Why Are Apple's Competitors Staying Silent On the iPhone Unlocking Fight?

erier2003 writes: A court order forcing Apple to help the FBI access a terrorism suspect's iPhone has drawn responses from leading tech companies, newspaper editorial boards, and security experts. But one major faction is staying largely silent: the computer and smartphone manufacturers who compete with Apple for business and could be subject to similar orders in the future if the company loses its high-profile case. Silicon Valley software firms have universally backed Apple in its fight against the Justice Department, which won a ruling Tuesday from a California magistrate judge compelling Apple to design custom software to bypass security features on an iPhone used by one of the San Bernardino shooters. But Apple's hardware competitors are staying on the sidelines.

Comments

Finally the debate is here

[NotInHere]

Finally we have a debate on whether or whether not the state should have access to people's personal data. This is what snowden wanted, his goal is reached.

Re:Finally the debate is here

[pedz]

Yes, but only kinda. It seems like the real fight would be between the US citizens and the FBI represented by the shooter bringing suite (after the fact) and various other parties joining in. What is depressing is at least half the politicians seem to be on the side of the FBI / NSA / etc implying that their belief is that more than half of the citizens are on the side of the FBI / NSA / etc. The article by Jon Oliver was extremely revealing I think. People don't really even think about this stuff until it is their personal "dick pics" ... then they get very engaged.

Re:Finally the debate is here

[MacTO]

I'm not sure what Snowden wants in cases like this, because it is about evidence collected after a crime was committed. It isn't terribly different from a court demanding paper documentation.

The big concern, and the concern which ties into Snowden's revelations, is that US government agencies have proven untrustworthy. If Apple, Google, Microsoft, etc. fulfill this presumably legitimate request, they may find themselves fulfilling requests for surveillance purposes or disclosing information that these agencies can use to engineer their own solutions for surveillance purposes.

Re:Finally the debate is here

[PopeRatzo]

I'm not sure what Snowden wants in cases like this, because it is about evidence collected after a crime was committed. It isn't terribly different from a court demanding paper documentation.

It's completely different. It's not about demanding paper documentation, it's about demanding that a company crack a code. The gov't can make me open my door, but they can't make me invent a new way of opening doors.

Re: Finally the debate is here

[Anonymous Coward]

If it is even possible for Apple to crack into that phone, then the device is not secure. When will these manufactures make a friggin secure device that will nuke the encryption keys at any hacking attempts?

It should not be possible to load new/custom firmware (which is what the gov is demanding that Apple create) without unlocking the device first.

I applaud Apple's stance, but the still have a weakness in their architecture -- which is what the FBI is attacking.

Re:Finally the debate is here

[Anonymous Coward]

While it's a US only debate, it will still have long term repercussions. Apple won't be able to sell their phones abroad to governments or serious bizmen. Only as a toy phone, playing the latest and greatest Angry birds or Clash of clans.
American hw and sw is already a hard sell outside of US.

Re: Finally the debate is here

[Anonymous Coward]

I highly doubt that could ever be realistically possible for apple's current implementation. If you create a piece of software and you design in such a way as to enable future updates (name an OS that doesnt do this?) then it will always be possible to push an update that undoes parts of the protection systems in place. Its not just a security flaw, its out of necessity. If those parts of the code were somehow hardwired into a chip at the silicone level it would be an absolute nightmare if any bugs developed in any part of the security routines. You would have to reissue millions of phones just to fix a single simple issue. This is why these phones, even the most secure aspects of them, are still capable of being updated by the person or company who created it. Now they do certain things to lock access down, like requiring the OS updates to be signed with a private key that only apple has. This can at least limit the number of people with the ability to implement something like this, but still anyone who can sign code for apple can create this type of hack the FBI wants.

The only way to be truly secure is to use some third-party encryption applications that aren't subject to the same concerns as the OS itself. Most third-party encryption applications use a stronger method of authentication, compared to the default of 6 digit numeric passcode apple uses. With an actual private key being the authentication method, good luck to the FBI if they want to try brute-forcing the phone. It won't matter if google or apple pushes an update that weakens certain security features that prevent attacks. As long as the encryption is sufficiently strong so as to resist attacks for a significant period of time, the phone maker can go suck a lemon. The real failure in this case, for Apple at least, is that their default authentication method is pathetically weak (which is why they put a 10-try limit with a wipe). If they used a more secure authentication method combined with requirement of a positive auth on every boot or unlock (not storing private keys in ram for hours or days) they would have little need for their current security measures the FBI wants to bypass and this case would never have gotten this far. The key aspect here is that Apple's default encryption and authentication measure are inadequate and require protection with brute-force prevention and automatic wipes.

Re: Finally the debate is here

[Anonymous Coward]

Aren't just about all phone os's from American companies?

Re: Finally the debate is here

[Anonymous Coward]

Also not allowing updates unless the phone is unlocked would totally ruin their ability to repair devices without needing the user's passcode. They will always retain the most basic level of access to these phones to allow them to fix any issues that arise. Limiting their own access would also limit their ability to repair devices, especially in the event that a pushed software update somehow messes everything up (history has taught us this is not uncommon). In those cases, where the phone can't be unlocked but can be connected to a computer to be updated, its critical that unlocking isnt a requirement to fix the issue. This is probably a really specific case I must admit but I am sure there are other scenarios where requiring unlocking of a phone to update the software would be a problem. Probably not very often, but you can't just ignore certain contingencies because they aren't likely.

Re: Finally the debate is here

[ooloorie]

US government agencies are no more and no less trustworthy than those in other countries. The difference is that in the US, spying on citizens is actually illegal; the only way to search someone should be by court order. The reason you don't hear about such problems in Europe is because what the NSA did is by and large legal already in Europe in the first place.

Re: Finally the debate is here

[Anonymous Coward]

Open in more than one way...

Re:Finally the debate is here

[Midnight Thunder]

Whatever happens to Apple here will impact everyone else, especially if it gets worded in law. Don't believe Android, Windows Phone et al. will be unimpacted by this. Other companies are staying silent because they probably don't want to get involved in something high profile until it really impacts them or that they know the any publicity on their part may backfire.

Re: Finally the debate is here

[Anonymous Coward]

From what I saw on this, it is possible because it is a iPhone 5s and the anti-hamerring code or whatever is in software. Supposedly they would not be able to do it on the current phones where this is implemented in hardware.

Re:Finally the debate is here

[Anonymous Coward]

Not really. That debate is already over, and the people lost.

Apple has already handed over all the data they can on that phone. That includes all the supposedly encrypted iCloud backups and would have included the most recent backups hadn't someone changed the iCloud password. (This was covered on Slashdot even.)

Apple's current stance is more "we don't want to take the effort to do this" and not "we want to protect our customer's privacy." Just ask Jennifer Lawrence or anyone else involved in the Fappening just how much Apple cares about their users' privacy.

Re:Finally the debate is here

[Anonymous Coward]

Right because Cisco, HP, Intel, AMD, Dell, Apple, Microsoft, Adobe, etc etc etc doesn't have a roll in the world market.

This whole post stinks of anti-Apple/anti-American sentiment. You don't really make a clear point and you seem to think that if something (which you never state) does or does not happen that it'll ruin Apple on a world market that is most likely already just as corrupt as the American govern.

Meh.

Re: Finally the debate is here

[93 Escort Wagon]

Nope. Only Android and IOS.

Well thank heaven those two don't have more market share, then!

Re: Finally the debate is here

[Anonymous Coward]

You people are idiots.

The only way to install device software is when it is unlocked. In any other case the device must be wiped and returned to a "from the factory" state. If the device is wiped all content is irrevocably erased. A user must accept any updates to the device software before it can be installed even if the software has already been downloaded and awaiting approval to install. All Apple can do is decrypt the iCloud backup. However, the password was changed after the FBI had possession of the smartphone, presumably reset by the security administrator at the county health department but potentially the FBI themselves to create this false flag situation.

Re:Finally the debate is here

[gnasher719]

Finally we have a debate on whether or whether not the state should have access to people's personal data. This is what snowden wanted, his goal is reached.

No, that's not what this is about at all. The government has a search warrant for this data. They have the right to get the data. Apple even handed over an iCloud backup based on a legal warrant. Apple has absolutely no problem with handing over data when the police comes with a valid search warrant.

What Apple refuses to do is to break the security of their phones that they sell to millions of honest, hardworking citizens, honest but lazy citizens, dishonest citizens, politicians, lawyers, army personnel and so on and so on and so on, by creating software that they don't have right now, to access data that they cannot access right now.

This is not about preventing the government from executing search warrants, it is about keeping customer data safe. Apple declares that your iCloud data is safe from hackers and criminals, even though Apple can access it, because all that data is under Apple's control and they don't let hackers and criminals near it. Apple also declars that your phone data is only safe if _nobody_, including Apple, can access that data, because your phone can get under total control of the hacker.

As a side effect, Apple can deliver data stored on iCloud if they get a search warrant, but they can't deliver data stored on your phone. If Apple could deliver the data on the phone without creating a risk to the security of everyone, they would.

Re: Finally the debate is here

[2ms]

In other words only about 99% of smartphones have American OSes?

Re: Finally the debate is here

[cyber-vandal]

It isn't in the UK otherwise David Cameron wouldn't be demanding that US companies weaken their encryption and threatening them with new laws if they don't comply. The European Convention on Human Rights isn't as strong as the US Constitution, but people still have plenty of rights and the state has to justify any violation of those rights in court.

Re: Finally the debate is here

[Anonymous Coward]

Mod this guy up. He gets it.

Re:Finally the debate is here

[Anonymous Coward]

Finally we have a debate on whether or whether not the state should have access to people's personal data. This is what snowden wanted, his goal is reached.

That's not what this debate is about, have you been paying attention at all? Warrants are executed EVERY DAY to lawfully enter people's homes and collect evidence. The owner of this phone GAVE it to the FBI.

This is about compelling a third party to help with an investigation.

No safe, no lock, no phone is uncrackable, and of course the manufacturer has an edge.
A safe manufacturer might spend a several hours cutting away at hard steel. Apple is going to spend several hours coding, and at the end people will have the impression they broke in with nearly no effort. That's just how computers are, they look like effortless magic from the outside once everything's done.

Apple probably figured there's no way they can convince you it's hard. There is absolutely no way they could convince anyone reading this, and you all know it.
Even if it took their brightest engineers weeks of brainstorming with all their privileged insight, you'd be reading on /. the next day "Apple backdoored iPhone hurr durr"

So they resorted to making it look wrong because privacy blah blah blah ... OnAComputer (TM)

Re:Finally the debate is here

[whoever57]

No, that's not what this is about at all. The government has a search warrant for this data.

They also have permission from the phone's owner: the San Bernadino Health Department. It's important to recognize that this phone was Farook's work phone. There was never an expectation of privacy for this phone.

Re: Finally the debate is here

[ooloorie]

It isn't in the UK otherwise David Cameron wouldn't be demanding that US companies weaken their encryption and threatening them with new laws if they don't comply.

Think about what you're saying there. US companies have strong encryption, both in the US and the UK. And it is the UK government that demands that the US companies weaken their encryption for the UK market. What does that tell you?

but people still have plenty of rights and the state has to justify any violation of those rights in court.

No, that is false. European legal systems have huge exemptions from the need to justify searches and surveillance for national security and other kinds of situations. That's why the NSA activities in the US were a scandal, while the equivalent activities by European intelligence agencies against their own citizens were not. European governments tried to distract people from that basic fact by getting people all riled up about the NSA spying on Europeans as well, but that is actually the NSA's job, and that too was done in collaboration with European intelligence agencies.

Re:Finally the debate is here

[AmiMoJo]

The problem with this case is that Apple can comply with a court order to help the FBI break into the phone. If they had not screwed up by allowing the Secure Enclave's auto-erase and rate limiting functions to be disabled, we could get to the real question: will companies be allowed to build truly unbreakable encryption?

That's why everyone else is keeping quiet. Why risk saying something that affects the inevitable future legal case when the phone really cannot ever be unlocked? Then it will be down to lobbying against laws mandating backdoors.

Re:Finally the debate is here

[Anonymous Coward]

American hw and sw is already a hard sell outside of US.

Says YOU. Microsoft is doing pretty well, thank you very much. So is Cisco. What you mean is that smaller companies have a hard time establishing their products as competitors to the big players.
We may have oddities such as social networks, world-wide apps such as Lyft and Uber, which don't seem to have people concerned that they are giving some data-miners a treasure trove of GPS and marketing data on exactly where and when they require non-basic transportation and even what kind of luxury cars / services they like.

Re:Finally the debate is here

[Anonymous Coward]

It isn't terribly different from a court demanding paper documentation.

It *is* terribly different. It's more like asking a safe manufacturer to unlock one of their customers' safes.

To which, of course, the correct response is "Why the hell does the safe manufacturer have the ability to unlock the safe in the first place?".

Re:Finally the debate is here

[Anonymous Coward]

They can make you provide info on how to open the door.

If it was a physical safe, they would be providing all related schematics. How is a phone any different?

Re:Finally the debate is here

[Solandri]

With all the rhetoric surrounding this case, I didn't learn a crucial fact until reading this CNN article - It is not the shooter's phone!

The phone belongs to his employer - the San Bernardino government. This is like a homeowner letting someone stay in his home, and the guest changes the locks. The guest then kills a bunch of people and himself. The homeowner wants to get back in and (clumsily) resets the lock so the old key won't work even if they managed to find it. They then ask the lock maker (Apple) to help them unlock the door, and Apple refuses.

I'm all for keeping the government out of my encrypted data. But this is the wrong case to fight that fight.

Re: Finally the debate is here

[Anonymous Coward]

But the system should be configured so that pushing an update to a phone without unlocking it would wipe the crypto keys and the data with it. Then Apple could put into their terms that this would happen to cover themselves if and when they had to do it and they could still recover bricked phones. The data would just be gone.

Re:Finally the debate is here

[Anonymous Coward]

I disagree, it's the right fight to fight.

Apple isn't asked to crack this specific phone only. It looks like the government wants Apple to give them the ability to easily (ie. using untrained stooges and not NSA level experts) to crack phones and are using this specific case as a talking point.

If Apple gives in, the government will have access to any and all iPhones. Life being what it is, the tool will tumble through all sorts of law enforcement agencies and be used for pretty much whatever, depending on individual ethics of whoever has access. Organized crime will probably have access via some corrupt employee somewhere before the last sheriff's department gets their act together with reading the instructions manual

I have read comments to the effect that if law enforcement really, really wanted to know what's on this particular phone they could have had it cracked long ago by now, but that's not what this thing is about. Considering the general state of computer security I believe those commenters are correct.

Re:Finally the debate is here

[BronsCon]

The problem is, it wasn't his phone and the owner is also locked out of it. If that is the case, and the owner wants to help (which it would seem they do), then it should be the city of Sane Bernadino seeking this and, while they still wouldn't comply, nobody would think twice about it if they did. The city of San Bernadino could then hand over any relevant information to the FBI. The headlines on both stories would read "Malicious User Changes iPhone Credentials, Apple Helps Regain Access" and "Terrorized City Recovers Information, Aids FBI Investigation".

For example, if the FBI Apple a court order to install a compromised firmware on behalf of the city of San Bernadino, when the city brought them the phone, and presented the city with both the phone and a warrant for its contents and a court order to comply, city officials would be asking Apple to compromise their own phone, which should be acceptable. A court order forcing a vendor to comply with a customer request relating to their own property should also be acceptable. The only questionable part then becomes the warrant and court order served to the city itself, for which there is plenty of precedent; we've already shown that we accept entities being made to share their own records, or face their own consequences if they do no. The problem is that the city, ostensibly innocent in this, is being removed from the loop regarding the handling of their own property.

