Apple Is Said To Be Working On an iPhone Even It Can't Hack (nytimes.com)

An anonymous reader writes with this story at the New York Times: Apple engineers have already begun developing new security measures that would make it impossible for the government to break into a locked iPhone using methods similar to those now at the center of a court fight in California, according to people close to the company and security experts. If Apple succeeds in upgrading its security — and experts say it almost surely will — the company would create a significant technical challenge for law enforcement agencies, even if the Obama administration wins its fight over access to data stored on an iPhone used by one of the killers in last year's San Bernardino, Calif., rampage. The F.B.I. would then have to find another way to defeat Apple security, setting up a new cycle of court fights and, yet again, more technical fixes by Apple.

Comments

Torn

[WhipITGoodER]

I want security, but if access to the data on the phone could potentially save lives, that seems pretty important too.

Re: Torn

[Anonymous Coward]

I find it hilarious that security efforts are not being driven by the government but to protect people from the government.

Re:Torn

[Nethemas the Great]

If the lack of security--due to government mandated back doors--allows for state sponsored persecution of innocents, enemy state or NGO attacks, etc. where would you stand then? You do grasp the concept that a security vulnerability may be exploited by any actor, at any time, not solely the "right and just" United States government after receiving a lawfully obtained court warrant?

Re:Torn

[alvinrod]

In a perfect world maybe, but you're not considering the real world where few lives will be saved, but the vulnerability will be abused constantly.

Re:Torn

[Anonymous Coward]

I want security, but if access to the data on the phone could potentially save lives, that seems pretty important too.

So the government should have a back door into every mobile device on the planet (and by extension every hacker capable of finding that backdoor) just on the off chance that the user is a terrorist?? If something can be abused by government security agencies it will be abused, and it will be abused with wild abandon. I think the Snowden revelations made that clear.

Re:Torn

[Sax Russell 5449D29A]

"If listening on every citizen's phone calls could potentially save lives..." –Sting Ray

Those who would give up essential liberty, to purchase a little temporary safety, deserve neither liberty nor safety.

Re:Torn

[Nethemas the Great]

In case I wasn't clear with my above post. This is the physical version of what I'm talking about.

Re:Torn

[Anonymous Coward]

Unfortunately lives have already been lost as you should have known

Re:Torn

[the simurgh]

this is because the fbi screwed up on purpose and refused to use a very easy way to get the data to try and break American freedom to privacy

Re:Torn

[Anonymous Coward]

I want security, but if having a government minder residing in every home could potentially save lives, that seems pretty important too.

Re:Torn

[Mitreya]

if access to the data on the phone could potentially save lives

That's not really an argument, but more of a random statement.
Keeping everyone sedated and locked up in a room when they are not at work could also potentially save a lot of lives (by keeping some perpetrators and many potential victims off the streets). But we are not planning to do that either.

Re:Torn

[Darinbob]

Is there evidence that lives could be saved?
Even if true, the FBI could always say that they want to put RFID tags into every person and newborns at birth in order to solve crimes and save lives. It would seem like a huge invasion of privacy and government intrusion, but that's only because care about our own personal rights. But when it comes to a third party we're a lot more blasé about what the government does to companies or people that aren't us.

Re:Torn

[BitterOak]

I want security, but if access to the data on the phone could potentially save lives, that seems pretty important too.

Well, if your phone has information which can save someone's life, then of course you have the option of unlocking it for the government. No one is forcing people to keep their phones locked. But Apple is giving people the choice.

Re:Torn

[Anonymous Coward]

in a perfect world countless lives would be saved by limiting the speed of cars to 20kph but no one wants to do that either. I am agreeing that the risk/reward outlook favors encryption by a wide margin.

Re: Torn

[Anonymous Coward]

Anne Frank had something to hide from the government

Re:Torn

[Anonymous Coward]

Thanks Tom for this quote

security vulnerability may be exploited by any actor, at any time, not solely the "right and just"

Re: Torn

[saloomy]

People who would trade liberty for security deserve neither. An overzealous government with unlimited reach and power is what so many have died for, paying their lives as the cost of liberty for their children.

A free-thinking libertarian once gave me a great acid test for weather or not laws should exist: Would the existence of such a law have helped the colonies overthrow King George III or would such a law have helped King George III keep hold of the colonies?

In my opinion, there are really three things here that have to be considered:
1. What you have
2. What you know
3. What you are
What you have is the information on the phone. This information on an iPhone is encrypted, and would take unimaginable amounts of time to reverse, but it is reversible.
What you know is the key to reverse the information. What you are includes the thumbprint that can also be used to "mimic" what you know (the key).

The government through a warrant has the absolute right to search and seize what you have: The encrypted data.
The government does NOT have the right to what you know (5th Amendment).
The third one: "what you are" is tricky. It only works in this case of the phone has been left ON, and has been unlocked in the past 48 hours using the key. From what I believe: due to the 13th amendment, the government can not force you to enter your fingerprint, because of a catch 22. You have not been found guilty (yet) of a crime, and doing so would constitute "involuntary servitude".

