Why Apple / iPhone were right not to cooperate with the FBI in the San Bernardino Terrorism case; viewed in Light of the NSA hack
A while back, Apple had been ordered by a US court to help the FBI access data – or, in other words, hack their own device – on an iPhone belonging to San Bernardino gunman Rizwan Syed Farook. Farook and his wife killed 14 people in the California city and were subsequently shot dead at the scene by the police. This occurred late last year.
The FBI said that the phone contained information crucial to the investigation into the terrorist incident and that they needed Apple’s help to unlock it. Apple devices are encrypted by default – and have been since September 2014 – and no one other than the owner of the device can gain access without the passcode. The encryption Apple uses is one of the top in the world and that is great news for anyone who appreciates their privacy, but not such good news for law enforcement agencies.
Once a device is locked, the only way to open it is by entering a password or by using the biometric finger scan. If the erase setting is on, the data will be deleted once ten incorrect attempts have been made. The FBI wanted access to the contents of Farook’s iPhone and wanted Apple to do two things:
- Make changes to the device Farook used, such it would be possible to make unlimited attempts at unlocking it.
- Make it possible for the FBI to “brute force” attack the phone to speed up the time it takes to find the correct unlock code. Brute force (also known as brute force cracking) is a trial and error method used by application programs to decode encrypted data such as passwords or Data Encryption Standard (DES) keys, through exhaustive effort (using brute force) rather than employing intellectual strategies.Farook uses a four digit PIN code, which means there are 10,000 possible combinations.
Apple contested the court order, which was based upon a statute from the 1700’s and Tim Cook wrote an open letter to customers explaining the attitude of the company. The letter, in part, reads as follows:
The United States government has demanded that Apple take an unprecedented step which threatens the security of our customers. We oppose this order, which has implications far beyond the legal case at hand.
This moment calls for public discussion, and we want our customers and people around the country to understand what is at stake.
The Need for Encryption
Smartphones, led by iPhone, have become an essential part of our lives. People use them to store an incredible amount of personal information, from our private conversations to our photos, our music, our notes, our calendars and contacts, our financial information and health data, even where we have been and where we are going. [see Riley v. California, 573 U.S. ___ (2014), was a landmark United States Supreme Court case in which the Court unanimously held that the warrantless search and seizure of digital contents of a cell phone during an arrest is unconstitutional.]
All this information needs to be protected from hackers and criminals who want to access, steal, and use it without our knowledge or consent. Customers expect Apple and other technology companies to do everything in their power to protect their personal information, and at Apple, “we are deeply committed to the protection of their data.
Compromising the security of our personal information may ultimately put our personal safety. That is the reason why so important for all encryption has become for us.
“Compromising the security of our personal information may ultimately put our personal safety. That is the reason why so important for all encryption has become for us.
“For many years we have used encryption to protect the personal information of our customers because we believe it is the only way to keep their information secure. We even we found this information from our own range because we believe that the contents of your iPhone are none of our business.”
The Terrorism Case in San Bernardino
“We were shocked and outraged by the deadly act of terrorism in San Bernardino last December. We mourn the loss of life and want justice for all those whose lives were affected. The FBI asked us for help in the days after the attack, and we have worked hard to support the efforts of the government to solve this terrible crime. We have no sympathy for terrorists.” Said Apple.
“They went on: “When the FBI data requested in our possession, we have the information. Apple complies with valid subpoenas and search warrants, as we have in the case of San Bernardino. We also have Apple engineers to advise available to the FBI, and we have our best ideas on a number of investigative options offered at their disposal.
“We have great respect for the professionals of the FBI, and we believe that their intentions are good. Up to this point, we do everything within our power and done within the law to help them. But now the US government has asked us to something we simply cannot, and something we consider too dangerous to create. They have asked us to build a backdoor for the iPhone.
“In particular, the FBI wants us to make a new version of the iPhone operating system, bypassing some important security features, and install on an iPhone recovered during the investigation. In the wrong hands, this software – which does not exist today – would have the potential to unlock an iPhone in one’s physical possession.
“The FBI may use different words to describe this tool, but make no mistake: Building a version of iOS that bypasses security in this way would undeniably create a backdoor. And while the government may argue that its use is limited to this case, there is no way to guarantee such control.”
The Threat to Data Security
Some argue that the construction of a backdoor for just an iPhone is a simple, clean-cut solution. But it ignores both the basics of digital security and the sense of what the government requires in this case.