Also to note: if we don't fight that fight here, we allow a precedent to be set that allows the government to do the same in any case.

Re:Finally the debate is here

[Aighearach]

This is absolutely the wrong case to fight that other fight, but this fight might be more important.

That said, I don't really care what some hardware companies have to say. They might not even have a strong record as any sort of moral or legal authority. ;)

The debate that matters here is the legal debate that lawyers are having. Congress is incapable of action on either side of this, and Joe Schmoe's opinion is irrelevant. And, most Schmoes don't understand the difference between opinions and analysis, or how it affects the type of analysis that is useful to do in cases where nobody is going to ask your opinion because you're not a professional in the relevant field.

The EFF's involvement is a lot more meaningful than the opinions of hardware companies.

Re:Finally the debate is here

[BronsCon]

I accidentally a whole word. "For example, if the FBI Apple a court order" should be "For example, if the FBI served Apple a court order".

Re:Finally the debate is here

[Aighearach]

American hw and sw is already a hard sell outside of US.

Export data begs to differ. ;)

It turns out that pundits writing anti-American stuff in foreign media is not the same thing as lost sales. Who knew?! Oh, right, the marketing people. Turns out they did know something, even if it wasn't what the product features are. ;)

Gosh, if it is so hard to sell American software and hardware, why is the demand so high? Oh, right, there are people who disagree with you even in your own country, but you pretend they don't exist. It might turn out, they even have money and are the ones choosing which software and hardware to buy.

Not all foreign business people are more scared of the US Government than their own Government, did you consider that? Lets say, just as example, that it is possible an audit would come up with a different tax amount than the company had claimed. Which Government cares, the US Government, or their own local Government? Which government presents a real risk of corrupt or coercive demands for payouts? Which government's corruption would potentially expose them to local organized crime, with local wrenches? It may be that even the magazines publishing breathless anti-American conjecture about lost hardware sales are still going out of their way to buy US networking hardware. And that factories in countries that are US allies prefer to buy US factory equipment rather than equipment from a nearby company that is more likely to have information stolen by competitors. We have corruption in the US, but of a different sort than many places in the world. This is a whole country where offering bribes will land you in jail, it is not an accepted practice. This is a country where the sugardrink companies call the police when somebody tries to sell them their competitor's recipe. Foreign companies often care more about that than they do about breathless blahblahs.

Re:Finally the debate is here

[Austerity Empowers]

Whatever happens to Apple here will impact everyone else

So assume that if they never jump in, they are already compromised.

But if they're going to jump in, they won't do it now. Let Apple deal with the PR issues (which won't be entirely in their favor, a lot of people are terrified of terrorists and would gladly give their house keys to the government). If Google and MS are going to jump in, and i agree they pretty much have to if they are not already compromised, it will be when this hits the courts.

Re:Finally the debate is here

[Aighearach]

It's more like asking a safe manufacturer to unlock one of their customers' safes.

To which, of course, the correct response is "Why the hell does the safe manufacturer have the ability to unlock the safe in the first place?".

It is exactly like that, because there is a service for opening safes, and it is called a "locksmith," and not all safe manufacturers offer locksmithing services. Some do, some do not. The manufacturer is usually hired to help the locksmith determine where to drill, but they don't actually do the work.

This is the same; there are companies that offer services to write custom firmware; Apple isn't one of those companies, and the firmware in question is not a tool that they have and use internally. Furthermore, the FBI admits that it knows that if Apple got into this line of work it would affect their public image; they can't accuse Apple of PR without implying that they know there is a market affect on them.

In the NY pen register case that the FBI cited, the tool that the phone company was asked to use already existed, and was being used by the company for similar purposes; and further, the company already used the tool to provide (paid) services to law enforcement at other jurisdictional levels where it was clearly allowed. The company was happy to "lose" the case; they only said "no" because they thought they weren't allowed to say yes. If Apple was already using the tool internally, this would be a different case; it would be the case the FBI is claiming it is. ;)

That is without even getting to the part where firmware is copyrighted speech and Apple doesn't want to say those things.

Re:Finally the debate is here

[Qzukk]

A proper encryption scheme does not rely on the secrecy of the scheme. The FBI almost certainly has the schematics and code. It won't help them.

Re:Finally the debate is here

[davester666]

It's not a real debate, just a bunch of talking heads.

The FBI and DOJ knows that it is very likely they will lose. They WANT to lose, because then, Congress and the Senate and WAY more likely to pass laws that will go much further into enabling them to invade our privacy, "otherwise, the terrorists and child molestors win."

Re:Finally the debate is here

[amiga3D]

Because to break into this safe you basically would have to compromise all the other safes in the world. Think about the implications of that.

Re:Finally the debate is here

[amiga3D]

Microsoft is already in bed with the Feds. I'd bet they're loving this.

Re:Finally the debate is here

[Anonymous Coward]

But it's not only US government agencies who will be empowered.
Once the precedent is set then other governments, so far reluctant to be the first, will be able to point to this case and demand who-knows-what sorts of concessions and not just from Apple.
The world extends far beyond the borders of the US.

Re:Finally the debate is here

[PhunkySchtuff]

As the phone is owned by the San Bernadino Health Department, why are they rolling out phones to employees without any proper MDM solution in place that would allow them to, among other things, unlock the phone even if they don't know the user's PIN/passcode?

Re: Finally the debate is here

[Anonymous Coward]

If I buy a vault that is supposedly indestructible and the door can only be opened with a set of keys that cannot be replaced and I lost the keys, is the manufacturer oblige to help me break into my own vault. I will be fucking pissed if they will help.

Re:Finally the debate is here

[Anonymous Coward]

which still doesn't matter because they aren't arguing that the data isn't someone else's. They are refusing to create a NEW version of the OS that bypasses all the security they have just spent the past 5 years creating.

Re: Finally the debate is here

[Anonymous Coward]

Alternatively a lot of businesses with secrets to keep will buy the iPhone if its security is that good. Maybe DoD will be its biggest customers?

Re:Finally the debate is here

[Anonymous Coward]

It's not a debate. Apple, MS and Google can all change their minds on a case per case basis. There is zero guarantee of security as long as someone other than you has any capacity to unencrypt your data. Laws can be changed, minds can be changed, secret deals happen often enough. As long as it's possible, it's still just as much of a problem as ever.

Apple making one instance of denial public means little to nothing in the big picture of things.

Real life doesn't work like this. Snowden's impact, if it can be measured, is just not binding. There are no laws protecting data that can't be bypasses or easily changed. What you see on the new is on the new for a reason. Apple wants it on the news and they are making this stand public for a reason and it's not because they need your permission or because they are scared of the FBI. They made this stance public because Apple knows that they have a perceived marketing edge on MS and Google when it comes to security. I'm sure they want the FBI to leave them alone, but no corporation owns it's own nation, so they are all subject entirely to the dynamic laws of the nation or nations they do business in.

That means there is not ever going to be anything even close to a guarantee of security unless you make it a constitutional right in every country you expect to communicate in. If you have secret info.. don't store it on other people's server or use other people's network and perhaps don't store it on any internet capable device. If you want to talk in secret, you never use telephones, they've long been insecure and at no point did that change or did telephone companies tell you that telephone are secure. They start out insecure and they are still insecure.

So.. what is it you really expect or want? Governments not to push the envelope or spying even though history shows it's a very powerful skill that can turn the tide or wars. That's not going to happen anymore than you're going to get the world governments to ban guns and military equipment.

I think the real number one problem here is a completely unrealistic expectation of privacy in the face of things like google and facebook. In once sentence you sheep hate on basic data mining from the NSA and on the other hand you post about it all over facebook and google your silly little hearts out while using gmail and letting it scan every email to send you ads.

Now the same bunch of idiots are scared of the same features but with vastly more control built into Windows 10. Beside that.. well illegal wiretapping always happened and still will. Mass endpoint call data collection might have stopped, but you can bet if a time comes when we are scared enough to use it again, they will. All these same things happened in less automated fashion during WW2 and even years after during the cold war.

You're basically all angry about losing something you never had. What you need to do is learn how your nations laws work and organize and effort to make a real law. Anything else is just kind of useless whining. I mean.. the damn Patriot Act is till in affect and you think Apple pretending to buck the FBI is a sign of changing times.

Cmon.. if it's that easy to trick you... how can we ever get lasting change. They will just change things enough to appease people who don't pay close enough attention to the issues and then slowly move right back to those same policies. Just like they will do in the US with the banking laws.

As I see it Snowden got just about jack and shit out of all his troubles. Almost nothing changed, nobody got in trouble (except him) and the people have just about completely forgot. I think they had mostly forgotten about 4-6 weeks after the initial announcement. One huge flaw in the Snowden plan was lack of marketing. He didn't line his ducks up well. He didn't plan things out in a way to get his message out quickly and meaningfully. Perhaps most important he fled to China and then Russia, greatly harming his credibility.

Snowden also lacked real significant world examp

Re:Finally the debate is here

[Anonymous Coward]

They can do anything the law says.

If you run a business in a nation you are agreeing to abide by their laws. If they US says you have to invent a way to make door if you want to use that type of door then that's what you have to do.

Just look at housing code. Sure.. it's your house and you own it, but you can't just do anything you want with it. You can't run a business anyway you want and you can't invent things that get around laws and then whine when you get in trouble for it.

If you create a process that supercedes law, you can't expect the government to side with you over a technicality. That's silly and shows no real grasp of reality or accountability.

If I make a new drug and it makes people sick.. I get sued. If a company makes a new app and it break the justice system... they are going to wind up paying some price for that. You can't re-write a governments laws with computer code, it's not a democratic process.

You are siding with technology over democracy and that can never work. If you want these protections they have to go through the democratic process, not attempt to use technical or legal loopholes because that is either not practical or not sustainable.

The government can say that you can't sell that door UNLESS you first invent a way of opening it. They can TOTALLY do that. Just like they can make you build your houses to code and make you get your car inspect and make you test out new drugs.

All it takes is a law that says all encryption must be capable of abiding by legal data collection procedures. Mass producing applications that cannot be unencrypted would potentially catch you a charge of conspiracy or destruction of evidence just like shredding documents would, even if you did it long before the court order you still conspired to make it impossible for the courts to get your documents and that's illegal.

Don't expect technology to supersede democracy. If you want a loophole, you're going to have to learn how to organize and vote and make one yourself.

Re:Finally the debate is here

[Anonymous Coward]

They are asking for a tool to circumvent the auto erase function wherein the phone auto erases itself after X number of tries at the password. To do this, they expect apple to design an OS update that will break this security feature. So they are effectively conscripting apple dev to beak their own security feature enabling the phone to be brute forced. However, if apple develops this software, what is to stop anybody from using it on anybody else's iphones with or without a warrant?

Re:Finally the debate is here

[currently_awake]

Apple can release a software update that blocks this universal key. Simply requiring you to log into your phone before it will install software updates would suffice. Having the passcode software programmed into the CPU where it can't be altered would make newer phones immune to this attack.

Re: Finally the debate is here

[Anonymous Coward]

Wrong. This isn't some 'loophole' or grand scheme to subvert what you think is democracy. This is how encryption works. It's how it will always work. The government can totally pass a law that the sky should be pink and that won't make it so.

Any encryption that can be broken by the manufacturer is broken and badly designed. Yes, any example you can think of.

The government is not asking them to break the encryption by the way. They know better. What they're asking is for a safety feature to be removed that stops random guessing. If it is possible for Apple to do that at all, that is a design flaw that I guarantee they'll fix later.

Breaking encryption isn't like CSI. It relies on:

- poor key management
- bad implementation like predictable random number generators (like the NSA bribing certain manufacturers to do)
- using algorithms with known vulnerabilities (like the NSA suggesting things that are broken for common use)
- spying on the user for passwords, etx.

If you don't make mistakes it simply can't be broken. Learn to live with the fact that it doesn't matter what you think or what politicians and judges think.

Re:Finally the debate is here

[Anonymous Coward]

Can we just fucking can the hideous analogy-arguments ??

That's like an analogy that makes a weak argument!

Re: Finally the debate is here

[zaphirplane]

Analogy straining aside.
This is the equivalent of wanting access and ownership everything the guy has/owns.
how do you know they don't have remote wipe ability ? It's about the data in the phone

they already have physical ownership of the phone and could factory reset it if need be or replace the disk.
They want the data in the phone which isn't "owned" by the department.
 

Re: Finally the debate is here

[zaphirplane]

That's why there are constitutional courts that protect the people from unconstitutional laws
Now how effective they are in America is debatable after the Guantanamo bay and unlawful combatant dance

Re: Finally the debate is here

[Anonymous Coward]

Umm, what rock have you been living under ?

Apple has supported long/complex alphanumeric passcodes since iPhone launched. It's opt in.

Re:Finally the debate is here

[tlhIngan]

Whatever happens to Apple here will impact everyone else

So assume that if they never jump in, they are already compromised.

But if they're going to jump in, they won't do it now. Let Apple deal with the PR issues (which won't be entirely in their favor, a lot of people are terrified of terrorists and would gladly give their house keys to the government). If Google and MS are going to jump in, and i agree they pretty much have to if they are not already compromised, it will be when this hits the courts.

Or, perhaps Samsung, Microsoft, etc., are simply relishing at the thought? I mean, if the FBI wins, that means they'll benefit in the short term as everyone leaves Apple for competitors. After all, Trump just gave Samsung a boost.

Yes, it's very short term thinking at the expense of the long term - perhaps Samsung will be next, and they can't fight it because Apple lost. Now everyone moves from Samsung to someone else. Rinse, repeat and so on.

Basically, the competitors are making hay while the sun shines.

What happens to Apple will happen to everyone else, but in the meantime, they have a year or two to sell lots more phones for profit.

Re: Finally the debate is here

[Anonymous Coward]

Note how the post says "by default", which is currently true. I didn't know it was full alphanumeric however, still paltry default, a 6-character string.

Re: Finally the debate is here

[Anonymous Coward]

If the only way to install device software was to unlock the device, then the FBI wouldn't have any basis for their request to Apple to UPDATE THE SOFTWARE TO BYPASS THE SECURITY RESTRICTIONS. I honestly don't get whats so hard to understand about that, and name calling just lowers the discussion even further. Your next reply should not contain anything of the sort if you expect any replies.

Please do some research on the FBI's request in its entirety. Apple does indeed have the capability to update devices while they are still locked. I would love to hear your reasoning on as to why that wouldn't be possible, since only the user-data is encrypted on the iPhone and none of the operating system is protected by the user's passcode. In fact the entirety of the operating system is already loaded before the decryption of the phone's data even starts. I'm struggling to understand exactly your argument here or exactly what you think is going on inside the iPhone the FBI has in their custody. Furthermore, I highly doubt you fully understand the exact nature of the FBI's request, as is evidenced by your seemingly nonexistent knowledge on exactly what Apple is objecting to (e.g. why would they object to being forced to make an OS update if the phone couldn't take the update in the first place because it was locked?).

Re: Finally the debate is here

[Anonymous Coward]

Yes they technically could do this. There are a lot of things they could technically do to tie their own hands and prevent situations like this. I suspect most of them put an undue hindrance on their customer support capabilities although that is just speculation. I'd imagine if Apple were actually serious about having an encryption they themselves cannot unlock they would have investigated such methods already. Maybe they just haven't had time to implement them yet and future OS updates will have a different system, one that isn't vulnerable to updating the operating system around it.