I don't think it would serve us well either to have all of our information readily accessible without any privacy protections either. What happens when China wants this information to find out who has been preaching Christianity in China, or Saudi Arabia wants to know who has gay thoughts?
Our iPhones have such intimate details about our lives and so much information, I wonder if it would not server us well to classify that information as an extension of "what you know".

Re: Torn

[Anonymous Coward]

You believe the lie. Apple has already caved to the Chinese government. This is only marketing.

Re:Torn

[MobileTatsu-NJG]

I want security, but if access to the data on the phone could potentially save lives, that seems pretty important too.

Would you be willing to give a copy of your house keys to the local police department? Afterall, if everybody did that, then lives could be saved by letting the police enter suspects' homes on a whim. In fact, you could even assume those that didn't volunteer their keys are suspect to begin with!

Re: Torn

[Anonymous Coward]

I don't have an iPhone, why should I care? Apple didn't care when the Indian government went after Blackberry.

Re: Torn

[hackwrench]

Because when whoever comes for you based on what you do have, there will be no one left to care for you?

Re:Torn

[Macdude]

The problem is it's not just this phone. It's the 12 others they have on stand by, it's the 175 NY has lined up and ready to go -- for starters. The other problem is there is no guarantee breaking into this phone (and enabling the government to break into any other iphone) is going to save even one life. Is it worth compromising the phone's security (and enabling all kinds of fraud) on the off-chance that some information it contains may help the government prevent a death?

This couple purposely and specifically destroyed their phones and computers before going on their rampage. Do you really thing they left incriminating evidence on the guys's work phone?

Ask yourself, what is the price of freedom? If you want to live in a world where your every move isn't monitored and recorded by untrustworthy people who seek to capitalize on every little weakness you may have, perhaps the risk of a death here or there is an acceptable price. The question boils down to, would you rather live as a slave or risk death living as a freeman?

Re:Torn

[fisted]

In a perfect world, lives would not end prematurely in the first place.

Re:Torn

[peragrin]

If you give up freedom in the name of security you get neither .(paraphrased from Ben franklin)

There is nothing of value on that phone. exactly like how the NSA bulk collection didn't stop a single terrorist threat. Every so called threat it stopped is deeply classified as if the terrorists didn't know we stopped them.

Re: Torn

[Anonymous Coward]

I don't have an iPhone, why should I care? Apple didn't care when the Indian government went after Blackberry.

Learn from the past:

First they came for the Socialists, and I did not speak out—
Because I was not a Socialist.

Then they came for the Trade Unionists, and I did not speak out—
Because I was not a Trade Unionist.

Then they came for the Jews, and I did not speak out—
Because I was not a Jew.

Then they came for me—and there was no one left to speak for me.

https://en.wikipedia.org/wiki/First_they_came_...

Re:Torn

[KGIII]

That really depends on one's view of perfect.

Re:Torn

[Pseudonym]

I don't know why people modded you down as flamebait. You've summed up the dilemma perfectly. Better than most, actually, since tend you see a lot of people falling for the "liberty vs security" rhetorical trap when topics like this come up. You recognised that privacy is security. And only an idiot would think that lives aren't important.

It's not really relevant to the current case, since realistically we all know that exactly zero lives will be saved by the act of the government breaking into the phone. But as a general point, weakening security can indeed potentially save lives, and the "most wrong" answer is to kid yourself that all answers are simple.

Apple is in the right... this time.

Re: Torn

[postbigbang]

Profit!

Re:Torn

[Anonymous Coward]

If the lack of security--due to government mandated back doors--allows for state sponsored persecution of innocents, enemy state or NGO attacks, etc. where would you stand then? You do grasp the concept that a security vulnerability may be exploited by any actor, at any time, not solely the "right and just" United States government after receiving a lawfully obtained court warrant?

Well said. We give up what little privacy we have left at our own peril. Here you have a door they want opened. They will probably succeed at forcing it open. At first it will be a few phones, but then it will be an automated process. Then that won't be fast enough, and it will be a portable device. Then the device will be copied and it will be used all over the world at every checkpoint. I wouldn't be surprised now if certain customs agents don't demand the unlock code to get in the country, and then silently clone it. With the automated tool they wouldn't have to demand. Just drop the phone in the "terrorist detector" and watch it scan for anything of interest. That anything of interest could easily be not sufficiently praising some group or another. Got a phone they can't crack, well that is a presumption of guilt. Better lock you up till you open it up for them. And all that is ignoring the possibilities of governments around the world simply collecting contact lists of people and such, so they can better target their espionage efforts, and of course if there is actual company IP on the phone, they will want that too. What, your phone's browser stored the username and password to access a work related site? Well, better get that too. Could drain a bank account with that info too, depending on what is on your phone. (All of this also applies to laptops and everything else of course. A phone isn't all that different from a computer these days.)

Re:Torn

[KGIII]

> In fact, you could even assume those that didn't volunteer their keys are suspect to begin with!

I once had a couple of cops kick me out of Kansas for that line of thinking. It's a long story but I'll try to make it brief.

They tried to convince me that my refusing to allow them to search my vehicle is grounds to allow them to search the vehicle, that it constituted probable cause. Yes, I laughed aloud and explained that I was not a teen. I did applaud their effort, quite literally. They then told me to get out of Kansas and that if they ever saw me again, they were going to arrest me.

