government want to give repressive regimes in Russia and China a blueprint for forcing American companies to create a backdoor?" If countries know Apple already has created the software needed to bypass iPhone security, the temptation to order Apple to use it would be strong, critics say.

It would be one thing for the court to order Apple to brute force this one device and turn over the data stored on it. It's altogether something else to require that Apple turn over powerful exploit software and claim that whatever digital locks are included can't be undone by a determined adversary. That's why it's no exaggeration for Cook to call Tuesday's order chilling and to warn that its prospects for abuse of such a backdoor are high.

One part of this has already come true - see China's new law, justified by China as no different than what Western countries are doing. China passes controversial counter-terrorism law | Reuters

China's parliament passed a controversial new anti-terrorism law on Sunday that requires technology firms to hand over sensitive information such as encryption keys to the government

Speaking after China's largely rubber-stamp parliament passed the law, Li Shouwei, deputy head of the parliament's criminal law division under the legislative affairs committee, said China was simply doing what other Western nations already do in asking technology firms to help fight terror.

"This rule accords with the actual work need of fighting terrorism and is basically the same as what other major countries in the world do," Li told reporters.