Since the iPhone's are now encrypted by default, if ever you had a customer who's phone software malfunctioned either through a one-off situation or a fouled update process (or the update itself) you wouldn't be able to rescue that customers data no matter what. Because its encrypted by default I'd expect if there was any weird update problems they would have millions of very unhappy people with their data all lost.

It's all a matter of tradeoffs. You can easily create a phone operating system that cannot, no matter the circumstances, have its security measures circumvented (unless through a bug or missed vulnerability) by law enforcement or the company who created it. However you will lose many of the niceties of customer support that Apple gives its customers, such as the capability to rescue data even in the event the operating system becomes partially corrupt and cannot be loaded (but can be updated). Apple is a company that prides itself on having easy to use devices. They are also a company made of human beings who are not infallible and who can make mistakes, sometimes big ones. Its highly unlikely, but technically possible, for apple to push a regular update that totally bricks their phones. If these phones then couldn't be updated again without erasing userdata, apple would have a huge fiasco on their hands. Not only would it cost them millions to replace units and settle claims of lost data (might be protected against litigation by EULA) but they would almost certainly change their system to not have that problem in the future (i.e. allow updating the phone without deleting user keys). Although its unlikely, I highly doubt a company like Apple would ignore such a costly scenario purely because it was unlikely to occur.


Like my last post however I must concede that this argument feels in some ways contrived and doesn't have a generality to the situation that I like. I haven't through up any other scenario that are more broadly applicable either. This could mean there are none and I'm wrong, or it could be a failure of imagination. I hope its the latter :P.

Re: Finally the debate is here

[Anonymous Coward]

I think it is still possible to update the firmware of their security chip. Its been mentioned in passing in a few articles. I don't believe Apple has made any comment on whether they can update that specific chip's firmware or not, but outside experts have said they most likely can. So its all supposition until Apple says they can't or does it.

Re: Finally the debate is here

[cyber-vandal]

Let's see some citations for that.

Re: Finally the debate is here

[Anonymous Coward]

I retract this statement. It appears the default is indeed a 6-digit numerical password. Incredibly insecure.

Re:Finally the debate is here

[Anonymous Coward]

They then ask the lock maker (Apple) to help them unlock the door, and Apple refuses.

Maybe that was the wrong thing to ask. Do they really want to access the information in the phone, or do they merely want to make the hardware functional again to give it to another employee? If the latter, then they should ask for a factory reset and maybe Apple will accept.

Re: Finally the debate is here

[sonamchauhan]

No. Its about getting Apple to assemble existing bits and bolts which force the lock to stay open while the government tries a millions keys, one after the other.

Its a reasonable request. Apple's upset because it shows customers that encryption is a charade on a device you don't fully control.

Re: Finally the debate is here

[Anonymous Coward]

Since when are county government IT departments not incompetent?

Re:Finally the debate is here

[minstrelmike]

From the government's pov, the debate is between the user of the phone and the owner. Fareed the mental case "terrorist" locked the phone but the owner is the county organization he worked for. They paid for the phone and the account and they are fully onboard with finding out what their employee used it for.

That's not quite the same as a citizen's right against the govt.
Forcing Apple to write some sw that doesn't exist seems onerous to me even in this case.
But employers may think different about buying iPhones for their employees now.
quite the interesting conundrum.

Re:Finally the debate is here

[steveg]

The point here is it doesn't matter at all whose phone it is, or whether they have permission to break into this phone. It doesn't matter what's on this phone, or how important it is to get that information.

It has nothing to do with *this* phone. Whatever they do will be to all iPhones. They are being requested to design a backdoor for iPhones. After they do that, it will exist.

Re:Finally the debate is here

[BronsCon]

You're right, it has nothing to do with *this* phone, and I never said it did. It has everything to do with who is asking. If the owner of the phone is asking for it, Apple would be fully within the realm of reasonability to do so; whether or not they would without a court order is irrelevant, though I don't think they would. Were this both the owner of the phone making the request and the FBI serving Apply a court order instructing them to comply with the phone owner's request, it would certainly be reasonable for them to comply; for the owner, not for the FBI. And, in this case, it just so happens that the owner of the phone does wish to aid the FBI and, if they could, would.

Or are you saying that the owner of a device shouldn't be allowed to ask someone to help them hack it, or that someone shouldn't be allowed to help hack a device should the owner request it?

Do you seriously believe that Apple doesn't already have builds of iOS without the failed login limit and login delay? You know as well as I do that these builds certainly do exist, if for no other reason than testing. That is to say, what is being asked of Apple here already exists; your fears have been reality for as long as iOS has incorporated these features.

Re: Finally the debate is here

[Anonymous Coward]

i dont really care what snowden wants. Tv guy is hanging out with Putin. Putin is an ex kgb agent who is very corrupt and probably orderedan assasination using radioactive polonium in a public place in London. How can Snowden claim to be about freedom and against state corruption while at the same time living under the wings of Putin?

Re: Finally the debate is here

[Anonymous Coward]

ifthey make the software so it only works on one specific phone then you dont need to worry about people using it on other phones. Also every OS uodate for ios needs to be signed and approved by apple, so its not like someone could go rogue with it

Re: Finally the debate is here

[Anonymous Coward]

It's not reasonable, because the fbi can build that bolt for themselves.

If they can't, they can't compel Apple to perform thousands of dollars worth of programming, hours of QA to confirm it works as expected and doesn't damage the data.

And Syu the end of it all, if it doesn't go to plan, spend yet more countless hours of their lawyers and programmers explaining it to the court.

This is literally a warrant asking Apple to spend a couple million dollars. All told, it WILL cost that in hours spend developing and testing and lawyer vetting and explaining.

It's a single line of code, but it won't take a single coder, it Will literally take a room full of coders and lawyers.

They can sue Apple to force help, and Apple can choose to spend millions on lawyers.
They can't compel Apple to spend millions of dollars because the fbi weren't careful.

Re: Finally the debate is here

[Anonymous Coward]

Just build your tpm sip it can't be circumvented. No court order can force you to break into a tpm that has no firmware update mechanism.

Request the code without success too many times? Oh dear the working memory to determine success or failure marches through the chip memory until it either succeeds and resets the offset, or starts over writing the decryption key.
Build it into silicon, make it so simple it can't have bugs.

Shrug when you get court order.

Re:Finally the debate is here

[Anonymous Coward]

Only as a toy phone, playing the latest and greatest Angry birds or Clash of clans.

And here I thought that they were $700 facebook devices. You're telling me they play Angry Birds too?

Re: Finally the debate is here

[niftymitch]

No. Its about getting Apple to assemble existing bits and bolts which force the lock to stay open while the government tries a millions keys, one after the other.

Its a reasonable request. Apple's upset because it shows customers that encryption is a charade on a device you don't fully control.

Formally the bits and bolts do not exist. The court order demands that they be created, tested and applied.

The demand is for a service and a software product that is contrary to Apple's business.
One key business depends on a trusted platform to make payments.

The law does not care but Apple cares a lot about the reality that this would be the first
of many phones. Subsequent court orders will make much the same demand and apple
will have to comply. Divorce court, Russian, French, Cuban courts.

Because this involves Apple signature codes Apple should worry that the value of their signature
is compromised by this service. The service demands that Apple engineer, design, sign and install
this hobbled version of its product. In the future someone could demand the change, inspect the
phone, restore the software and return the device to the owner.

In this case the criminal acts make me wish there was a way to open exactly
this one this device and no other and have the authorities satisfy their need.
That does not seem to be the case, the problem is that once done there is
proof that it can be done again and again.

For many of use this is a do not care because it requires physical control
of the device. However anyone in any nation place or time could have their
device opened and once active data can be inspected, added or deleted.

A previous service generated an image Each transfer of that image could
be audited and multiple check copies made providing checks and balances.
This not so much. While the FBI has had very few problems with their evidence
management this context is more difficult to audit. Consider how one might
keep an Etch-a-Sketch image from being altered or damaged in transit.

Most are unconvinced that there is anything on the device. Many see that this
crime is so evil that they are willing to allow this order to be executed when
more common victim less crimes would allow less emotion and more more worry
about consequences.

There are no laws and this order will have lasting effect as law without action
from elected officials.

Ask the software guys.

[0100010001010011]

asked phone manufacturers LG, Samsung, and Sony and computer manufacturers Acer, Asus, Dell, HP, and Lenovo (which also owns phone manufacturer Motorola) whether they agreed with the government or Apple in the unfolding legal battle.

None of them also make the OS, they're just the hardware guys. The FBI is asking for a software backdoor.

Google (those guys behind Android) has stood by Apple

Re:Ask the software guys.

[jonwil]

Google may make the core OS for Android devices but I can assure you that Samsung and HTC and LG and the other OEMs releasing Android devices do a lot of software work themselves. More to the point, it would be HTC or LG or Samsung or whoever that would need to produce a customized software stack with a backdoor in it if the FBI needed it, not Google (especially if the device the FBI wanted cracked would only run signed firmware)

Re:Ask the software guys.

[Anonymous Coward]

You're right to a point but the hardware manufacturers aren't beyond question as well. They select the OS that they put on their device and, if need be, they should be held accountable in whatever fashion suits you best.

And I'm not saying their wrong and that their choice is bad but to shrug them off as "just the hardware guys" is like saying that they don't have a say in the matter. These vendors made a decision in the matter. It wasn't a fluke.

Re: Ask the software guys.

[Anonymous Coward]

But are any one of these companies american?

Re: Ask the software guys.

[Anonymous Coward]

the same question will need to be resolved in every country; what happens in the US will set the scene across the globe, each government demanding more of the same. It's why Tim Cook has used the word, "chilling".

Re:Ask the software guys.

[c]

None of them also make the OS, they're just the hardware guys.

Well, that and the majority of Apple's hardware competitors aren't US companies, and hence operate under somewhat different legal environments; in some cases, legal environments where resisting government law enforcement efforts is suicide.

Microsoft is one of the few US competitors equivalent to Apple, and everyone knows where they stand on the security and privacy of their users.

Re:Ask the software guys.

[Overzeetop]

"They select the OS that they put on their device"

You mean like selecting KitKat or Lollipop or Marshmallow? What other mainstream, well-populated ecosystem exists outside of iOS and Android? Microsoft? Blackberry? Name me a successful consumer handset company which isn't "choosing" Android.

No - there's pretty much one choice if you don't plan on building entire, robust ecosystem from scratch (and you're not Apple).

Re:Ask the software guys.

[Anonymous Coward]

Please mod this up. He couldn't be more correct. I used to work on one company's android version, the amount of change is huge.

Re:Ask the software guys.

[Anonymous Coward]

Microsoft is one of the few US competitors equivalent to Apple, and everyone knows where they stand on the security and privacy of their users.

Microsoft stands behind every one of its customers. All the better to look over their shoulders, with knife in hand, knee in back, etc.

Re:Ask the software guys.

[Anonymous Coward]

Just because they're the mainstream doesn't mean they were the only choice. Again, the hardware makers made a choice. Android wasn't predestined to be The Next Big Thing(tm) any more than iOS, PalmOS or Blackberry was at one time as well.

For someone with so low of a UID it baffles me that you don't realize that not all major market players stay major players forever. I think you're confounded in some way or do you honestly not recall a day in which Apple was only found in schools, IBM had serious marketshare in the OS arena and Linux was mostly a hobbies OS?

Why did this change? Because people made choices. There are other choices today and someday you will find Android and iOS as outmoded as WinMo.

Re: Ask the software guys.

[Anonymous Coward]

Please read the Google tweets in their entirety, if you have not, before praising Google on this. The language used in those tweets provides enough wiggle room to drive a truck through.

Re:Ask the software guys.

[jonbryce]

It would be Samsung, not Google, that would have to bake a custom ROM in similar circumstances.

Re:Ask the software guys.

[aliquis]

No - there's pretty much one choice if you don't plan on building entire, robust ecosystem from scratch (and you're not Apple).

And that one my friends is: Symbian! ;D .. or Maemo/MeeGo/Tizen.

So.. Nokia.. I think I've found your future product and chance! ;D

Re:Ask the software guys.

[thegarbz]

None of them also make the OS, they're just the hardware guys.

False. The other guys make enough OS customisations that they are well and truly in control of features to this level. Take a look at features like Samsung Knox to see what kind of security bolt-ons these vendors put on top of the features already in existence on Android. Many of these vendors also attempt to lock down the boot loader to prevent unauthorised code from running in ways that isn't part of the standard Android feature set so they most definitely do make major security changes to the OS before loading them on devices.

Re:Ask the software guys.

[AmiMoJo]

It's not the OS developer who can unlock the secure memory that holds the encryption key or disable the rate limiting/auto erase. It's the CPU manufacturer.

Samsung make their own CPUs. Most others use Qualcomm or Allwinner parts. Samsung and Allwinner are not US companies which complicates things a bit. Qualcomm didn't make the mistake of allowing the secure memory's firmware to be altered so couldn't comply anyway.

Re: Ask the software guys.

[Aighearach]

Yeah, if you wiggle hard enough while you read it, it almost looks like the words are wiggling. I kinda see your point. I guess I'd have to view it while riding in a bouncy truck to misconstrue the rest.

Re:Ask the software guys.

[UnknowingFool]

The amount of other software added by the OEMs is not the point. The point is that the bulk of hardware encryption software Android has is created by Google. But because Google does not control the hardware, Android cannot enforce the application of it. If the hardware is capable, an Android phone is every bit as locked down as an iPhone and there is little that Google or the OEM can do to unlock it.

Re: Ask the software guys.

[amiga3D]

I'm thinking Jobs made the right choice with Tim Cook. I own a Samsung phone but this makes me want an iPhone. To know a company stands up for it's customers against this kind of pressure renews my faith in humanity.

Re:Ask the software guys.

[amyreyna]

Do you know how to do this ? Or any article ? I'd like to try it in my android phone. I don't know if there is a way to lock up to hardware in Android phone

Re:Ask the software guys.

[Vlad_the_Inhaler]

That could happen. If the U.S. mandates backdoors, the market (and some of the companies) will shift to countries where the policies are different. Of course we don't know the contents of TTIP which could have an effect on the ability of Finland to be one of those countries.

Re:Ask the software guys.

[Anonymous Coward]

Google (those guys behind Android) has stood by Apple [macworld.com]

No they didn't. As a corporation, they said nothing. Their CEO tweeted five times, with a really tepid statement that reads like "security is good, but on the other hand, terrorism is bad.". If you think Google's CEO supported Apple, you probably are you very confused during election season..

Re:Ask the software guys.

[aliquis]

That could happen. If the U.S. mandates backdoors, the market (and some of the companies) will shift to countries where the policies are different. Of course we don't know the contents of TTIP which could have an effect on the ability of Finland to be one of those countries.

I don't know if Iceland is part of TTIP, they aren't an EU member at-least.

Re:Ask the software guys.

[UnknowingFool]

The problem with Android is the variation in hardware means not all features in the OS are possible in a specific model. You can try these steps.

Why should they?

[Sneftel]

What good would it do them? Since Google has taken point on designing, evangelizing, and (recently) mandating strong, backdoor-less crypto -- actions they, along with most of the technologentsia, are firmly in favor of -- they can ride the wave of inevitability, rather than stick their neck out with broad anti-government pronouncements. Sometimes the best PR is no PR.

Re:Why should they?

[Anonymous Coward]

Or, sometimes it's best to keep one's mouth shut.

Re:Why should they?

[Anonymous Coward]

Or, you know, Google's CEO could have come out with a statement in support of Apple's fight against the FBI already. Look it up.

Really?

[rmdingler]

This is a win-win situation for competitor corporations who might find themselves ideologically aligned with Apple's stance, yet lack the political will to stand against the governors ubiquitous snooping.