Oddly, with all the travel I have done (and the condition and manners in which I've done it) that's the worst thing I ever faced. There's more to the story but that's the gist of it. I don't believe the rest is significant but I'll share it if you want to understand the circumstances. I'm not sure if I should be frightened or amused by the treatment. I have to wonder if they use that line often and if anyone falls for it?

I'm also pretty sure they can't just kick me out of Kansas but I didn't figure I'd stick around where I wasn't wanted and I was headed out anyhow - and right on the border. They were even kind enough to give me an escort to the on-ramp at the nearest highway. I didn't have the heart to tell 'em that I'd just gotten done helping clean up after 90% of Greensburg had been destroyed by a tornado and that I'd only cleaned up because I happened to be right there in the area and they needed help. I just figured that I'd avoid Kansas. I've never been back.

Re:Torn

[Pseudonym]

If you give up freedom in the name of security you get neither .(butchered from Ben franklin)

FTFY. I happen to agree with the rest of what you said, but that particular misuse of the Ben Franklin misquote needs to be retired.

Re:Torn

[Anonymous Coward]

... if access to the data on the phone could potentially save lives, that seems pretty important too.

The question to ask yourself isn't "if access to the data ... could ... save lives?" (notice how even you are putting in qualifiers to make it even more broad than that which is absurd (as "potentially save lives" would justify banning junk food)). It's "is access to data on the phone the ONLY way to save lives?". The problem with that is it's such an improbable, uncommon circumstance where there's only one source of information, you happen upon it enough to know there's a threat, yet still can't access the actual information. The rest of the time, you have plenty of other sources that give you plenty of evidence that would lead you to whether there's an actual threat and where it's at. Or as in the current case, the threat is already past and the issue is merely getting a long jail sentence for the defendant--something which is unlikely to save anyone's life except in the most indirectly of ways.

This is, btw, beside the point. It is patently clear that if one can own a gun, one can own a device, like a phone, that merely contains information that others may not be able to access. One is clearly much more life threatening.

Re: Torn

[Anonymous Coward]

If there were a garauntee, then they wouldn't have needed to search it, dumbass. That's why it's called a search. I'm sure that in your fantasy world, everyone in the government is evil, and all bad things that happen are false flag attacks.

Re: Torn

[Anonymous Coward]

You talk about the 5th amendment like it was made yesterday. It was made in 1789, almost a hundred years before the first telephone was made. There are simply no comparisons to be made and the writers could never have comprehended the technologically advanced world we live in today. You are a buffoon relying on the same old crutches to support you, without understanding they were made in a completely different time.

Re: Torn

[Anonymous Coward]

Even worse the government isn't just asking for assistance, they are demanding that Apple build the tool to circumvent the system. Reminds me of the stories I beard of Nazis forcing scientists to build weapons. I mean they only asked them to build weapons to help protect the lives of people in Germany.

Re: Torn

[penguinoid]

To be Frank, at the time, was a dangerous thing.

Re: Torn

[Anonymous Coward]

"And we wondered, whenever we had the time: who the criminal, what the crime..."

You have to proactively put effort into things like this. Not only when it is about you, or when you have time.

Re:Torn

[Anonymous Coward]

The only back door I want access to is the one on a nubile girl's butt.

Re:Torn

[PopeRatzo]

I want security, but if access to the data on the phone could potentially save lives, that seems pretty important too.

Access to the money you have hidden in your sock drawer could potentially save lives too. So give it up right now.

Re: Torn

[Anonymous Coward]

If the iPhone's security was as good as all this hullabaloo suggested, then the military is wasting its billions on secure comms equipment and they should just use iPhones instead.

Re: Torn

[PopeRatzo]

A free-thinking libertarian once gave me a great acid test for weather or not laws should exist: Would the existence of such a law have helped the colonies overthrow King George III or would such a law have helped King George III keep hold of the colonies?

God, "free-thinking libertarians" are even more banal than I thought.

Re:Torn

[PopeRatzo]

Those who would give up essential liberty, to purchase a little temporary safety, deserve neither liberty nor safety.

Don't forget though, Ben Franklin is someone who never had his liberty or his safety threatened. It's an easy platitude when you've got both.

Re: Torn

[bondsbw]

The government does NOT have the right to what you know (5th Amendment).

This only applies to self-incrimination.

Re: Torn

[NotBornYesterday]

So what? The Magna Carta was written 800 years ago, and we still value many of the principles it contains. Much of the beauty of the Constitution is how well engineered it is, and how much of its framework still works and applies today, including the 4th and 5th. The fact that the founders couldn't foresee our technology is irrelevant. What you don't seem to understand (most people, actually) is that the Bill of Rights doesn't grant people rights.

It states that these rights preexist, AND EXPLICITLY STATES THE GOVERNMENT HAS NO POWER TO INFRINGE UPON THEM.

Whether we are to be secure in papers in our houses, our strongboxes, or letters, or text messages is simply a game of semantics. These are all communications we intend to hold privately ... and therefore the government has no right to them.

Re:Torn

[Anonymous Coward]

A few lives lost are nothing compared to the loss of liberty to all.

