Apple Govt. mandate

[Jim Becker]

You do to update firmware in the normal way....presumably with physical access to the phone there are alternative ways to install firmware, such as would be done during manufacturing.

Once the iOS device is setup by an end-user post manufacture, the current passcode must be entered in order to update the firmware. They started enforcing that on recent versions of iOS. The passcode is the primary issue here. Without the passcode, the prosecutor cannot access the data on the device and they are concerned that x number of incorrect attempts will wipe the device...which is a feature of the current versions of iOS. (It's also a feature liked by corporations and government entities that allow organizational date on mobile devices...they can wipe it "for real") Unlike on Android, iOS actually can wipe user data securely. Interestingly, iOS also doesn't allow someone who HAS access to the device to wipe it/rest to factory unless they also have additional credentials, such as the iTunes ID and password.

I'm slightly divided personally on this matter, but lean more toward Apple's point of view. Balancing the needs of individual privacy and security vs societal needs isn't easy. What I find most interesting, however, is the reaction by some folks who normally are all for privacy and free will taking the opposite stance on this specific matter.

[Jim Finn]

I suspect Apple will eventually go along with the court order and put one of their least competent persons in charge of complying.

[Art Mann]

Unfortunately the "back door" is not something you can just create and then destroy. It is permanently incorporated into the device. The assumption is that only the good guys will ever learn the secret to opening the door. Based on my observation of our Federal Government, the probability of keeping the back door access secret is approximately zero. All it takes is one Edward Snowden.

Doesn't seem so onerous to me:
1. Create backdoor
2. Obtain info from phone
3. Share info with the FBI
4. Destroy backdoor
5. Charge government accordingly.

[Brian Elfert]

Once the iOS device is setup by an end-user post manufacture, the current passcode must be entered in order to update the firmware. They started enforcing that on recent versions of iOS. The passcode is the primary issue here. Without the passcode, the prosecutor cannot access the data on the device and they are concerned that x number of incorrect attempts will wipe the device...which is a feature of the current versions of iOS. (It's also a feature liked by corporations and government entities that allow organizational date on mobile devices...they can wipe it "for real") Unlike on Android, iOS actually can wipe user data securely. Interestingly, iOS also doesn't allow someone who HAS access to the device to wipe it/rest to factory unless they also have additional credentials, such as the iTunes ID and password.

My employer has at least one Apple device that is completely worthless because Apple is very strict about not allowing access to a device if you don't know the passcode, or the Apple ID and password. The device can generally be wiped, but not set up with another Apple ID for reuse.

[Yonak Hawkins]

..Well, then, why doesn't the FBI just hack into this phone ? The US government has more money than anyone.

[Ken Fitzgerald]

Everyone's security is not worth the information that may be on this phone, no matter how crucial it is.

Really? If there is information on that cell phone that could lead to finding a ISIL sleeper cell in this country plotting future attacks, you don't think it is worth have a method to crack these cell phones?

What could you or anybody else have on your cell phone that is so important that it rivals saving numerous lives? I can tell you I have nothing on my smartphone that is worth unnecessarily endangering other's live including yours!

Keep in mind, it wasn't that person's private iPhone but rather one issued to him by his San Bernardino County government employer. It is not his personal cell phone and thus I question whether the data on it belongs to him alone or rather to the owner of the cell phone, his governmental employer.

[Mike Henderson]

Unfortunately the "back door" is not something you can just create and then destroy. It is permanently incorporated into the device. The assumption is that only the good guys will ever learn the secret to opening the door. Based on my observation of our Federal Government, the probability of keeping the back door access secret is approximately zero. All it takes is one Edward Snowden.

There is no desire to incorporate some "back door" software into every device. All Apple has to do is turn off the 10 attempt limit, and also turn off the time delay between attempts ON THIS PHONE ONLY.

Since the pass code is 4 digits, that means you only have to try 10,000 codes to guarantee access. And based on statistics, it's likely you'll hit the correct code long before you get to 10,000. Once you have those two parameters turned off, you can hook up a computer to the phone and feed the codes pretty quickly.

Even if someone used more than 4 digits for the passcode (Apple started recommending 6 digits), you could still break it pretty quickly. Normally, you don't just try codes in sequence. Since a human has to remember the code, it usually has some meaning to them (someone's birthday is common), or it's a code they have used somewhere else (maybe their ATM code). You'd get all the information you can on the user and you'd try those first. You might hit the right one pretty quickly.