If Apple wins, everyone of them win. If Apple loses, and they could, they lose alone.

Listen to the proffered positions of the pretenders to the Presidential nomination. To many non-tech people, Apple's stance is bordering on treason.

Re:Really?

[Anonymous Coward]

Some day America will probably have a president like Trump who uses encryption backdoors to throw dissenters in jail.

Re: Really?

[ooloorie]

Whether Apple "wins" this fight or not is completely irrelevant to privacy or security. The only way to make sure that your data is secure is to make the technology secure, not to fight governments or subpoenas. That means that phone backups need to be encrypted with a pass phrase and biometric identifiers (including pins and pass codes) cannot be used as keys and need to be verified by a secure subsystem before performing decryption. Furthermore, in order to be sure that this works as advertised, it needs to be verifiable by users somehow.

Re:Really?

[FlyHelicopters]

To many non-tech people, Apple's stance is bordering on treason.

That is only because most people like to have opinions on things they know nothing about.

I cannot begin to tell you how many non-pilots have strong opinions about aviation, helicopters, and all things flying, while having no idea whatsoever what they are talking about (I'm a professional pilot with commercial and instrument ratings in both airplanes and helicopters, a certified flight instructor in both airplanes and helicopters, with thousands of hours of flight time and over 2,000 hours of dual instruction given). Yet whenever major aviation stuff is in the news, they all like to talk like somehow they have a clue.

Re:Really?

[Anonymous Coward]

Hence the tweet:

"Simple security rule of thumb: don't build encryption for how the world is today, but how it could be if Donald Trump were President." from Aaron Levie, CEO of Box

Re:Really?

[Anonymous Coward]

Understanding technology is irrelevant to understanding government overreach.

Re:Really?

[dbIII]

Yes but to those people treason is beating a Russian at chess without permission to play the match. Meanwhile a "patriot" sells weapons to terrorists less than a year after those terrorists have killed more than one hundred US Marines. Why should we care how people with such fucked up concepts call traitors since it comes down to people in their Party can do no wrong while people outside are seen as evil?

Re:Really?

[rmdingler]

Why should we care how people with such fucked up concepts call traitors since it comes down to people in their Party can do no wrong while people outside are seen as evil?

Well, we care because this stupidity is among us, and because what stupid people do en masse can sometimes affect the rest of us.

The point is simply that Apple has found itself on the same side of the privacy argument as many of us, but there are factions of citizens who couldn't care less or begin to understand what is actually at stake here.

Re:Really?

[Kjella]

This is a win-win situation for competitor corporations who might find themselves ideologically aligned with Apple's stance, yet lack the political will to stand against the governors ubiquitous snooping. If Apple wins, everyone of them win. If Apple loses, and they could, they lose alone.

First of all, corporations are rarely ideologically aligned to anything. Apple wants people to trust the iPhone so they'll buy iPhones. And post-Snowden, the more noise they can make about the US government not being able to crack it the better for world sales. Even if they lose, I think they'll still win by introducing the "iPhone Clipper Chip" edition for the US, creating an impossible situation where businessmen, tourists and others come to the US with uncrackable phones. I really doubt Apple gives a crap about this one phone, they know exactly what they're doing now by making a big deal out of it.

As for the political grandstanding, it'll always happen... take phone cameras, before anything like it would be considered spy cameras. Ask people about the potential for espionage, taking pictures of people in the shower, underage sexting and so on and they'll all agree that's terrible. But if you ask them if they'd really like to get rid of digital cameras and go back to huge, dedicated cameras with film rolls and processing labs, then hell no. We want the good, without the bad... and a free pony. Like we want the justice system to put all the bad men in jail, and we're angry with the ones that get away. And we're angry about innocent people being wrongfully convicted. We want a perfection we can't have.

Re:Really?

[rmdingler]

I know you're right. Often, smart people are the worst offenders, as if some skill or acumen in an unrelated field leaks over into all things.

Re:Really?

[rmdingler]

You're probably correct. I know this plays well for foreign sales.

But maybe some geek at the top of a tech superpower, who already has all the money he could ever spend, might just decide to stand for something he believes in.

Re: Really?

[tlambert]

That means that phone backups need to be encrypted with a pass phrase and biometric identifiers (including pins and pass codes) cannot be used as keys and need to be verified by a secure subsystem before performing decryption.

Hi!

My biometric identifier has been cracked! Due to the Error 53 fiasco, which pissed off unlicensed repair shops that don't have legal access to parts not pulled out of stolen iPhones bought off of eBay, the Error 53 thing has been disabled, and now, as long as you have an electronic copy of someone's fingerprint, you can pretty much unlock their device.

How do we change our fingerprints again?!?

Oh. We can't. So what you are actually saying is, "biometrics are a totally crappy mechanism for securing anything".

You know, I think I saw Bruce Schneier say that once... https://www.schneier.com/essay...

Re:Really?

[tlambert]

To many non-tech people, Apple's stance is bordering on treason.

That is only because most people like to have opinions on things they know nothing about.

You mean like "treason" being applicable, when the only currently outstanding and ratified articles of war that the U.S. has are versus North Korea?

Otherwise, you know, we'd be going against Wall Street for their "treason" committed during the "War On Poverty" (another ongoing war on a concept that the U.S. has "declared").

Re: Really?

[SuricouRaven]

"pulled out of stolen iPhones bought off of eBay"

Huh. So that's where they come from.

Re: Really?

[Anonymous Coward]

No, if Apple loses this one, all of us lose. Precedent will be established, probably for all time. We can either stand together against government backdoors, or we will all be hung with the same noose, eventually.

Re: Really?

[Anonymous Coward]

I'm sorry, but what in my posting gave you the idea that I endorse the use of biometrics? What I said is that you must use a pass phrase or long key to actually encrypt; you cannont use pin codes or biometric identifiers for encryption.

Re:Really?

[Aighearach]

A bit off-topic, but I'm going to love the debates in the general election when those candidates have to debate this against the backdrop of Snowden. Right now the Republican candidates are having a shouting contest over this only in the context of terrorism. In the general election, the broader issue of rights will be discussed, and they're going to have a hard time reconciling this standing across from somebody arguing that it violates people's rights. So far both the Democrats are refusing to "take a side" in the legal issue, but their response is also to talk about believing in privacy and supporting encryption rights. So as the shouting dies down, and the case matures a little, this is going to get more interesting than it is now.

Re:Really?

[Aighearach]

False, it is legally well-established that when Congress authorizes money for a military action, that is the "declaration" that the War Powers Resolution and other documents talks about. There is not, and never was, a Declaration of War Form that gets filled out. Congress doesn't like to use the word, but they still authorize wars.

As an example, the Authorization for use of Force against Terrorists of 2001 specifically says that it satisfies the declaration of war requirement, even though it doesn't use the term. Here is the type of language Congress uses when it explicitly declares war:

(1) SPECIFIC STATUTORY AUTHORIZATION- Consistent with section 8(a)(1) of the War Powers Resolution, the Congress declares that this section is intended to constitute specific statutory authorization within the meaning of section 5(b) of the War Powers Resolution."

( https://en.wikipedia.org/wiki/... )

Law has to be learned by reading. It can't be learned by listening to complainers in a tavern.

The situation in Korea is that the UN declared war, not the US, and there was never a formal resolution at that level. US soldiers who fought in the Korean War were not fighting on the side of the US, or South Korea, they were fighting under the banner of the UN. It is hilarious that people not only bungle the status of US wars, but their one claimed exception doesn't even apply. It seems to be rooted in this mythical belief in a war declaration long form.

Re:Really?

[Aighearach]

Wait, you thought that violating sanctions against Serbia during crimes against humanity is only about not having "permission?" Wow.

People reading this should be aware that he is trying to say that Bobby Fischer was only charged with doing financial business in violation of sanctions, during a military conflict, because he didn't "get permission." No, it is because he was materially supporting crimes against humanity. Those crimes are not based on "permission." They are not crimes relating to contempt of cop, which is what you want to reduce it to.

As a rated tournament chess player, your attempt to re-write history disgusts me.

For people wondering, "WTF" this is what this is about:

United States District Court
for the District of Columbia

Holding a Criminal Term

Grand Jury Sworn on October 29, 1991

UNITED STATES of AMERICA

vs.

ROBERT JAMES FISCHER

Criminal No.
Grand Jury Original

Violation 50 USC 1701, 1702, and 1705

(International Emergency Economic Powers Act )

INDICTMENT

The Grand Jury Charges that:

From on or about July 11, 1992 to on or about November 5, 1992, within the jurisdiction of the District of Columbia and elsewhere, the defendant ROBERT JAMES FISCHER, a United States person, did knowingly and willfully perform a contract in support of a commercial project in the Federal Republic of Yugoslavia (Serbia and Montenegro), in that the defendant ROBERT JAMES FISCHER did enter into and perform a contract between the defendant, the Jugoskandic Company of Belgrade, Yugoslavia and Boris Spassky to participate in the "World Chess Championship Match" in the Federal Republic of Yugoslavia (Serbia and Montenegro), for a cash purse of $5 million in United States currency and a percentage of revenues from the commercial gain as a result of the performance of the aforementioned contract.

( In violation of Title 50 USC 1701, 1702, and 1705 and Executive Order 12810)

How is violating sanctions somehow patriotic? Also note that we ended up going to war with Serbia, because the sanctions were not effective. This was a real conflict, and the sanctions were real sanctions. And they were clearly violated materially, it is not some innocent technicality.

Re:Really?

[amiga3D]

If they go by the Constitution then Apple wins. Lately though they've been trying to ignore that tired, old, outmoded document that limits their ability to rule over the surfs.

Re:Really?

[FlyHelicopters]

Law has to be learned by reading. It can't be learned by listening to complainers in a tavern.

And a whole lot of lawyers love to ignore the practical world of politics and reality.

Remind me again when the last time a non-military member was charged in the US with treason was.

Re:Really?

[Aighearach]

I didn't use the word "treason" in my comment. I was discussing the issue of when a war has or has not been declared, legally.

Remind me again what you're replying to?

Re:Really?

[AK Marc]

Treason is against "enemies" not "only states we are currently at open war with". It seems your definition is the broken one, not everyone else's

Re: Really?

[zaphirplane]

Off topic but why didn't USSR or China veto

Re:Really?

[Anonymous Coward]

Remind me again when the last time a non-military member was charged in the US with treason was.

The end of World War II, some of the broadcasters for the Axis Powers, but then, the charge itself has been only brought up a couple of dozen times.

It is mostly a political tool, not an actual method of law enforcement.

Re: Really?

[Aighearach]

China had had a civil war, and the place we now call Taiwan was the last stronghold of the old government; they were still recognized internationally as the government of China until 1971.

The Soviet Union (USSR) was not only helping North Korea, they were also boycotting the UN meetings over the "wrong" China being represented there.

Things were right on the edge as far as if the UN would survive. Most of those types of organizations had failed. However, if it failed most of the world would have simply been behind the US. Russia realized after Korea that they were better off if they attended the UN and made use of their vote; that's why that is the only major war ever authorized by the UN, and everything else military has been smaller peacekeeping missions with broad support.

They have made official statements backing Apple

[lseltzer]

Newsweek: Google and Microsoft Back Apple on Encryption Battle With FBI

Re:Because they don't store user data in China?

[NotInHere]

That was mostly not public until now. So apple cooperated. But having the US state demand cooperation publicly? nono, that's gonna hurt the company's reputation. Now they do biggest drama possible, to pretend they actually cared about their customer's data. They care about their reputation, and about their money. Nothing. else.

But kudos to Mr. Cook, its a cool marketing story.

if the audience leaves the stands...

[Anonymous Coward]

last man standing decommunications endeavor designed to make sure we know whois watching us....? more vaudvillian burlesque from hype.war.fear.madison.ave annex of our wmd on credit cabals... perfect balance is an absolute?

Re: if the audience leaves the stands...

[Anonymous Coward]

That you, John?

Looks kind of bad

[Sax Russell 5449D29A]

The fact that Apple even (seemingly) has the capability to assist in the decryption of the phone is appalling. Bad security.

Re:Looks kind of bad

[Anonymous Coward]

Did you read Apple's statement? The only way they can do this is by creating a brand new OS that has a backdoor builtin in order to update the phones and gain access. There is no backdoor for the current OS.

Re: Looks kind of bad

[Anonymous Coward]

There is a backdoor if the device is capable of installing new firmware without unlocking (or destroying the encryption keys) first.

Re:Looks kind of bad

[pauljlucas]

If you bothered to read any of the news articles, Apple currently doesn't have that capability. What the FBI is asking for is to update iOS on the phone with a custom version that removes the time delay between unsuccessful passcode attempts, the 10-try limit before wiping the phone, and a way to enter passcodes via the lightning connector rather than the keypad --- all of this so the FBI can brute-force unlock the phone.

Re: Looks kind of bad

[mark-t]

So basically, if Apple can do it at all, then the backdoor already exists, and is already awaiting exploitation.

Re:Looks kind of bad

[fustakrakich]

If you bothered to read any of the news articles, Apple currently doesn't have that capability.

Too good to be true, I believe is the phrase....

Re: Looks kind of bad

[thegarbz]

Only if that capability has the capability to decrypt the data. A back door is something that bypasses the cryptographic requirements of encrypted data. None such method exists, even if you are capable of loading custom firmware.

Re: Looks kind of bad

[gnasher719]

So basically, if Apple can do it at all, then the backdoor already exists, and is already awaiting exploitation.

Absolutely not. To exploit this, you'd first have to write working iPhone firmware. You know, firmware that can boot the iPhone and make it run. Obviously firmware with the passcode security removed. That's difficult. Even say the Samsung engineers that built the firmware for the Samsung phones would have a huge problem doing that, because they can talk to the Samsung hardware engineers but not to Apple's hardware engineers.

Then comes the minor problem that this firmware must be codesigned with Apple's must secretly kept key. How do you get access to that? Let's take again Samsung's firmware engineers, because they are likely among the people in the world most capable of doing this. At this point, they would be stuck. They have no chance to build any firmware that an iPhone would even consider loading, because they lack Apple's firmware signing key.

Now if Apple _builds_ and _signs_ that firmware, then you do have an exploit that just has to find its way in the open.

Re: Looks kind of bad

[Anonymous Coward]

The custom firmware is exactly what the FBI is demanding that Apple creates: a custom build of the OS whose some change is disabling the anti-hammering protection. This will allow the FBI to brute force the secret code one the new firmware is loaded on the device.

The backdoor, then, is the device allows the installation of firmware without unlocking (or destroying encryption keys) first.

If the device was already secure against this attach, then Apple's response would be that what the FBI is asking is technically impossible.

The bad thing about all this is that what the FBI is asking for is actually technically possible -- and most likely trivial for Apple to do when they cave to the pressure.

Re: Looks kind of bad

[SuricouRaven]

It's encrypted, but with a very short key length: It's a four-digit pin, only 10,000 possible keys. The security is dependant upon trusting the hardware and firmware to do the auto-wipe after too many failures.

Re:Looks kind of bad

[Sax Russell 5449D29A]

If you bothered to read any of the news articles, Apple currently doesn't have that capability. What the FBI is asking for is to update iOS on the phone with a custom version that removes the time delay between unsuccessful passcode attempts, the 10-try limit before wiping the phone, and a way to enter passcodes via the lightning connector rather than the keypad --- all of this so the FBI can brute-force unlock the phone.

What are you talking about..?

I said:

The fact that Apple even (seemingly) has the capability to assist in the decryption of the phone is appalling. Bad security.