Re: Torn

[NotBornYesterday]

I logged in just to see if I had points to mod you up.

Re: Torn

[preflex]

A free-thinking libertarian once gave me a great acid test for weather or not laws should exist: Would the existence of such a law have helped the colonies overthrow King George III or would such a law have helped King George III keep hold of the colonies?

I don't understand. Which condition should the law satisfy in order to exist? Also, what exactly does it mean to "help the colonies overthrow King George III"?

A law that would explicitly enable the revolutionaries to stand up to King George III would be a law that would help the colonies overthrow the King.
"We want guns and cannons and stuff!"
"Okay. Free guns and cannons for all colonists!"
"BOOM BOOM BOOM! We're FREE!"

What about a law freeing the colonies of taxation?
"No taxation without representation!"
"Okay. No taxes then."
"Yaaaay! This king RULES! No revolution!"

What about a law giving the colonies a voice in Parliament?
"No taxation without representation!"
"Okay. You can have some seats."
"Cool. Sounds fair. No need for revolution."

An overly oppressive law could also help the colonies to overthrow the king, by strengthening the resolve and numbers of the opposition.
"This king sucks!"
"Oh yeah! Well I claim primae noctis on all marriages in the colonies. You also have to pay your own way to England. You can't get married otherwise. We'll kill you if you don't comply."
"Let's kill him!"

Does timing matter? Couldn't the same law have different effects during different stages of the revolution? Consider something which, early on, would be non-controversial and "nip in the bud" revolutionary activities. However, if enacted after the colonies were already in revolt, this same law would be seen as oppressive and instead fuel rebellion?
"Don't talk to Ben Franklin!"
"Ben who?"
vs.
"Don't talk to Ben Franklin!"
"FUCK YOU!"

Is this really a good test? Wouldn't the most oppressive laws imaginable actually pass, because they would incite revolution? Should the gov't really pass crazy laws simply for the purpose of provoking the public?

Oh, and it's "whether". /pedant

Re: Torn

[argumentsockpuppet]

I appreciate someone who takes the big picture view and I wish more people were. That said, there are a few points I think are worth adding.

You can be compelled to provide a fingerprint under the current legal system in the US.
(I looked for a better legal reference, but this is a summary http://blogs.wsj.com/digits/20...)

Technically what you know might be called a key, but it's clearer to refer to it as a password or passcode because it is a small piece of information used to decrypt a large key. The large key is a randomly generated string of characters that is held in memory by the phone after the passcode is entered. That real key is used to decrypt the information on the device directly, while the password or passcode is used to decrypt the key. That's important because backdoors are usually considered to be ways of sharing the key with someone rather than the password and because the key is not something most software, like phone software, makes visible to the user. When you change your password or passcode, the phone doesn't get re-encrypted which would take a long time, just the key gets re-encrypted.

It is also worth noting that the 5th amendment doesn't protect you from having to provide what you know to the government; it only protects you from self incrimination. You can be forced to testify against your desire in cases where your testimony doesn't incriminate you. This is an important distinction to make since it prevents people from testifying against friends or people who share your viewpoint when you haven't done anything wrong but might sympathize with them. (Citation: Matlock)

If Apple had the key, they could be compelled to share it with the government. If they don't then they can't. What Apple could create is software that the phone would load without needing a password which would make the process of guessing the passcode easier and not result in a loss of the keys due to incorrect guesses. That's why Apple is focusing on not wanting to create hacking software rather than saying they refuse to provide information they already have.

What many in politics want is for Apple to keep a copy of the actual keys for each phone they sell and turn those keys over to law enforcement. Apple doesn't want to keep the keys, let alone be required to build a system that shares them, but if Apple wins this case, you can expect that will be the next demand.

Re:Torn

[Etcetera]

I want security, but if access to the data on the phone could potentially save lives, that seems pretty important too.

Would you be willing to give a copy of your house keys to the local police department? Afterall, if everybody did that, then lives could be saved by letting the police enter suspects' homes on a whim. In fact, you could even assume those that didn't volunteer their keys are suspect to begin with!

That's a false analogy. The police want help from the local locksmith to get into this house, which he made the lock for, because they have a warrant to search the premises. And the tenant is dead. And the property owner consents.

Re:Torn

[Anonymous Coward]

It doesn't matter. If we truly believe in the professed American cultural values, life is NOT, and has never BEEN, more important than our freedom and rights. If the price is 50, 60, 70% of us? We STILL believe our rights are more important.

Re:Torn

[MobileTatsu-NJG]

That's a false analogy.

No, it isn't. It's a question of if you trust your government. Even your own reply is full of stipulations like having various forms of consent.

Re:Torn

[Etcetera]

That's a false analogy.

No, it isn't. It's a question of if you trust your government. Even your own reply is full of stipulations like having various forms of consent.

Yes. Trust comes from checks and balances. They have a warrant. No one is disputing any of the facts in this case. Where exactly is the problem?

Re: Torn

[jxander]

iPhones are only secure within themselves. If I send you a text, that's open and easily interceptable.

Military needs secure comms, not secure storage.