In today’s digital world, the “key” to an encrypted system is a piece of information that unlocks the data, and it is only as secure as the protection around it. Once the information is known, or a way to bypass the code is revealed, the encryption can be defeated by someone with that knowledge.
Apple has the right to reject this judgment, because what it says is too valuable to lose the game. The government essentially asking Apple to eliminate a crucial feature of the iPhone security and create a key that can unlock any Apple device.
The government wants us to be confident that it will only use this power for good – to protect its citizens against the bad guys – but there is no way this backdoor will not be misused and abused.
While Apple has argued the government’s request could endanger consumer privacy at large, the U.S. has said that it’s asking the company for something quite narrow: tools to crack one iPhone. FBI director James Comey wrote earlier this week that the agency “doesn’t want to… set a master key loose on the land.”
In its new filing, Apple says the U.S. is making that claim even though “the government itself falls victim to hackers, cyber-criminals, and foreign agents on a regular basis.”
A Dangerous Precedent
“Rather than asking for legislative action through Congress, the FBI is proposing an unprecedented use of the All Writs Act of 1789 to justify an expansion of its authority.
[28 U.S. Code § 1651 – The All Writs Act]
the FBI is proposing an unprecedented use of the All Writs Act of 1789 to justify an expansion of its authority.
“The government would have us remove security features and add new capabilities to the operating system, allowing a passcode to be input electronically. This would make it easier to unlock an iPhone by “brute force,” trying thousands or millions of combinations with the speed of a modern computer.
“The implications of the government’s demands are chilling. If the government can use the All Writs Act to make it easier to unlock your iPhone, it would have the power to reach into anyone’s device to capture their data. The government could extend this breach of privacy and demand that Apple build surveillance software to intercept your messages, access your health records or financial data, track your location, or even access your phone’s microphone or camera without your knowledge.
The recent NSA disclosures of hacking tools
One Saturday in August came breaking news that a mysterious group of hackers calling themselves “The Shadow Brokers” claimed to have hacked an NSA-linked group and stole several NSA hacking tools with a promise to sell more private “cyber weapons” to the highest bidder. This mysterious online group claimed to have stolen US “cyber weapons” of a hacking team named Comparison Group. The claims have proven true.
The stolen hacking tools are used by the National Security Agency and the violation of its systems and tools led to a boast by the Shadow Brokers that it has access to a number of secret tools of the agency. In the latest twist, the group is now selling copies of these tools online.
Here are the things you need to know about the fallout
“We will give you some free Equation Group Files,” the Shadow Brokers proclaimed in messages online that offer downloads for the code of the pilfered files. These include malware and hacking tools that are terrifying out in the open for anyone to use. Gone are the days of security thanks to a lack of proper security by the NSA and it’s contractors. Again (read: Edward Snowden). The reason for this, the Shadow Brokers say, is to prove that the information was real and devastating before they sell out the rest of the NSA hacking instruments gathered in the hack. The Shadow Brokers also said the Equation Group “do not know what is lost” and would offer the group the hacking tools for a price, so it will not disclose the data.
“do not know what is lost” and would offer the group the hacking tools for a price, so it will not disclose the data
“The first file contains close to 300MBs firewall exploits, tools and scripts under cryptonyms as BANANAUSURPER, BLATSTING, and BUZZ DIRECTION,” Kaspersky said in a detailed blog post. However, that post made clear that Kapersky saw file logs dated as far back as October 2013.
It is not quite known exactly what the group has access to, but it has a number of images of the files (and their structures) posted on social media. These are believed to come from the comparison group and is claimed to be a small part of what the Brokers have opened. Although messages on Pastebin, Tumblr, and Github have been removed, that still exists by the group on Twitter and Imgur.
Another hacker has claimed to have more of hacking tools stolen from the NSA. According to another technical report published again by security firm Kaspersky Labs, the leaked sophisticated hacking tools include digital signatures that are identical to those in the hacking software and malware that have been previously used by the Equation Group.
“Although we have neither the identity or motivation of the attacker, nor where or how they came to be stolen treasure, we can say that a few hundred tools from the leak share a strong bond with our earlier findings from the Equation Group,” said Kaspersky researchers in a blog post. More than 300 computer files found in the online Shadow Brokers archive have a common implementation of RC5 and RC6 encryption algorithms – which are known to have been used extensively by the Equation Group.
So, it appears that the NSA is working on tools that would access everything in the world. Apple was right to keep our data secure. Privacy may be a quaint notion, but it is the last refuge from an ever-encroaching government. Apple doesn’t need to help the US Government violate the privacy of our cell phones. They seem to have that well in hand all by themselves.