And you say:

Apple currently doesn't have that capability. What the FBI is asking for is to update iOS on the phone with a custom version that removes the time delay between unsuccessful passcode attempts

And that's exactly what i described in my comment. If Apple has the capability to assist in the decryption of the phone. It doesn't mean it would need to be possible with an existing solution, it's enough if there is and/or has always been a known way to do it.

It's bad security when security measures can be bypassed one way or another. The ability to bypass the 10 try limit with the help of Apple effectively renders the encryption of all existing iPhones completely useless. 99.99% of the iPhones out there could be decrypted at will by anyone in the position to mandate Apple to provide assistance in doing it.

One thing is for sure now: Apple's credibility as a secure product has crumbled to dust. If it's not the encryption that's holding the government out of users' data but rather the rulings of rubber stamp courts, that's no secure product.

Re:Looks kind of bad

[Anonymous Coward]

Funny how e government is suddenly very apt at understanding technology when it's in their favor. But elsewhere oh let's fuck up electronic voting.

Re:Looks kind of bad

[pauljlucas]

Except it would be assisting ONLY with suppressing the anti-brute-force measures and NOT with the actual decryption as you stated. If the phone is protected by an alphanumeric passphrase instead of an ordinary PIN, it would still take the FBI a while to brute-force it.

Re: Looks kind of bad

[Anonymous Coward]

This is the difference between a 'backdoor' and a 'vulnerability'. The system clearly has a vulnerability, which is a bit bad, but then most systems have many vulnerabilities. This becomes a backdoor if Apple deliberately put it there in a way so that they could get in easily. This doesn't seem to be the case.

Re:Looks kind of bad

[UnknowingFool]

One of Apple's arguments is that they don't really have the capability but they are being compelled to do so assist anyways. Another point is that if they could do what the government asks, it is not a good thing for a number of reasons.

Re:Looks kind of bad

[UnknowingFool]

The question again is whether Apple is technically capable of doing so. That might require Apple to devise a way to update the phone's firmware and software without the consent of Farook. Technically the owner of the phone is San Bernandino county if I remember the details of the case but it was Farook who set the password. Now if Farook set the phone to auto-update, that would far easier. That sets the precedent then that the FBI can ask Apple or anyone to lower the encryption safeguards set by any citizen.

Re: Looks kind of bad

[Aighearach]

So basically, if Apple can do it at all, then the backdoor already exists, and is already awaiting exploitation.

The difference is the same as the difference between:
The house has a backdoor.
The house has enough space between the support beams to design and install a back door, but you'd have to know where the wiring and plumbing is first.

Re:Looks kind of bad

[Sax Russell 5449D29A]

If you reply, do so only to what I explicitly wrote. If I didn't write it, don't assume or infer it.

Your signature is a tad funny in this context. :-)

Here's what I said in my original comment:

If Apple has the capability to assist in the decryption of the phone.

Without Apple's help the FBI would most likely not be able to brute force the passcode. If, however, Apple assists them by providing a custom ROM, they'd be able to bypass a core security feature that prevents brute forcing the passcodes. Brute forcing iPhones' passcode is trivial since who uses a passcode of any meaningful length in their iPhone? They'd have to enter it every 15 minutes or so if they want to use their phone. Entering a 20+ character passcode that often just to read your texts or browse the Internet is a huge nuisance. And iPhone users, after all, have been confident that there is a mechanism that prevents brute forcing passcodes anyway.

If it's possible to bypass the passcode try limit, it's huge. It's bad and it's hugely bad. It doesn't even mean that Apple would have to help the FBI at this point to lose a lot of credibility. Everybody thought it was not possible in any way, but it seems Apple has had this capability since day-1.

Before the iPhone 6 series phones were released, the default passcode length was 4 digits (numbers). I personally have *never* met anyone who uses alphanumeric characters in their iPhone passcodes. If the majority of passcodes in modern iPhones is between 4-10 digits, that'll take a fraction of a second or a few seconds at most to brute force on the phone itself. And if it's somehow possible to extract the passcode hash from the phone, it doesn't matter if you use even 15–16 alphanumeric characters.

Here's what Apple has said in their official statement:

Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession.

If this isn't Apple being forced to assist in the decryption of the phone we live in different dimensions.

Re:Looks kind of bad

[ubeatha]

I think the interesting point is that the FBI is asking Apple. Undoubtedly, other arms of the US government have this ability. NSA's Tailored Access group could do it. The case is explicitly about forcing Apple to do it. And that in itself is interesting. The US Government could do this but it wants to set the precedent that it can bully companies into doing it for them. Witch tells me it has nothing to do with terrorism and everything to do with control.

Re: Looks kind of bad

[thegarbz]

It's encrypted, but with a very short key length:

So what you're saying is it's user error for net setting up an appropriate length passcode?

To be clear I don't agree Apple should do it. In fact I'm dead set against it. But calling it a backdoor or calling it weakening the encryption is fundamentally incorrect.

Re: Looks kind of bad

[SuricouRaven]

It's more a usability limitation: Do you want to have to enter a fifteen-character alpha-numer-symbolic passcode every time you want to use your phone?

Re: Looks kind of bad

[ooloorie]

It's encrypted, but with a very short key length: It's a four-digit pin, only 10,000 possible keys.

The PIN isn't the encryption key.

Re: Looks kind of bad

[ooloorie]

A back door is something that bypasses the cryptographic requirements of encrypted data.

A "back door" can be many things: it can be a weakness in the cryptographic algorithms, but it can also be a weakness in they keyring or even just failing to clear memory somewhere. Apple's devices appear to have a weak keyring.

Re: Looks kind of bad

[ooloorie]

It's more a usability limitation: Do you want to have to enter a fifteen-character alpha-numer-symbolic passcode every time you want to use your phone?

No, that's not how it works. The PIN is not the encryption key, it is simply an identifier the user uses to identify himself to the device. The actual encryption key is a 256 bit key that you never see and that's inaccessible and inside the hardware.

PINs are secure as long as the hardware strictly enforces a limit on the number of authentication attempts; after that number of attempts, the system either needs to erase the keyring (and/or device), or it needs to switch to PUK or pass phrase authentication. Some hardware does this (e.g., SIM cards), but on Apple hardware, the limit can apparently be circumvented.

That's a shame, given how much Apple seems to have invested in special hardware to support encryption on their devices. http://www.darthnull.org/2014/...

Re: Looks kind of bad

[SuricouRaven]

I could have explained in detail about how the key management works, but I was trying to keep it brief. The important thing is that they have the phone, need the pin to access it, and security is dependant upon the phone being designed only to behave in a certain way.

Re: Looks kind of bad

[ooloorie]

You said It [the data] is encrypted, but with a very short key length: It's a four-digit pin, only 10,000 possible keys.. That's not "keeping it brief", it's simply wrong. The data is not encrypted with a very short key length. The data is encrypted with a 256 bit key.

Re:could it be

[Pax681]

Because they don't make iPhones, you dumb fuck.

WHOOSH!

Re:Because they don't store user data in China?

[Anonymous Coward]

Hurr durr. All speculative nonsense. But yea it helps an Apple-hating narrative so Slashdotters will eat it up.

Why is someone silent?

[no-body]

Answer: NSL

case closed.

Re:Why is someone silent?

[Anonymous Coward]

Answer: NSL

case closed.

Fucking this. There can be no trust here.

Re: Why is someone silent?

[jmac_the_man]

The answer is actually that "They aren't silent. Apple's two biggest competitors in the smartphone market are Google and Microsoft. Both have put out statements supporting Apple's position."

Re: Why is someone silent?

[Anonymous Coward]

They have to put out statements supporting Apple's position, regardless of what the reality is. They have businesses to protect. To say anything else would cost them money. True or False, no one can know for sure.

Re: Why is someone silent?

[Anonymous Coward]

That is the whole reason Apple is fighting. If you think it is for any reason other than marketing, you're fooling yourself.

Re:Why is someone silent?

[mark-t]

The biggest issue I can see with NSL's is the non-disclosure aspect... to the point that you aren't even allowed to say why you won't talk about something even if you are directly asked, and what I can see being the biggest problem there is that can put a person in a position where the only way that they may be able to prevent revealing that they aren't allowed to talk about something (by explicitly avoiding talking about it if they are asked, for example, which may suggest to someone who pays attention to non-verbal cues that they are being compelled to not talk about it) is to make up some answer to what they are being asked that isn't true. In addition to potentially violating one's personal ethics on the matter of telling lies (which has potential to run afoul with the human right of freedom of religion), it can also require that the person possess certain levels of improvisational skills in order to convincingly tell such a lie, or else it may still be evident to whomever they are lying to that they *are* hiding something, and an observant person or someone who knows that person very well may still be able to conclude from this that they have been given a gag order.

Obviously, if they are never asked about it by anyone else, then there is no problem.... but this is not necessarily entirely within one's control... and easily the most problematic issue of such a gag order.

just access the truth? behind door # you

[Anonymous Coward]

'California judge rules EFF can collect evidence against NSA in mass surveillance case ....'

Re:They have made official statements backing Appl

[slashping]

Yes, that's what the summary said. It's the hardware makers that are quiet.

Only OEMs can offer hacker proof software?

[bogaboga]

I just have a question: Is it possible to download and install some software that will do exactly what Apple has done with their [iPhone] devices?

If so, let Apple do as they please then quietly advertise the availability of this software.

Re:Only OEMs can offer hacker proof software?

[wvmarle]

No, because (especially in current models) a major part of the encryption and related protections against brute forcing a key are engrained in the hardware. The best a software update could do is approach the iPhone 5 level (the kind of phone the FBI is now so desperate to unlock) of security.

The government voluntarily gave up their rights..

[Anonymous Coward]

The government voluntarily gave up their rights when the phone was tampered with while in the government's custody.
Why aren't, for something as important as the loss of 14 innocent people, the people / person responsible for resetting
the password criminally charged? How do we know it was stupidity and not intent to destroy evidence; maybe those / that
individual was involved as well and trying to cover their tracks?

For as much as I agree about not allowing the government access to technology to "backdoor" encryption, this is an (IMHO)
egregious post-mortem example where the government has good cause to access this data. The problem is, and without
any doubt, the government will abuse this technology against people without any evidence of wrong doing as was clearly
documented by the IRS attack against the protesters a few years back.

This is a damned if you do / damned if you don't situations that the government has made for themselves, not Apple or Google.

CAP === 'persists'

They are Collaborators

[soksabay9499]

the other tech manufacturers are most likely already collaborating with the the National Intelligence apparatus.

Re:They are Collaborators

[Anonymous Coward]

Are you intentionally dim, or just an Apple zealot or shill? Manufacturers do not make the OSes. Only Apple and the zombie-like BlackBerry have that honor. Apple built this garden wall, now they have to justify protecting terrorists while facing the consequences from the law and the [apathetic] consumer.

Re: They are Collaborators

[Anonymous Coward]

In this case, apple does control producton. That is their way. They created a hardware platform, created the software platform, and intergrated them. Some one else may create the parts, but apple controls what parts are in the apparatus, and the software that makes it operate to play birds. Unlike samsung, whick only does parts, not software, google and ms are generally software drivers, except for nexus and nokia,

Re:They are Collaborators

[Anonymous Coward]

>Manufacturers do not make the OSes

No, they just make firmware that loads the OS.

Re:They are Collaborators

[sasparillascott]

Now, now lets not have any name calling...he's just stating common sense. The other mfrs take the base Android stack and modify it (extensively at a low level) to work with their hardware and make the ROM image and with that (or the hardware itself) you can insert any backdoor you want.

An example we know about is our friend Lenovo using the PC ROM they modified to install their phone home spyware onto your PC after you do a clean install - it was Windows but something similar or worse could be done in Android if the mfrs felt they should (by govt suggestion perhaps):
http://arstechnica.com/informa...

Most of the other smartphone mfrs are keeping quiet because they are friendly with their Governments - Samsung (I have a Galaxy S5) for example is very close to the South Korean Govt (who is a good partner with the USA and in particular its military and intelligence apparatus). Microsoft is very friendly with the U.S. government and a "partner" with the NSA and they certainly won't protest this either. Cause they would line up with their govts not their customers.

It's important to look at the big picture, from a business standpoint it makes sense to work with your govt and their desire to spy on their citizens as they control your market access. Frankly its odd that Apple is doing this from a purely business perspective, from a moral perspective it makes sense - but most companies don't care about moral issues and will faithfully line up with their govts surveilance apparatus when the call comes no matter the consequences for their cutsomers / citizenry. Remember all those German companies that closed up shop and moved out of country in the 30's after the Nazi's were elected? Yeah, most just shrugged and fell in line. That is exactly what is happening (and what would be expected to happen) in this fight over privacy - if the govts want to surveil the population of the planet (which they do), most smartphone companies will ask how they can help.

Re:They are Collaborators

[Aighearach]

This is the statement that MS endorsed:

Reform Government Surveillance companies believe it is extremely important to deter terrorists and criminals and to help law enforcement by processing legal orders for information in order to keep us all safe. But technology companies should not be required to build in backdoors to the technologies that keep their users' information secure. RGS companies remain committed to providing law enforcement with the help it needs while protecting the security of their customers and their customers' information.

Just because they support certain government activities doesn't mean they would have to support other ones. Maybe in some countries that seems natural, but it doesn't work that way in the US. Companies, and people, take positions on each issue independently. It is not a requirement to join a team and then be on their side on every issue.

You seem to admit you don't understand the business case; what if customers have choice, and customers like privacy? Does that clarify the business case? Did German customers in the 1930s have lots of choice? Could they simply choose companies that respected their privacy, or was that choice not available?

Spineless - hoping Apple's stomped but afraid

[Anonymous Coward]

These competitors have conflicting hopes and they don't know which to give voice to - they hope that Apple is stomped to the point where they can no longer effectively compete but hope that they will somehow, impossibly, be exempt from the same requirements.

Re: The government voluntarily gave up their right

[Anonymous Coward]

Resetting those passwords is pretty much standard procedure. You don't want a third party mucking with the account and potentially destroying evidence.

Re:Because they don't store user data in China?

[Anonymous Coward]

I strongly disagree. As someone who's usually all for eating Apple-hating narrative, this particular one wasn't baked long enough; and I suspect that the ingredients had gone off, judging by all the fish-scented weaksauce used to mask the flavour.

Re: The government voluntarily gave up their righ

[Anonymous Coward]

So the FBI should get a warrant / take the person who reset the password to court and compel him to release the new password.

Simple...

[Sebby]

They don't want to get accused that they're "just copying Apple".... again.

Re: The government voluntarily gave up their right

[Anonymous Coward]

Wrap the device in tin-foil until it's safely in a Faraday cage. Matter of fact,
it's just common sense that all police should carry a roll of the stuff just to
prevent remote tampering of a device. If it can't network, it can't be altered.
Hell, if I can see something this basic, it should be a no-brainer for law enforcement.

CAP === 'gazelle'

Re: They have made official statements backing App

[ArmoredDragon]

Well Microsoft does make phone hardware...but...lol.

The Early Bird May Get the Worm...

[Irate Engineer]

...but it's the second mouse that gets the cheese.

They are watching Apple to see if they get hammered by the DOJ or win business due to not selling out their customer's privacy.

they probably don't have this problem

[ooloorie]

Based on what has come out over the last few days, it seems like there are two ways the FBI can access information on an iPhone: from the backups on Apple's servers and by disabling the limit on the number of passcode attempts in its OS without requiring the user to unlock it first. It's because of those two weaknesses that the FBI can order Apple to help them access information on a phone.