(Well okay, they need both... But the storage is cheap and easily handled)

Re:Torn

[Anonymous Coward]

Well, one of mine is being threatened (it's not my safety, as an American I'm more likely to be killed by a police officer than a terrorist) and I fully agree with Franklin's statement.

Re:Torn

[Anonymous Coward]

The flamebait is this, "could potentially save lives". That is an absurd justification for anything. It isn't a dilemma because both sides must be equally bad. The choice is keep one and tolerate having just some of the other or destroy one and maybe, possibly have more of the other.

Or, using the language you are accustomed to, only an idiot would think that an unknown, unquantifiable possibility of protecting one value is justification for destroying another value.

Re:Torn

[_KiTA_]

In a perfect world maybe, but you're not considering the real world where few lives will be saved, but the vulnerability will be abused constantly.

Especially since they immediately demanded to violate those rights 12 additional times in order to break the encryption of 12 more iPhones -- none of which had anything to do with the bogyman of the week, terrorism.

This has nothing to do with fighting terrorism or protecting Americans. The FBI decided us using our right to privacy was making their jobs annoyingly difficult, so our right to privacy, in this situation, simply has to go.

Re:Torn

[_KiTA_]

That's a false analogy. The police want help from the local locksmith to get into this house, which he made the lock for, because they have a warrant to search the premises. And the tenant is dead. And the property owner consents.

Except that they're not asking for a key to that house. They're asking for a Master Key to 38.58% of the Houses in the country, along with the legal authority to demand a custom built master key for the other 60%.

Re:Torn

[Dcnjoe60]

If the lack of security--due to government mandated back doors--allows for state sponsored persecution of innocents, enemy state or NGO attacks, etc. where would you stand then? You do grasp the concept that a security vulnerability may be exploited by any actor, at any time, not solely the "right and just" United States government after receiving a lawfully obtained court warrant?

Considering how much people divulge about themselves online these days, the government or other actors don't need a back door persecute the innocents. Maybe, if we want protection from prying eyes, we should be more conscious about what we put out for the world to see.

Re:Torn

[Dcnjoe60]

Well said. We give up what little privacy we have left at our own peril.

Smart phones, like the iPhone, don't give up our privacy. We do, everytime we use them to post our whereabouts, pictures online, etc. The iPhone is just a device. We control the data we put on it or through it. Using the connect features of a smart phone and desiring privacy are an oxymoron. Put differently, those who truly value their privacy don't post their intimate details online, with or without a smart phone.

Re:Torn

[MobileTatsu-NJG]

There are a few. First is that the gov't is trying to compel Apple to make all of their phones vulnerable. Second is that the gov't is trying to compel Apple to actually do the work to make that possible, as opposed to just providing a simple service. Third is that they're trying to compel Apple to do this because the gov't didn't handle their evidence properly, leaving this overreach as their next resort to get at that data.

The reason to accept this happening is trust in the gov't. If the idea of handing them the keys to your house is unsettling, what they're trying to do with Apple is as well.

Re: Torn

[Anonymous Coward]

So did Timothy McVeigh.

Re:Torn

[Dcnjoe60]

Those who would give up essential liberty, to purchase a little temporary safety, deserve neither liberty nor safety.

Don't forget though, Ben Franklin is someone who never had his liberty or his safety threatened. It's an easy platitude when you've got both.

One would think that his involvement with the US Declaration of Independence, the revolution, etc., would certainly be evidence that he felt his safety and liberty were threatened.

Re:Torn

[Dcnjoe60]

this is because the fbi screwed up on purpose and refused to use a very easy way to get the data to try and break American freedom to privacy

Actually, it was the county officials who screwed up and locked the phone, not the FBI.

Re:Torn

[Etcetera]

That's a false analogy. The police want help from the local locksmith to get into this house, which he made the lock for, because they have a warrant to search the premises. And the tenant is dead. And the property owner consents.

Except that they're not asking for a key to that house. They're asking for a Master Key to 38.58% of the Houses in the country, along with the legal authority to demand a custom built master key for the other 60%.

Wrong.

First of all, you can't build a backdoor or a master key in after the fact -- the backdoor already exists in the 5C. If a there's a "Master Key to 38.58% of the Houses in the country", it's the locksmith's fault for creating that situation, not the police's fault for -- a Master Key being possible -- telling the locksmith to use it on this house they have a warrant for.

Furthermore, the FBI's own affidavit indicates that Apple can keep possession of the software (key).

“Apple may maintain custody of the software, destroy it after its purpose under the order has been served, refuse to disseminate it outside of Apple and make clear to the world that it does not apply to other devices or users without lawful court orders,” the Justice Department told Judge Sheri Pym. “No one outside Apple would have access to the software required by the order unless Apple itself chose to share it.”

Finally, nothing here is telling the locksmith to *build* Master Keys into future products -- that's a very separate debate: http://www.usatoday.com/story/news/politics/2015/04/02/encryption-bill-tech-companies-federal-law-enforcement/70734646/

If it helps, think of it this way: The iPhone 5C has a security vulnerability that's fixed in a later version. That security vulnerability enables the use of a search warrant in this case. Said search warrant was lawfully issued.

Re:Torn

[Dcnjoe60]

I want security, but if access to the data on the phone could potentially save lives, that seems pretty important too.