But the FBI does not want to risk having the data erased and that's why they want Apple to turn off those parameters.

This is something that affects ONE PHONE only. Unless someone publishes the technique for turning off those parameters, we'll all have the same level of security as we had before.

If a device can be hacked, it will be hacked. Someone will figure out how to do it. And from Apple's comments, it appears that the iPhone can be hacked, they just don't want to do it.

Mike

[Brian Elfert]

We don't know that Apple even has the ability to install custom code on an iPhone that they don't have the passcode for. As already mentioned you need to have the passcode to install an updated version of iOS.

If Apple does this once what will stop every prosecutor in the country from asking for warrants to look at iPhones? Oh, you got stopped for drug possession, we need to see if you sent any texts to your dealer from your iPhone.

[Mike Henderson]

We don't know that Apple even has the ability to install custom code on an iPhone that they don't have the passcode for. As already mentioned you need to have the passcode to install an updated version of iOS.

If Apple does this once what will stop every prosecutor in the country from asking for warrants to look at iPhones? Oh, you got stopped for drug possession, we need to see if you sent any texts to your dealer from your iPhone.

For an owner who is alive, the court will simply order the person to give the access code to the court. If the person does not give the code, they will be held in contempt of court and will go to jail until they do give up the code. The fifth amendment does not protect you from giving up the code.

You only need Apple to break into phones where the person is dead or unavailable (and the information is important), or the information is so time critical that you can't wait for the person to give up the code.

Mike

[People have tried saying that they don't remember the code, but that rarely flies with the court.]

[Jim Koepke]

You only need Apple to break into phones where the person is dead or unavailable

Okay, I want to ask a devil's advocate question to this. Does this suggest this is no longer about a single iPhone?

or the information is so time critical that you can't wait for the person to give up the code.

I have always wondered how one would know there is time critical information stored on a device if they do not know what is on the device.

Back to speaking as myself... Isn't this a Pandora's box about to be opened? Does anyone expect the FBI or other federal agency is going to turn this phone over to Apple to retrieve information with the expectation they will trust Apple and Apple will not have to give the cracking code to the FBI?

Each and every person shall be secure in their persons, houses, papers, and effects or none of us are.

The principle point to this would be if Apple does not have the capability to do what is asked of them, can they actually be held in contempt?

Next can the court compel them to do something that they themselves designed to be undoable?

I have heard some people suggest it is an easy thing to do. If it is so easy, why haven't the hackers employed by the FBI already done it.

If you read some of the information on this Apple gets requests all the time from law enforcement on these issues. Law enforcement has even brought in phones that were not password protected.

Over the past few years, Apple has become tired of government officials around the world asking it for help unlocking smartphones, according to an article about CEO Tim Cook published in The New York Times on Friday.

Here's one request that must have infuriated Apple: A government official once asked Apple to unlock a phone that wasn't even protected by a password.

http://www.businessinsider.com/gover...assword-2016-2

It is easy to imagine people in law enforcement not up on smart phones and not even knowing how to turn it on. Hand me one and I might accidentally call someone in Nepal.

jtk

[Mike Henderson]

Okay, I want to ask a devil's advocate question to this. Does this suggest this is no longer about a single iPhone?

The specific situation we're looking at is about a single iPhone. If it is possible to break into an iPhone, it is likely that courts in the future will order phones to be broken into. The courts have the right to order the disclosure of evidence. The only leg that I see that Apple has to stand on is that the method of breaking into a phone is not something existing. Normally, a court order requires the disclosure of something existing, not that the subject of the order has to develop something.

But see my comment in a previous post about the court being able to order a person to give up their code.

The administration of justice trumps privacy except in a few limited areas: Attorney/client privilege, certain religious communications, such as Catholic confession, limited doctor/patient communications, spousal communications and maybe a few others.

I have always wondered how one would know there is time critical information stored on a device if they do not know what is on the device.

In almost any search warrant, you don't "know" but you suspect and your suspicion is supported sufficiently to get the court to issue the order. In this case, the suspicion is that the person may have been involved with others, and the importance of finding that out is sufficient to get the court to issue the order. So if the agency making the request to the court can make a case that the iPhone likely contains time sensitive data, they could get their order.