What's the situtaion with other phones? Hardware manufacturers don't handle Android backups, Google does. And Google seems to encrypt them. And in general, it doesn't seem to be possible to push phone software updates to Android phones without rebooting them, at which point a full pass code is required (of course, if you pick a weak one, that's your problem). In addition, any weakness would be specific to one manufacturer, not to all phones.

I think Apple's biggest problem is that they are a single, juicy target: compromise iOS and you have compromised half the phone and tablet users in the country. So, even if other manufacturers have similar weaknesses, they all require separate efforts to subvert, making life a lot tougher for people trying to invade our privacy.

Re:they probably don't have this problem

[Bing Tsher E]

Apple doesn't have a problem. They have a marketing opportunity, which they are noisily taking advantage of.

They have long needed a reason to give that they charge a large markup on their hardware compared to their competitors. And they have a history for decades of basing their high prices on hype. This is simply their new SCSI/RISC/Altivec elitist hypestorm.

Re:they probably don't have this problem

[Jeremi]

They have long needed a reason to give that they charge a large markup on their hardware compared to their competitors.

Actually, they don't need a reason. Plenty of people are happy to buy their product already, without them needing to come up with any new motivations for people to do so.

I know it's tough for the haters to accept, but they produce a quality product that people are willing to pay a premium for.

Re:they probably don't have this problem

[jonbryce]

You have to reboot for an iOS update as well. However, the update would let you try all 10,000 pin combinations if the FBI had their way.

Re:they probably don't have this problem

[ooloorie]

You have to reboot for an iOS update as well. However, the update would let you try all 10,000 pin combinations if the FBI had their way.

The issue isn't whether you have to reboot the phone, but whether you have to unlock it for the upgrade and how they implement the unlock count. This is complicated because there are many different ways of implementing it. But whichever way you look at it, a secure system must guarantee that no matter what an external user does, you get to try your pin combinations only 10 times before the system requires a full password.

Re:could it be

[Anonymous Coward]

I second the WHOOSH. Not to say the Feds are smarter right?

My prognostication:

Feds said: Open the device
Apple said: We cant do that. I.E even if we could why the hell would we do it for you? BTW you're the damn Feds with all these cool tools right?
Feds said: Errr yeah errr no errrr. You do it :)
Apple said: Erm no stop trying to privatize surveillance with us you fucksticks now cram it.

They'll will ask again dance around it and forget the discussion happened. Rest assured they already have the data. This is a media spectacle is all about "break the law now based on Legal precedent we'll set in the future" type situation. These guys are just prepping us for the onslaught ...

Re: The government voluntarily gave up their righ

[Hawks]

Getting the new password won't allow them to use the known iCloud backup work around for the encryption. The iPhone has the old iCloud password stored in its keychain. The current iCloud password, even if revealed to the FBI is different. The iCloud encryption work around is due to the iPhone doing an automatic backup sync to the iCloud account. This will not work if the iPhone's stored password doesn't match the current iCloud password. With out being able to unlock the phone, they can't change the iCloud password on it to match the current actual iCloud password. Its also not feasible to change the current iCloud password back to what is stored on the iPhone, as I'm sure the password reset didn't expose the old password.

So go ahead, get the new password from the IT individual who changed it, he would probably give it up with out a warrant, it won't help the FBI get into the phone.

soul of the business

[Anonymous Coward]

Apple has a soul. Some debate how light or dark it is, but it has one. It has principles. It has a character.

Those who are being silent do so because they lack any conviction, or integrity.

In my personal opinion, though I have sometimes differed ideologically with Apple, this is the strongest case they can make for their products. Whether they win or lose in the court, they are winning in the court of serving their customers. They are winning in the court of public opinion. Whether their competitors "win" in the eyes of a minority of Americans who would not buy apple products, they will lose in the eyes of the world that does.

Serving the customer should be job 1. Pandering to the tyrant - not job one.

The flat tax would close the loopholes that allows the 0.1% to keep nearly the entire value of their "taxable income". The very rich will never support it, so even if it was on every ballot - it only has a 20% chance of working. It would serve the nation well - but the people in power are not about serving the people, only themselves. This is similar - eat the poor. Apple is saying "eat nobody".

Re:soul of the business

[gweihir]

It also has a CEO that knows if things get too bad he will be one of those that go to the concentration camps for "sexual deviancy". It always helps if a threat is not only abstract. And yes, Apple does have a soul. Even a dark-gray one is far better than what most corporations and all governments have these days.

this is a criminal investigation vs two deceased.

[Anonymous Coward]

Ignoring the fact that this is a criminal investigation, Dead people have very little in the way of "rights"

at _ABSOLUTE BEST_ the person whose data was being searched could request the data be handed to a neutral third party to prevent fishing expeditions.

in this case? this is a Terrorism Investigation against two Dead People. If apple refuses the lawful order they've been given on "privacy" grounds they'll be run straight into the ground by any sitting judge. There's no legal precedent that i'm aware of that allows you to refuse to obey the law because you don't want to. We call that "Obstruction of Justice"

Because they have already been compromised

[RogueWarrior65]

Just a theory but there are some 4000 Android devices from 400 different manufacturers using who knows what version of Android that may or may not be in the original form since it's open source.

isn't it obvious?

[Anonymous Coward]

They don't want to be seen as aiding pedophiles, drug dealers, terrorists, gamergaters, and copyright infringers. Wise choice if you ask me.

Re: isn't it obvious?

[ZeroWaiteState]

You mean like all the pedophile engineers at Belgian telecom, or the terrorist copyright-infringer Angela Merkel, or the gangbangers at Anmesty International? They have to be criminals if they're hiding something, right?

Re: isn't it obvious?

[Anonymous Coward]

You mean like all the pedophile engineers at Belgian telecom, or the terrorist copyright-infringer Angela Merkel, or the gangbangers at Anmesty International? They have to be criminals if they're hiding something, right?

Err, do you mean gamergaters at Amnesty International? I wasn't aware there were any brothers working at AI.

p.s.
Angela Merkel literally is the worst terrorist copyright-infringer, isn't she?

Laugh

[koan]

They already know how it's going to turn out, because it is all just theatre, Apple will comply again because they already have complied in the past.

Apple just want their consumers to keep believing in the myth of Apple.

Re:Laugh

[SeaFox]

They already know how it's going to turn out, because it is all just theatre, Apple will comply again because they already have complied in the past.

That was with older versions of iOS that had weaker security. Since iOS 8 Apple has not had the same degree of access.

This is like a person owning an "uncrackable" safe

[Anonymous Coward]

Can a court order compell a safe manufacturer to assist the authorities with opening a safe that may contain private papers belonging to the person charged with a crime, in this case a deceased person who can't provide the combination to open it? Also, if the manufacturer did assist in providing a way in, would future customers ever buy a supposedly "secure" safe from that manufacturer again?

If there is a difference, it's that if Apple creates the backdoor, it may only be software. It could theoretically be applied to any and all similar devices and sets the precedent for companies being obliged to do so when legally compelled. The government is effectively asking a company to build a customized backdoor that didn't exist previously, undermining the reliability of their own product. That's a genie you can't stuff back into the bottle once it is created as a legal procedure, because you're telling companies they could be asked to do the same thing again in the future, no matter how secure and tamper-proof they try to make their product. This is much bigger than merely getting access to one encrypted device.

We've heard plenty in the news from know-nothing politicians thinking some magical encryption process could be created that would let them unencrypt anything they like if they had legal justification, but somehow otherwise keep things secure for the users. People point out over and over that such a system is inherently insecure the moment you make it. Now the government is asking Apple to build such a system after the fact: to build a brand new, flawed system.

Missing The Point

[Anonymous Coward]

Suppose all of the companies are somehow compled to provide secure back doors. A terrorist organization could then start using Open Source software and build some propritary encryption of their own. I’m sure they could recruit some developers. At that point, the general public will have given up their privacy for no good reason.

Software development is not restricted to companies.

Re:Missing The Point

[Anonymous Coward]

>At that point, the general public will have given up their privacy for no good reason.

Honestly, I'm just dumbfounded by the level of naivete expressed in the above statement. It's like the entire country has developed collective amnesia about everything that we already know about state surveillance and the tech industry's enthusiastic collaboration with, not just the US government, but with other nations that they have corporate presences in.

Re:this is a criminal investigation vs two decease

[koan]

Apple knows this, Apple is putting on a big show for their customers "we care about your privacy", they picked this battle to lose, in effect losing allows them to maintain "face" with their customers and comply with the FED's request.

This was planned, this is theatre, and you really shouldn't be buying Apple products.

They already caved

[Anonymous Coward]

duh.

One word

[Anonymous Coward]

Qwest

Because a backdoor damages Apple

[Mr. Jackson]

One of the big reasons to spend $600 on an iphone instead of $100 on an Android is privacy and security. I need a smartphone about $100 worth, but I was just about to bite the bullet and get an iphone because of the phone's built-in encryption and Apple's pro-privacy policy. Now I'm going to wait and see. A backdoor into iphone makes me less likely to fork over the extra money, to the good of Apple's competitors.

Re:Because a backdoor damages Apple

[Anonymous Coward]

and you think that if Apple loses here, Android is going to remain secure w/o a backdoor for long? Precedent will have been set. If you need a phone now, buy one from the company that is taking a stand - not one from a company whose CEO offers milquetoast "support" in a couple tweets, but otherwise no official statement.

Re:Because a backdoor damages Apple

[Anonymous Coward]

If you can update the firmware image while the phone is on and locked, then the backdoor is already implemented.

Re:Because a backdoor damages Apple

[Anonymous Coward]

No, what I think he's saying is that he'd rather pay $100 for an insecure phone, than $600. If that $600 phone was secure (whatever that means in this context), but the $100 wasn't, buy the expensive one. If they are both subject to compromises, buy the cheaper. Makes perfect sense to me.

Re: Because a backdoor damages Apple

[Anonymous Coward]

uhm, you don't have to turn that feature on....

Re:Because a backdoor damages Apple

[Anonymous Coward]

Sadly it's been modded down, but it deserves repeating:

Apple ALREADY collects all your user information. In fact, they already turned over all the backups for the phone that they had. What's in question is the most recent data on the phone, that wasn't collected because a San Bernardino employee changed the Apple Account password.

If you read their privacy policy, they routinely collect information like your location, what apps you run, how long you run them, and stuff like that. All that was already handed over to the FBI.

This whole current thing is a farce. Apple already hands over the government as much information on their users as they can, apparently their line in the sand is being asked to write new software.

Re:Because a backdoor damages Apple

[Anonymous Coward]

If you can update the firmware image while the phone is on and locked, then the backdoor is already implemented.

The device software cannot be remotely installed on an Apple iPhone 5c. At most the software payload can be pushed to the device but an actual person has to manually accept the update before the installation begins. It is the same way for Google Android, BlackBerry OS10, and BlackBerry Android. This is by design otherwise every smartphone risks being bricked due to a buggy update or failed update. This failure can even happen when the end-user manually chooses to update the device software.

Re:Because a backdoor damages Apple

[gweihir]

And you are not the only one thinking that way. The only thing Apple does better is security and privacy. Other than that, there is no reason to get an iPhone (except maybe "lifestyle", i.e. it is a fetish). Apple stands to lose big-time here if they cave. The problem really is that the FBI does not ask them to unlock just this one phone, they are demanding a tool that would allow them to get into any similar iPhone (not the newer ones though), and Apple has to refuse in order to protect their reputation.

Whether they do this out of a sense of duty to their customers or whether they want to protect their future business is entirely immaterial. Both are fully acceptable desires for a corporation and in this case they coincide.

Re:Because a backdoor damages Apple

[Aighearach]

It is probably modded down because it conflates access to the data stored on the phone with access to the data stored in a iCloud account.

Users who care about privacy have different expectations of cloud data than they do for data that is stored on physical devices they own and exclusively control.

Re: Because a backdoor damages Apple

[Anonymous Coward]

An iCloud back contains less info than a wired / USB backup, and it can be enabled/disabled by the user.

So they only have the back up data if you choose to give it to them .

Re:this is a criminal investigation vs two decease

[belthize]

They haven't been given a 'lawful order' they've been given a 'strongly worded request'. There is precedent for what Apple is being asked to do and the precedent is they can say 'fuck off'.

They're not being asked to present data they have access to, they're being told to provide a mechanism to extract data. Picture a tech company that specializes in image manipulation and they make cameras. One of their cameras has a security still of a suspect. The government can ask that they turn over the still, they can not compel the company to write new software to manipulate that still.

The govermnent has the phone, in fact there's evidence they borked things up by attempting to change the password. They want the data on it they can knock themselves out. If they succeed in extracting the data then phone manufacturers need to step up their security. If they fail then things are working as intended.

Compels me

[stud9920]

Unless you're a recluse old spinster portrayed by Kathy Bates, how can you force anyone, let alone a corporation, to write something. Will they also maim the guy if the produced work is not up to the expected?

I could understand forcing spec & design disclosure, but *write* something ?

Re:Compels me

[tlambert]

Unless you're a recluse old spinster portrayed by Kathy Bates, how can you force anyone, let alone a corporation, to write something.

It's more likely that anyone who starts working on it might accidentally get hit by a bus.

Re:Compels me

[gweihir]

That is pretty much Apple's point. Apple basically says "we think we could, but we think very strongly we should not, so fuck off".

The battle's lost either way.

[Anonymous Coward]

The only thing singling out the Bernardino shooters is that they are dead. If they were living, they'd be likely to use any non-throw-away phone again, and then they'd get a "security update" via cellphone tower spoofing.

This phone is not likely to contain anything useful. The only reason there is a showdown over it is that it's users are dead and the FBI nevertheless wants to look at the phone like they do with every other phone routinely. The privacy of living users is already completely subverted. And in the rare case where you have been smart enough to behave as though you were dead to the phone, there will be "heroes and patriots" ordering and performing torture on you in order to make you use that phone, and they will be getting a general pardon in the unlikely case that someone is as stupid as to order an examination of your body.

It takes $$, lots of $$$$$, to make a stand

[Anonymous Coward]

Apple has cash to defend itself....many of the mobile competitors can't take such a risk.

Obvious - they dont want it noticed how

[Anonymous Coward]

much they have been complicate in acting with the guberment . Next question.

Re:They have made official statements backing Appl

[Anonymous Coward]

Why read a summary if the headline is already incorrect?
I read the headline and the first thing I thought was "Wrong. Next Slashdot article."
The only reason I'm in this thread is to see how many other people pointed out the summary is incorrect.
And then I saw your post, apparently you took the time to read the summary.

US Government Should Post an Ad

[retroworks]

Hire some ex-Apple employees to hack this phone. It's a job, and the government has every right to crack THAT phone. But Apple shouldn't be the only people in the world who can do it, and shouldn't be forced to. Surely if he government pays someone enough money, they can do whatever Apple would do half-heartedly

Re:US Government Should Post an Ad

[MillionthMonkey]

Former employees would probably be liable to a civil suit if they did this. I'm pretty sure Apple makes you sign legal documents when you get a job there.

Re:US Government Should Post an Ad

[gweihir]

O ye of simple minds. The issue here is not cracking that single phone.

Re:US Government Should Post an Ad

[Aighearach]

Contracts don't trump laws, and the investigative actions of law enforcement are authorized by laws. The lawsuit you contemplate would not be legally possible. If there was something that could go to court in that scenario, the government agency would have to be a named defendant, and the former Apple employee would only have to show that they thought the government had authorized... what they had authorized. If it wasn't in their power to authorize it, that doesn't pass through to the civilian as legal liability unless that person would have known it was illegal; and we already know we're talking about engineers, not lawyers, so there is no expectation that they would know the government lawyers were wrong.