Well, if your phone has information which can save someone's life, then of course you have the option of unlocking it for the government. No one is forcing people to keep their phones locked. But Apple is giving people the choice.

What if you phone has information that can save someone's life, but you are dead and can't unlock it?

It isn't Apple that is protecting people. It is the constitution and law. The law says the data is protected unless a court deems your right to privacy is subordinate to public safety, which is the case, in this case. As such, what Apple is doing is determining that its views on privacy are more important than the constitution's. If you don't like how the law works, then work to change the law.

Re:Torn

[Dcnjoe60]

If the local authorities needed access to your house to save a life, they would just break in the door. They wouldn't need your keys. If police enter a home without probable cause or a warrant, then whatever they find cannot be used.

In the US, you are supposed to be presumed innocent until proven guilty. The shooters in CA, have been shown to be guilty, if they were still alive, they would still have rights, but being dead, it is hard to argue that they have the right to privacy, particularly if others might have been involved.

Re:Torn

[MobileTatsu-NJG]

That sound great, it just doesn't have anything to do with the points I brought up. The gov't isn't kicking down the door, they're asking the manufacturer of the house to spend their own resources to compromise the security of all the houses they've built for this one case, and this is after they threw the keys they HAD legally obtained away.

Re:Torn

[Etcetera]

There are a few. First is that the gov't is trying to compel Apple to make all of their phones vulnerable.

No, the search warrant is for this phone only. If that makes all phones vulnerable [which it doesn't, since firmware needs to be loaded onto it for it to get brute forced], then that's Apple's fuck up and no one else's. Apple should be getting the blame for making their shit insecure. A cynic might argue that the very public PR fuss they're making is intended to distract from that point.

Second is that the gov't is trying to compel Apple to actually do the work to make that possible, as opposed to just providing a simple service.

There's tons of common law and case law around this. For a live investigation, even a simple county sheriff can compel assistance from private citizens (and, by implication, corps) to assist in an investigation, apprehension, or something similar. If you've never had to respond to a subpoena of any type, trust me, it's more than a "simple service." Additionally, Apple was going to be compensated for their efforts.

Third is that they're trying to compel Apple to do this because the gov't didn't handle their evidence properly, leaving this overreach as their next resort to get at that data.

Although that's indeed very funny, it's irrelevant.

The reason to accept this happening is trust in the gov't. If the idea of handing them the keys to your house is unsettling, what they're trying to do with Apple is as well.

I don't trust "the government", but that doesn't mean the judicial branch doesn't get to issue search warrants and the executive branch doesn't get to execute them. I'm all for the slippery slope argument, but people are getting way ahead of themselves here and hand-waving away challenges.

Re:Torn

[Dcnjoe60]

You should re-read it, because it has everything to do with what you posted.

Re: Torn

[Khyber]

"There are simply no comparisons to be made and the writers could never have comprehended the technologically advanced world we live in today."

Bullshit. I can teach 65+ year old biddies from the ghetto how to repair laptops in a couple of weeks, yet they still can't program a VCR to save their lives. Teaching the founders today by analogy would take about ten minutes, and they'd then look at you and go "You sir, are a fucking moron."

Re:Torn

[MobileTatsu-NJG]

[which it doesn't, since firmware needs to be loaded onto it for it to get brute forced]

They have to do the work to do open the first one. After that there will be no convincing the gov't that Apple can say anything but "Yes we can do that." This is software for a mass-produced and popular product, there is no 'doing it once'.

Additionally, Apple was going to be compensated for their efforts.

They were going to be compensated for compromising their entire product line? Heh. K.

Although that's indeed very funny, it's irrelevant.

As I said before, this is about trusting the gov't. Yes, it's very relevant. In fact, we wouldn't even be seeing this challenge go down if not for this sort of incompetence. You're being bought with theater.

I'm all for the slippery slope argument, but people are getting way ahead of themselves here and hand-waving away challenges.

People are showing an interest in the proper functioning of Checks and Balances. The whole purpose of a system like that is to prevent over-reach. The government's argument is unconvincing and the damage it would cause to the citizens of the USA has not been sufficiently justified. It reeks of opportunism.

Re: Torn

[saloomy]

You missed the point of the test:

A law that would explicitly enable the revolutionaries to stand up to King George III would be a law that would help the colonies overthrow the King.
"We want guns and cannons and stuff!"
"Okay. Free guns and cannons for all colonists!"
"BOOM BOOM BOOM! We're FREE!"

--Yes! Thats why the second amendment was written. We have a right to bear arms, specifically so that we can overthrow an oppressive government. So that a "militia" can not be overruled and out-gunned by its government. In modern times, its unimaginable how a citizenry in the U.S could overthrow its government, but surely it would be easier with arms than without.

What about a law freeing the colonies of taxation?
"No taxation without representation!"
"Okay. No taxes then."
"Yaaaay! This king RULES! No revolution!"

-- This isn't a good law. Taxation is a form of procurement we exercise as a nation. Eg. we can not procure national defense independently, or pay for a healthy system of courts independently. When the government purchases goods or services, we all collectively purchase them without a choice. Taxation and government procurement is under force, so it should be used sparingly. To put a point on it: No taxation would have hurt the revolutionaries, so no.