Back to speaking as myself... Isn't this a Pandora's box about to be opened? Does anyone expect the FBI or other federal agency is going to turn this phone over to Apple to retrieve information with the expectation they will trust Apple and Apple will not have to give the cracking code to the FBI?

Each and every person shall be secure in their persons, houses, papers, and effects or none of us are.

Well, that's only until a court issues a search warrant for your person, house, papers and effects. The important thing is that the search for evidence is controlled by a court.

The principle point to this would be if Apple does not have the capability to do what is asked of them, can they actually be held in contempt?

No, if it can't be done you can't be held in contempt.

Next can the court compel them to do something that they themselves designed to be undoable?

The question is whether it is undoable. If it is undoable, they're off the hook.

I have heard some people suggest it is an easy thing to do. If it is so easy, why haven't the hackers employed by the FBI already done it.

I don't know how easy it is to do but I know that it will be easier for the designers to do it than for someone on the outside. But someone on the outside, who is knowledgeable and has the tools and equipment will be able to figure it out. We broke the Japanese codes, for example. If you really want to break into an iPhone, and you have the "best and brightest" working on it, you will break into it (if it is possible).

If you read some of the information on this Apple gets requests all the time from law enforcement on these issues. Law enforcement has even brought in phones that were not password protected.

There's a difference between receiving a request from a law enforcement organization and receiving a court order. The request carries no weight and can be legally ignored. Not so a court order.

http://www.businessinsider.com/gover...assword-2016-2

It is easy to imagine people in law enforcement not up on smart phones and not even knowing how to turn it on. Hand me one and I might accidentally call someone in Nepal.

jtk

I tried to reply inside your text. Apple may have no choice but to submit to the court order, even if they don't want to. Just saying you don't want to is not sufficient to defy a court order. And even if they don't, someone else may figure it out.

If you want to really protect your data, get an app that uses an up to date encryption standard (such as AES), and use a very long, random key. The problem is remembering a key like that. Protecting the encryption key is the problem with all such encryption techniques.

Mike

[Jim Koepke]

If you want to really protect your data, get an app that uses an up to date encryption standard (such as AES), and use a very long, random key. The problem is remembering a key like that. Protecting the encryption key is the problem with all such encryption techniques.

There are many ways of having a simple key that is long, random or not yet easy for a user to retrieve.

One scenario would be to use a sequence of the numbers in an irrational number like pi or the square root of two. Just start at a point that is easy to remember like the second, third, forth or even the hundredth digit.

The first letter of each word in a bible verse or a section of the Constitution. In effect the letters would be somewhat random but whoever was trying to crack the code wouldn't know where they came from it would be more difficult to hack.

jtk

[William Adams]

Yeah, the phone belonging to the govt. office, and them not having in place a strict and enforced / regulated policy of having the password recorded is incredible to me. Typical policy I’ve seen on this, is the pass code and other credentials for one’s work-phone are written down and placed in a sealed envelope and locked in a safe and changed each month. Once a month, one of them is selected to be audited and the owner is called into the security office, and in the presence of the person it is issued to the phone is unlocked and the password verified, then the user has to go back to their desk and create a new passcode and password. Everyone gets back their sealed envelope each month at the beginning of the day, and has to provide the new replacement before leaving the office.

The reason it’s simple for Apple but hard for others is modern computers can have a requirement that a binary be signed w/ an encryption key — Apple has to use that to sign the binary before installing it, anyone else has to puzzle it out before even beginning to write the software.

[Mike Null]

This has turned into a pretty good and civilized discussion. Now I will pose another question. If we so staunchly protect our second amendment rights, i.e., we allow terrorists to buy guns through our refusal to allow background checks how do we align that position with this one? Granted, they are dissimilar but what the government is asking is unlimited power over security of mobile devices that not only would affect U.S. citizens but everybody around the world. In this case I believe background checks would have prevented the terrorists from acquiring guns--at least it would have been more difficult than buying a Big mac and fries.

[Curt Harms]

Found this on a somewhat irreverent tech site.

Setting - Federal agent and Apple tech person in Apple's offices

Federal Agent: Hands iPhone to Apple person and says "Here, crack this phone"

Apple tech person accepts phone. Places it carefully on a bench and opens a drawer under the bench. From the drawer withdraws an Estwing 20 oz. framer and proceeds to give the phone a whack - or 2.

Apple Tech: Picks up pieces and hands them to Agent "There. It's cracked".