More likely, being a former employee wouldn't actually help because engineers don't memorize all the datasheets for all the chips they've worked with in their careers. ;) I'm not a bigshot Apple engineer, but if I'm writing firmware I have to keep some of the header files, datasheets, and other documentation open while I'm writing it; even reading it an hour ago isn't good enough.

Re:US Government Should Post an Ad

[PhunkySchtuff]

Unless they jailbreak the phone (which is pretty risky given what is at stake) they can not update the firmware on the device without it being signed by Apple's keys. Writing the code to extract the data from the phone would not be that difficult for someone familiar with the inner workings of the phone. Getting it to run on the phone without being signed by Apple's keys is another thing altogether.

Re: US Government Should Post an Ad

[Anonymous Coward]

You can't jailbreak a phone later than the iPhone 4, if you don't know the password to it.

Let's look at a few great reasons to stay quiet...

[Dzimas]

Let's look at a few good reasons to stay silent if you're an Apple competitor.

1. Apple's competitors are based in South Korea and China. They're going to have a much harder time arguing privacy with the US government.
2. Apple has lots of money and excellent legal counsel. They'll put up a better fight than their competitors possibly could.
3. Staying silent won't piss off any American lobby groups, and it probably won't piss off the American general public.
4. This could be a PR nightmare if someone mis-words something. You don't want to accidentally paint yourself as pro-terrorist.
5. There's no obvious win here. If the corporations win and privacy remains paramount, eventually someone is going to do something awful that involves encrypted communication. At that point, the corporations look bad. If the government wins, things could devolve into 1984 if the wrong people ascend to power.

Because they are all in China

[Anonymous Coward]

Duh.

I don't want to be anti-Chinese (I am not, actually, though who'd be a fan of their government) but it's clear the Chinese government holds more power over its manufacturers than the US government does after 40 years of Republican representatives loosening the reins.

Why should anyone be forced to comment on shit?

[Anonymous Coward]

What the fuck is the point of this submission and who approved it?

This is simple

[slashmydots]

Is WinZip responsible for cracking passwords that their customers' set on their zip files? No! That's their product and that's what their product does. It's a security and privacy product so naturally the company doesn't "hold the keys" or put in a backdoor. All cellphone makers should leave encryption in the hands of the customer and tell the FBI to fuck off.

Re:This is simple

[PhunkySchtuff]

Exactly. As the phone is owned by the San Bernadino Health Department, why are they rolling out phones to employees without any proper MDM solution in place that would allow them to, among other things, unlock the phone even if they don't know the user's PIN/passcode?
If the customer (San Bernadino Health Department) had have set it all up properly to begin with, this would all be moot.

What happens if Apple cooperates, but fails?

[mark-t]

What happens if Apple tries to cooperate, attempts to write a version of iOS that will do what the FBI wants, and the result does not work? What if it takes a long time to write? Who compensates Apple for the programmers' time while that tool is being developed, tested, and debugged? What if the code they make accidentally has bugs that cause data loss on the device that simply were not exposed during QA testing?

Re:What happens if Apple cooperates, but fails?

[wierdling]

The United States tax payers are going to foot the bill for this if it happens. Apple is allowed to bill the F.B.I. for reasonable costs. So we get to pay for our own screwing.

Re:What happens if Apple cooperates, but fails?

[Anonymous Coward]

It will be far less costly if Apple does it, than if the FBI has to put resources behind cracking this phone - and they will do it, it will just cost a billion dollars instead of maybe a few million, but the end result will be the same, the FBI will pwn that phone, and then the hack is theirs to use as they see fit. If Apple wants to keep any control over this hack they should do it themselves, instead of forcing the FBI to do it alone.

Re:Let's look at a few great reasons to stay quiet

[Anonymous Coward]

If the government wins, things could devolve into 1984 if the wrong people ascend to power.

When the wrong people ascend to power.

reputation

[surd1618]

Apple's reputation is riding on their premium hardware and services, for which they charge premium prices. Their competitors are cheaper, and don't have the same quandary of keeping customers based on being better.

Re:reputation

[jonbryce]

Samsung's flagship products cost around the same as the equivalent Apple products.

Re:reputation

[surd1618]

But they don't have the exclusive software.
Apple made $17 billion revenue from apps

If they did... Look at the FCC

[Anonymous Coward]

The FCC is implementing rules to require that some wireless devices (WiFi routers) include provisions to prevent loading third-party software so as to prevent user modifications that could change parameters and possibly violate technical standards (power output, emission bandwidths, operating frequencies). As a result at least one AP vendor's equipment now requires signed upgrades, no more loading dd-wrt etc.

Not that it makes sense technically (why should any of this, it's politics), but a similar approach could be imposed (legislated) on any phones imported into, or sold in, the United States. So Samsung & co would have to implement the backdroor, and prevent the devices from accepting un-backdoored upgrades. I'm not advocating this, just saying that if Apple loses, no one's immune..

(I actually have a uid but can't recall it or the password. My bad)

Betterridges Law of Headlines

[Anonymous Coward]

No....

Wait...am I doing this right?

Oh really?

[Acid-Duck]

Y'all must of missed this one from 3 days ago:

http://www.usatoday.com/story/...

FBI wants less than China, but..

[dAzED1]

Maybe the rest of them can see that they, and Apple, have all done a lot more for China and they, unlike Apple, don't want to draw too much attention to it only to look like hypocritical oafs that would rather do China's bidding so that political dissidents can be silenced, than to do something where it almost (but not quite) would make sense to do something like this in a free society. Fark Apple, trying to pretend they have a moral high-ground here. Maybe we should just ask China for help hacking the phone, since Apple gave them the source code, back doors, and manufacturing of the device...

Apple Should Unlock it.

[Anonymous Coward]

I know that a lot of people right now are afraid of what the implications are, but lets be real for a second okay? In reality, what it breaks down to is.... We don't have to have a "BACKDOOR" developed. That's actually absurd. Apple has a history of unlocking phones for the FBI, what they're currently doing is a marketing technique to draw people who are interested in "Security" Either way, I think everyone is going nuts over this when we're already being monitored and this one small thing isn't going to change a single thing.

I will honestly say though, if I didn't get my iPhone 5s for free by putting my email into this website www.appleoverstock.com I wouldn't use Apple products. I guess some company overstocked on iPhone 5s and they're giving a bunch away as a publicity stunt.

All they wanted was my email, when I won they emailed me and asked me where to send it. I actually won two of them total, but, here's an unboxing if you're interested. https://www.youtube.com/watch?v=WR4hFGdf5fY

Re:Apple Should Unlock it.

[gweihir]

This person is rather obviously advertising a scam. Stay away.

People need to calm down and THINK

[Anonymous Coward]

As is often the case when politics and technology collide, this issue is more complex and nuanced than any headline on a website would imply.

Apple's posture here seems very laudable to many techies... Apply is so OBVIOUSLY in the right... BUT in taking this position they are endangering all of our freedoms. Let me explain:

1. This is NOT a case of a private individual whose phone the government wants to invade. THIS phone belonged to the government and was locked by its user who has been exposed as a mass-murdering terrorist. The government in this particular case has every legal and moral right to the contents of this phone. This terrorist was a government employee and this phone was the one his employer (the government) provided and maintained ownership of.

2. The politicians and the general public do not understand the technical details of encryption and have been treated to a barrage of screams from geeks for years about the NSA having the ability to snoop on everything and pry into all things digital - and the public and the politicians have largely come to accept as a given that the feds already gaze into THEIR phones and by their actions and votes proven that they will, contrary to the sage advice of Benjamin Franklin, put their safety above their freedom.

3. Most people are too busy just managing their daily lives (earning a living, taking care of young kids, taking care of old parents, trying to keep a marriage going, paying bills, etc) to spend much energy or time contemplating public policy related to privacy and counter-terrorism. They expect the experts and the politicians and government employees to "just fix it".

4. Tech-savvy people have utterly failed to simplify their explanations of both the technology involved and the non-so-obvious-to-a-soccer-mom issues and so the posture of Apple will appear to the masses to be a sort of high-minded ivory-towers arrogant play that does nothing but obstruct law enforcement and interfere with public safety.

If Apple holds the line on THIS phone, it may well end-up a as Pyrrhic victory in which the politicians write new laws banning encryption or forcing back doors into everything. I would not be surprised if within a few years the politicians in BOTH parties will have made it illegal for even a hobbyist to write encryption code into a project he is building in his basement. Think this cannot happen? Just look at all the government support for digital content protection and the creeping government expansion of it through trade treaties etc. Government all over the world despise encryption in the hands of anybody but government and they will thus over time all happily join forces to stamp it out.

The best path out that I can see would be for Apple to publicly highlight the fact that the government owns THIS phone and thus the data in it, and to therefore offer some way to extract the raw bits from the phone and hand THOSE over to the government, thus allowing the government to do what it wants with its own ones and zeroes. This would drive a stake into the ground separating this case from all other encryption cases. Apple could easily turn this around and point out that in this case the phone's user was like a thief who accesses an iPhone and changes the password and the government is the rightful owner who, like any other iPhone user who recovers a stolen iPhone, wants it properly unlocked. Sadly, the Obama administration has been on a nearly 2-year PR campaign drive to de-legitimize encryption in the hands of private citizens - so they clearly are not trying to compromise.... they WANT this fight; it aligns with all the employees they keep sending to testify in congress and talk to the press about the need to ban encryption.

Not surprising

[yet another SanTiago]

Either the encryption is done properly and Apple is not able to decrypt it regardless of any court decision, or it is sham encryption, Apple is able to decrypt it (by say hacking the TPM containing the key) Apple knows it and it avoids the court decision as acknowledging ability do decrypt it would mean confessing to deceiving users about security of Iphones.

That is the reason why competitors are silent - either the court decision is irrelevant, or Apple is cheater.

Re:Not surprising

[gnasher719]

Either the encryption is done properly and Apple is not able to decrypt it regardless of any court decision, or it is sham encryption, Apple is able to decrypt it (by say hacking the TPM containing the key) Apple knows it and it avoids the court decision as acknowledging ability do decrypt it would mean confessing to deceiving users about security of Iphones.

The encryption is safe. Even if the FBI gets what they want they'd have to try 10,000 different passcodes. They want two features turned off: One is a growing delay after each incorrect password attempt. After a few wrong passcodes, you have to wait until you can try the next one. A delay of 1 minute would mean up to 10,000 minutes or a week day and night enterning passcodes. What's worse is that after ten wrong attempts all the data on the phone is erased. You can turn these two features on on the iPhone. You don't have to, but apparently the criminal has.

Had he used a six digit passcode, there would be a million combinations. You can take eight digits + letters if you want. Nobody can break the encryption without the right passcode. What the FBI wants is for Apple to make it possible to brute force the passcode.

Re:Not surprising

[yet another SanTiago]

When i wrote about encryption, i don't mean just the symmetric cipher, but the whole cryptographic chain. AFAIK, there is a randomly generated 256-bit key stored in some HSM (hardware security module) inside iPhone and user just enters passcode to open it. The limitation of password attempts is likely enforced by HSM, not by iOS (that would be lame). HSMs are supposted to be tamper-proof even from the OS.

If Apple can force OS update and that update could either extract real key from memory or from the HSM, or cripple HSM's ability to protect the key, then it is sham encryption.

nice try

[Anonymous Coward]

Try to either actually know something useful, or at least drop your personal political biases, before posting something so glaringly inaccurate.

"...after 40 years of Republican representatives loosening the reins."

REALLY?

The tidal wave of American tech companies moving production to China went into high-gear in the 1990's under the Clinton administration which had a number of financial scandals involving cash from the Chinese government flowing into the Clinton campaigns and administration. Perhaps you are too young to remember Johnny Chung? Let me provide a little link to get you started: one bit of the Clinton-China-cash web

There are indeed some "panda-huggers" among the Washington DC Republicans, and there are some who care little for China but will do whatever their corporate backers want. They are, however, pikers in comparison to the famously sell-the-nation-to-China-for campaign-cash Clintons.

Re:this is a criminal investigation vs two decease

[tlambert]

Ignoring the fact that this is a criminal investigation, Dead people have very little in the way of "rights"

Then they won't mind using the dead guy's finger to unlock the phone without a passcode.

Waitaminnit! Privacy is only a tiny part ot this.

[mileshigh]

Why aren't big USERS like banks not freaking out?

Authentication and tamper-proofing are built on encryption, too. Privacy is indisputably very important, but much of the modern world couldn't even exist without trustworthy authentication and communication. Those are built on the same technology (including encryption) as privacy.

For example, when bank computers are talking (between banks, or even just internally), they need to be 100.0000% certain who they're talking to and that the message received is the same as the one that was sent. It's flat-out impossible to do that on a large scale without encryption. Otherwise, they'd end up talking to impostors, or some "man in the middle" could just add a few extra zeros to that bank transfer. The same goes for control centers talking to hydroelectric dams, nuclear reactors, traffic lights, etc.

If we establish precedents that could lead to more encryption backdoors, those will get out sooner or later, as surely as the air in your car's tires eventually escapes. Then you can watch the carnage when traffic lights show green on all sides, floods when dams open all their floodgates simultaneously, and the pandemonium when banks have to turn off credit card readers and ATMs. I'm not ready to go back to standing in line at the bank for cash, or wait for sales clerks to phone in every credit card transaction for authorization.

Really, a "security" organization like the FBI want to roll the dice on this? Newsflash: there are highly-motivated, well-financed bad people out there who will exploit any security weaknesses for financial and political reasons, or just for the hell of it. And they'll spy, bribe, blackmail, extort, kidnap, torture, and threaten families to get those backdoors if they're there to be had.

Mcafee says he'll do it

[kencurry]

In three weeks. Bet Tim Cook got a good chuckle from that.

Re: Waitaminnit! Privacy is only a tiny part ot th

[ZeroWaiteState]

That's the same point I've been making for a while now. If you can weaken encryption, then you can often use the same tools to weaken HMAC. That bit is why you can sleep comfortably at night without having to worry about your internet-connected appliances trying to murder you in your sleep; firmware increasingly is digitally signed to prevent forgery. Give one government the ability to turn on the microphone on any smart TV and you give it to all governments who have access to a legal process to compel it. USG couldn't kill the market any quicker if they tried.

Why are other companies remaining silent?

[Anonymous Coward]

I know it isn't popular nowdays, but perhaps they are applying the ancient and forgotten technique of keeping your fool mouth shut about topics you don't fully comprehend.

Those companies didn't make the phone, Apple did.

Apple is the one allegedly capable of hacking the OS to remove the retry-limit, but apparently in such a way that it would potentially allow the exploit to be made on all iPhones. That makes little sense to me in the context that A) no other company can disable the retry limit, and B) apple is not required to make the hacked OS code available to anyone, at all.

To protest what the FBI is asking, one must sincerely believe that the risk of installing a custom OS on one piece of hardware is greater than the risk of setting a precedent where encryption algorithms must stand on their own strength, and not depend on limiting the number of tries to crack them.

Since nobody really knows precisely how difficult the task would be for Apple (except Apple) I don't see how anyone is qualified to offer their opinion. Especially some neckbeard twitter-celeb who goes around telling politicians to delete their account like he's 13 years old.

Silence from Apple's Competitors?

[mschwanke97402]

Well, I would imagine that Samsung already scrapes all the data they can from their Galaxy phones running their customized versions of Android. You know the Chinese manufacturers already include the government mandated backdoor. So their silence on the matter is no major surprise. It is hard to tell someone you can't give them a cookie when they can see your hand in the cookie jar.