What about a law giving the colonies a voice in Parliament?
"No taxation without representation!"
"Okay. You can have some seats."
"Cool. Sounds fair. No need for revolution."

A voice in parliament would have absolutely helped the revolutionaries, and with careful negotiation and a strong bargaining position, the war could have been shorter, or avoided entirely. This would have been a good law, and it would have helped the revolutionaries. Yes.

An overly oppressive law could also help the colonies to overthrow the king, by strengthening the resolve and numbers of the opposition.
"This king sucks!"
"Oh yeah! Well I claim primae noctis on all marriages in the colonies. You also have to pay your own way to England. You can't get married otherwise. We'll kill you if you don't comply."
"Let's kill him!"

This is a bad law for so many reasons. It would not have helped the revolutionaries because it would have strengthened ties to England due to the children, it would have drained the colony of females who could not afford the trip back, and (to humor you) would have resulted in many deaths due to the inability to pay for or survive the Atlantic crossing. Bad law, no.

Does timing matter? Couldn't the same law have different effects during different stages of the revolution? Consider something which, early on, would be non-controversial and "nip in the bud" revolutionary activities. However, if enacted after the colonies were already in revolt, this same law would be seen as oppressive and instead fuel rebellion?
"Don't talk to Ben Franklin!"
"Ben who?"
vs.
"Don't talk to Ben Franklin!"
"FUCK YOU!"

At no point would such a law have helped the colonies, No. This isn't a good law.

Is this really a good test? Wouldn't the most oppressive laws imaginable actually pass, because they would incite revolution? Should the gov't really pass crazy laws simply for the purpose of provoking the public?

None of the laws you have proposed would have helped the colonials, save for the voice in parliament which would have been a great law at the time. Yes, this is a good test. The goal isn't to incite revolution, the goal is that the will of the governed reign over the will of their government. Laws should enact the peoples choices and beliefs. The colonists wanted freedom and liberties, their government didn't want to give it to them.

Re:Torn

[MobileTatsu-NJG]

No, it doesn't, for the reasons I posted. Re-reading your post didn't make any remarks addressing the scale of the request appear.

Re: Torn

[ihtoit]

spot on. Magna Carta, the Bill of Rights 1689 and the US Constitution don't *grant* rights, they *guarantee* them against State interference. As opposed the Human Rights Act in England and Wales, which ONLY guarantees that the State won't infringe on rights *granted you by the State at its own sufferance* unless it *feels the need to* - and you have NO RIGHT TO EFFECTIVE REMEDY under the Human Rights Act! Don't believe me, go read it for yourself: compare the ECHR which the HRA is based on, next to the HRA - you'll see that under the Articles in hte HRA, #13 is absent. This is because the UK Government is under the criminally erroneous impression that Art. 6 covers it. IT DOESN'T, which is WHY IT'S IN THE ECHR IN THE FIRST PLACE!

Just FYI: there is a clause in the Serious Organised Crime and Police Act 2005 (linked here) which immunises State actors from ANY civil or criminal prosecution WHATSOEVER on the single proviso that they turn evidence in ANY OTHER PROCEEDING. Cliffnote: you can't sue the State!

http://www.echr.coe.int/Docume... (ECHR)
http://www.legislation.gov.uk/... (Human Rights Act (HRA))
http://www.bl.uk/magna-carta/a... (Magna Carta 1215, Modern English translation at the British Library)
http://www.legislation.gov.uk/... (Bill of Rights 1689 (the dates are different because this is the year the calendar changed))
http://www.senate.gov/civics/c... (The Constitution of the United States, including Amendments I-XXVII)

Re:Torn

[Khyber]

"Ben Franklin is someone who never had his liberty or his safety threatened"

Say fucking what? February 15, 1739: Franklin’s home was robbed by William Lloyd. November 24, 1737: Franklin and others organized a volunteer militia – the Associators – for the defense of Pennsylvania. December 23, 1750: Franklin was severely shocked, while electrocuting a turkey. June, 1752: Franklin, who has not yet heard of the French success of his 'sentry-box' experiment, experiments with flying a kite in a thunderstorm, and also proves that lightning is electrical in nature. September 16-17, 1765: Franklin’s house threatened by Stamp Act protestors. Deborah refused to flee, and the mob was dissuaded by 8oo Franklin supporters ready to combat them.

Franklin has had his liberty and safety at risk more times than you can possibly imagine. these are just the documented and notable ones.

Re: Torn

[Anonymous Coward]

It states that these rights preexist, AND EXPLICITLY STATES THE GOVERNMENT HAS NO POWER TO INFRINGE UPON THEM.

Thanks! I get tired of hearing the blender airbrush historians tell us that the constitution grants no rights-and then leaves it hanging there. The Declaration of Independence refers to these rights as "Inalienable rights" - hence, no need for granting. (hope I got that right. If not, argue in 3.2.1...).

Re:Torn

[Dog-Cow]

Also on one's definition of prematurely.

Re:Torn

[ihtoit]

it's like making some areas gun-free zones because we don't like those icky things and people get hurt around guns... shall we ask the Columbine survivors how that worked out for them?