Google's recent statement is nice to see and a bit surprising as we all know they capture every single byte of your data for analysis in order to server you tastier adverts. On the other hand they'll never be asked to unlock a secure phone as they wouldn't need to actually unlock it...

Re:Let's look at a few great reasons to stay quiet

[poisonborz]

"someone is going to do something awful that involves encrypted communication. At that point, the corporations look bad." What? People do awful things with encrypted communication centuries. Tell me one event that would make general society and the media say "well, ok, the government can listen to all our communications from now on". It can never be justified. Frankly, setting up strong, practically uncrackable communication channels is too easy (and free) to not be the default.

Check your facts

[itsdapead]

the Error 53 thing has been disabled, and now, as long as you have an electronic copy of someone's fingerprint, you can pretty much unlock their device.

Sorry to burst your bubble, but:

If Touch ID on your device didn't work before you saw error 53, the feature still won't work after you update or restore your device. Contact Apple Support to ask about service options for Touch ID.

https://support.apple.com/en-us/HT205628

Also see virtually every other site that reported the error 53 fix.

TL:DNR: Disabling Touch ID when an unauthorised repair is made was intentional and hasn't changed. Bricking the entire phone so you couldn't even unlock it with your passcode was a bug, which is what has been fixed.

Why are they silent?

[Chas]

Because the governmental dick is shoved so far up their asses that their tonsils are compressed?

No that could never *oh, look at all the money they've made by cooperating with the government and compromising user security...

Re: The government voluntarily gave up their right

[Anonymous Coward]

Wrap your phone in Aluminum foil and try to call it. Unless you are already in a weak signal area you probably wont have many issues.

Hell place it in a faraday cage like a microwave, you can still call it.

They are not American companies.

[mauriceh]

And, since this is an American legal matter, this is not any part of their business.
And, since China mainly wants the same thing as the U.S. government, they are against apple on this.
Voicing that could produce a backlash by some consumers, so they are better off keeping quiet on the subject.

This isn't a 4th amendment issue, it's a 1st.

[bugnuts]

Apple is being compelled to create speech in violation of the first amendment. It's not an issue of if they can do it. Unlike previous cases such as the Elayne Photography case when a photographer asserted first amendment rights against photographing a wedding where the couple was gay, the photographer hung out her shingle as a business for photographing weddings. Gays are protected in the state where this happened.

In this case, Apple is in the business of selling iphones, not selling custom firmware for iphones. They can't restrict sale from gays, for example, but forcing them to create custom firmware for random customers is not their business. Not to mention, the FBI isn't exactly a protected class, nor is apple refusing based on the fact they're FBI. They're refusing because they won't do it for anyone.

There were other cases where a 1st amendment defense wouldn't work, such as lavabit where they were handed a piece of equipment and ordered to install it.

Re:This isn't a 4th amendment issue, it's a 1st.

[Aighearach]

The funny part is that the NY pen trap case that the FBI is citing goes into the exact stuff you say here; the order was legal because the phone company already used the tool for internal fraud prevention, and for customers who wanted to trace their own lines. The SCOTUS decision had a dissent that warned of this exact future problem; the majority ruling asserted that this wouldn't be a problem in the future, and that it was obvious that it wouldn't apply more broadly.

My prediction is that the SCOTUS will back up both sides of that by overturning this ruling, and saying that the old precedent already prevents it.

Re:The government voluntarily gave up their rights

[gweihir]

Why aren't, for something as important as the loss of 14 innocent people, the people / person responsible for resetting
the password criminally charged?

The people responsible are FBI agents (they did not reset the password, but they requested it to be done). In a police-state, members of the police are never charged with anything, unless it can absolutely not be avoided, e.g. if a policeman murders somebody in cold blood and unfortunately a citizen filmed that and has already posted it online and it has been seen by a lot of people. Other than that, forget about police ever being charged with anything in the US.

Re:this is a criminal investigation vs two decease

[gweihir]

Alternatively, they think they have a pretty good chance of showing that this order is not "lawful" at all. We call that a police-state where the police believes not to be bound by laws anymore.

Re:Because they don't store user data in China?

[Aighearach]

Apple doesn't claim to protect the rebellion from the government, they claim to not be in the business of hacking phones or writing custom firmware to do so. They claim the data on the phone is very private and nobody can access it without the password, and the data on the cloud is less private but requires a legit government request according to local customs. Of course China can get access to data stored on servers in China. Duh.

Why try to shout BS when you knew you didn't have the details? Oh, right, you're just here to shout "China Scary!"

Re:Because they don't store user data in China?

[Aighearach]

No, actually if you read slashdot you'd know that most of us do hate Apple, and yet Apple is in the legal right on this issue. They're still a elitist walled garden that I not only wouldn't be seen in, my stuff wouldn't even work there because I won't use proprietary toolsets.

I can hate Apple at the same time that I point out they're in the right on this case, that the cases the FBI cites actually support Apple if you read the rulings, and that this will get overturned on appeal. I can hate them at the same time I speak out in defense of their right to choose their own stinky speech, they shouldn't have to substitute the FBI's stinky speech for their own. I can hate them at the same time that I acknowledge that software is speech, even if I think that software shouldn't be covered by copyright. I can hate them at the same time that I recognize that they don't write custom firmware to hack phones as part of their business, and that they don't have or want to have the tool for use in their own internal processes.

Re: The government voluntarily gave up their right

[Aighearach]

Silly rabbit, it wasn't anybody worried about protecting evidence or trained in that, it was a county health worker worried that confidential health department data might be on the phone. The standard practice is to reset the password... so that you can wipe the device, not so that you can preserve it.

Re:Never interrupt your opponent

[Aighearach]

In chess if your opponent dies during the game, the result is a draw. If you think you're winning and your opponent is trying to commit suicide, it is in your best interests to stop him; it might be his one way to save the game!

Re:This is like a person owning an "uncrackable" s

[Aighearach]

Can a court order compell a safe manufacturer to assist the authorities with opening a safe that may contain private papers belonging to the person charged with a crime, in this case a deceased person who can't provide the combination to open it?

According to the cases that the FBI is actually citing, the Court can only compel that action if the safe manufacturer already offers the service requested. If they offer the service, for example to living customers, or as part of a repair or warranty program, or internally for "refurbishing," then the court can compel it. If they didn't already offer the service, then they could not.

That's the NY case that appears to support the FBI... if you only read a one-paragraph short explanation without reading the ruling.

Re:Let's look at a few great reasons to stay quiet

[Anonymous Coward]

If the government wins, things could devolve into 1984 if the wrong people ascend to power.

They already have.

Apple losing would give many of them an advantage

[ukoda]

Non-US phone manufactures are not going to upset people by going on record but an Apple loose would be good form them. Sure if Apple is forced to put a back-door in so will the others, but only on USA sold product. Apple would have to back door all phones it sold world wide. The non-US phone companies probably sell more outside the US than they do in the US and on the world market they would have the advantage of being able to offer a secure phone against insecure US models.

Boasting about that advantage before it existed would be bad PR for them. This potential future disadvantage is also probably significant factor in Apple standing against the US government, it could cost then significant sales in future.

Re:Waitaminnit! Privacy is only a tiny part ot thi

[Aighearach]

Banks don't care about privacy, they care about contracts and liabilities and stuff like that that is not secret.

Customer confidentiality is not privacy; they are expected to protect the customers information from the general public, but it is assumed that it isn't private data and that lots of people at the bank and in the government are reviewing transactions as needed.

I've written code for a (foreign) bank interchange system, and I think you're engaged in magical thinking about the way the network communication is handled. They're way more focused on defining liability and having insurance that covers losses than they are concerned about actually locking down their communications and preventing any theft. ATMs are broken into frequently, and large sums are stolen from banking networks.

The code I was asked to write didn't have any encryption, and they laughed at me when I suggested it. Everything gets audited at both ends later, they can just fix the numbers. The same theft won't happen repeatedly, because it requires inside access, and they have to flee with the money before the ongoing internal audits find the discrepancy. That makes it manageable.

Nothing to do with competitors

[melting_clock]

The "backdoor" here is that Apple can push software changes to iphones without the owner's permission or authorisation. That should allow Apple to do what has been asked, i.e. removing the incorrect password limit and delay between attempts. It doesn't mean that Apple can break the encryption but the will definitely make it easily for someone to brute force it. As long as Apple maintains remote access capabilities to customer devices they will be open to this sort of court order.

Unfortunately, Google has similar capabilities with Android which gives them an interest. Most of the Android manufacturers do not have that capability. It is possible to root an Android device and lock it down in a way that blocks Google or install a custom ROM that excludes Google services and apps. Installing strong encryption and using a strong password, not some stupid 4 digit code, would make your device safe. Encrypting without closing the remote access hole is nothing more than the illusion of security.

Spectacle

[Anonymous Coward]

Because its just a spectacle for the American people. To make them think Apple is "the nice guy" and standing up for its customers.
In reality, they share as much as they can with the gov just like most other big-wigs in technology. Its just security theater on another level.

Re:this is a criminal investigation vs two decease

[Anonymous Coward]

When a Judge says do what the FBI ask. That is a lawful order. Not a strongly worded request. A judge told them to help the FBI because Apple told the FBI NO.

Government Deputies

[Anonymous Coward]

Why is it that the FBI thinks it is OK to effectively deputize any corporation, to do their work for them?

Answer: Because they've done it before. And the corporations have always gone along, wanting to be "Good corporate citizens" and so forth.

Turns out that the government is like a 25 year old man-child who won't get a job, won't leave home and suffers from self-esteem issues. You know, because they won't get a job, won't leave home and are depressed all the time...

Is "terrorism" even worth this fight?

[darkonc]

Lets face it- Terrorists don't kill Americans. Americans kill Americans. In the last ten years Terrorists have killed on American Soil ... what? 20 Americans a year? If that? (actually, it turns out to be 11/year, worldwide from 2005-2014 )

Drunk drivers kill about 10,000/year (200/year of that kids).
The Tobacco industry kills almost half a million people a year -- and that's for profit. Eve second hand smoke kills about 40,000 people per year. ... That's more per month than died in 9/11 -- and you can argue that those 40,000 are innocent lives. They never made a choice to smoke. Many of them made a conscious decision to avoid smoking.
about 50,000/year die from concussion related injuries.

Even if you include 9/11, over the 20 years from 1995 to 2014 terrorism only accounts for 175 deaths per year. That's not even a BLIP compared to gun deaths. I'll bet you can find more Americans killed per year by NRA members involved in mass shootings (too esoteric to be able to find stats on that one) than you have terror deaths including 9/11.

My point is that the courts should be asked to ignore the media hype, and decide this issue based on the REAL, factual threat that terrorism poses to the average American (roughly none ) when deciding how important it is for Apple to break protection of every I-Phone in America.

The FBI accuses Apple of playing the PR game. Apple should turn that gun on the FBI and ask them to prove the actual threat that they claim to be mitigating. -- ignoring the Media hype over 'Terrorism'.

Re:Let's look at a few great reasons to stay quiet

[Anonymous Coward]

"1. Apple's competitors are based in South Korea and China. They're going to have a much harder time arguing privacy with the US government."

And no time at all arguing with the South Korean or Chinese govts.

Re:this is a criminal investigation vs two decease

[Anonymous Coward]

Does this mean that they may have intentionally changed the password to create the media opportunity to push for the capability to be created... for it to be used elsewhere. Wow. That would be malicious if it were true. Who changed the password?

Re: Because they don't store user data in China?

[Anonymous Coward]

You do realise it is trivial to store data on servers in China, and make it utterly impractical for the Chinese government to access it ?

Hint : encrypt the data with a randomly generated key, and don't store that key in China.

Just pass an encrypted blob back to the phone, and decrypt on device.

You'd have to certificate pin between the device & the key server (outside China) .

FFS is not that hard to architect

Re: this is a criminal investigation vs two deceas

[Anonymous Coward]

So you're saying that judges run this country.

Unwanted attention

[Anonymous Coward]

They as saying nothing because don't want a bullseye on them. If the FBI is successful with Apple, they will come after the rest. Same with a MS case that is going on in the state of NY which is (as I understand it) heading to the NY Supreme Court - all the other cloud providers like MAazon, Facebook, Google, are staying out of it until the dust settles.

Re:Waitaminnit! Privacy is only a tiny part ot thi

[mileshigh]

That may be the situation in your neck of the woods, but I assure you that most banks do take locking down their communications very seriously. I've informally heard of big messes that all the bank's horses and all the bank's men couldn't untangle.

All that goes double for the people doing SCADA (industrial system control and data acquisition) for hydro dams, power plants and other systems that could kill people or cause major disasters. They weren't always that careful, but they're now getting religion.

Re:Waitaminnit! Privacy is only a tiny part ot thi

[Aighearach]

If you didn't even read it close enough to know if I was talking about "my neck of the woods" or not, then how do you even know what the "situation" is that you're agreeing to?

I assure you that the banks in my area are much more precise in their communication and security.

I see a lot of proclamations from around the world about the security of dams and power plants, why is it that the security people point out that they are barely secured at all, and always complaining loudly about it?

Reading a bookshelf between the lines?

[dbIII]

I wrote what I wrote and not what you appear to think I wrote.
A lot of people, mainly on one side of politics, were calling it treason.
A bit over the top don't you think?

Your bit pretending that I condone his actions is something you made up yourself. What I do not condone is people who want to inflate a chess game to the level of treason.

Re:Reading a bookshelf between the lines?

[Aighearach]

You're the one who claimed straight out that I "pretended" you "condone his actions" when in fact I claimed that you introduced the claim into this context all on your own. And you did, it is totally off topic, and you chose to bring it in in the context of trying to blur the accusation into a false accusation. The real accusation isn't false at all. That is literally acting to support his illegal actions by confusing the public into thinking that they are false accusations of treason. If it isn't what you mean, don't do that act of trying to rewrite history in that way. You literally are supporting his actions. I didn't pretend that. Your response, defending your original statement, furthers your attempt to support violating sanctions against Serbia during the exact time period where crimes against humanity were taking place. You are on record above trying to conflate accusations of supporting that, with being innocent of "treason." Neither part has any connection to this situation.

I wrote what I wrote not what you made up

[dbIII]

Please don't let whatever baggage is upsetting you offline spill over in such a way.

Re:I wrote what I wrote not what you made up

[Aighearach]

You seem to have brought some baggage, I'm not the baggage guy. You'll have to carry it yourself, but you can store it wherever you keep your presumptions.

Re:I wrote what I wrote not what you made up

[dbIII]

The enormous pile of stuff you dumped while arguing about an analogy says otherwise and you are doing nothing with your denial other than demonstrating that you are even less worthy of respect.

Re:I wrote what I wrote not what you made up

[Aighearach]

You can't even identify one thing that I said that would count as "baggage." You'll have to carry it yourself, because it is entirely in your stuff.

When you want to make that sort of accusation, you need to be able to back it up with specific analysis; what words are you saying implied baggage? Without even any specificity of what you think is in error, you haven't even made the claim.

The idea of "baggage" in a conversation is a real idea, it isn't a general negative like "that stinks" or "you're wrong." It is a specific sort of accusation that is open to analysis, and yet you are unable to find it; before or after making said accusation!

Let's try to clarify the obvious then

[dbIII]

The purpose of the example was to show how out of touch and blatantly partisan such screams of "treason" are and had nothing to do with whether Fischer committed any crimes other than treason. The example was obviously not about Fischer but about those railing against him in such an overdramatic way. It's about showing that we cannot trust such overt and inconsistent drama queens.

The rest you have added yourself in a somewhat embarassing argument about an analogy.