Re: Torn

[Anonymous Coward]

Much of the beauty of the Constitution is how well engineered it is, and how much of its framework still works and applies today, including the 4th and 5th.

I assume you're talking about the Bill of Rights (which wasn't used at all for the first century or so), not the Articles of the US Constitution, and in which case, that 3rd Amendment gets a lot of use, eh? I mean, people talk about how the 1st and 2nd are so important because they are put in the beginning... the 3rd must get a lot more use than the 4th or 5th, eh?

Re:Torn

[Anonymous Coward]

Please refrain from posting wired links, they block users who have adblocks active (as they just did to me), and as such do not deserve the traffic.

Here is a link for those with similar objections.

Re: Torn

[Anonymous Coward]

Whether we are to be secure in papers in our houses, our strongboxes, or letters, or text messages is simply a game of semantics. These are all communications we intend to hold privately ... and therefore the government has no right to them.

Um, not quite. The government has every right to search through your papers -- and, by extension, through your iPhone -- for evidence of wrong-doing which may be used against you in a court of law upon obtaining a warrant to do so from a court of law. There is a process which must be followed in order to guarantee your right to liberty and freedom from unreasonable search and seizure. If they've convinced a judge that such a search is necessary, however, your information, whether in paper form or electronic, is an open book, and you as an American citizen, accede to that process as a necessary protection for society under the rule of law.

[posting anonymously to preserve mods]

Re:Torn

[Dr Damage I]

They say you should never try to be sarcastic in print. Apparently "they" were right. It never once occurred to me that GPP was anything but sarcastic.

Re:Torn

[slashping]

The problem is it's not just this phone. It's the 12 others they have on stand by, it's the 175 NY has lined up and ready to go -- for starters.

As long as they have proper warrants, I don't see what it matters if there is only 1 phone, or 10000.

Re:Torn

[Anonymous Coward]

the guy is dead his right to privacy expired, that is not the issue. The issue is whether or not the law allows the government to force a private company to build a tool for them

Re: Torn

[SuperDre]

what liberty? you cannot post/say anything if it hurts other people (real liberty would allow that).

And how will you protect 'liberty' if there is no way to be able to gather information.. What's the use of liberty if you have to worry about being blown to bits by some lunatic/morons..
People bitch at the goverment after an attack for not having tried to prevent it, but people bitch if the goverment tries to gather information..

It's not an easy subject, society is getting more and more complex and massive each day..
REAL liberty does not belong in a society as real liberty just turns into chaos..

For me, yes privacy is important, if I loose my phone I don't want john doe who finds it not being able to simply retrieve my information, but I don't mind if law enforcement with a court order being able to get to the data on the phone..

Re: Torn

[spire3661]

Some ideas are timeless...... The government is demanding a society where its impossible to store anything private in a fixed form. Do you really want a world where the only privacy you have is in your own head? Do you think society has a right to read my diary? Do you think i have the right to try and stop you from reading it through technological measures?

Re: Torn

[Anonymous Coward]

I am not sure their motives are entirely innocent. I think Apple is more concerned about the negative impact on its business, especially in foreign markets if it is perceived that it is willing to bend over to every request from the US government. The fortunate positive is the consumer wins, but don't mistake that for Apple "wanting" to do the right thing.

Re:Torn

[spire3661]

I'll just add Wired to my router's block list. I love it, these sites make it so easy for me to say, 'well im never going there again'.

Re:Torn

[BasilBrush]

3 score years and ten? When people die before that people tend to think they died too young. Over that, and the phrase "died of old age" starts to kick in.

Not of course that I think people should hang up their boots at 70. But rather that they should start think of those years, if they get them, as a bonus.

Re: Torn

[Anonymous Coward]

The government has the right to search and seize but there is no inherent right to understand what it has searched and seized.

Re:Torn

[stealth_finger]

I want security, but if access to the data on the phone could potentially save lives, that seems pretty important too.

How about by decryption you could potentially cost lives. How does that balance?

Re:Torn

[PopeRatzo]

One would think that his involvement with the US Declaration of Independence, the revolution, etc., would certainly be evidence that he felt his safety and liberty were threatened.

He just didn't want to pay his taxes. Don't forget the he spent a significant portion of the period in France, partying with the elite.

Re:Torn

[PopeRatzo]

Franklin was severely shocked, while electrocuting a turkey

OMG! What a brave, brave man he must have been. That turkey must certainly have been threatening his safety and liberty.

The Founding Fathers were mainly wine snobs who didn't want to pay their taxes. If you think Ben Franklin's safety and liberty were threatened, you may be mistaking the plot-line of Assassin's Creed Rogue for real life.

Re:Torn

[sribe]

f the lack of security--due to government mandated back doors--allows for state sponsored persecution of innocents, enemy state or NGO attacks, etc. where would you stand then? You do grasp the concept that a security vulnerability may be exploited by any actor, at any time, not solely the "right and just" United States government after receiving a lawfully obtained court warrant?

Exactly, it's really not an exaggeration to say that if the FBI gets their way, when the "just for this phone" (a bald-faced lie anyway) software eventually leaks, dissidents in totalitarian countries will be MURDERED because of it.

Re:Torn

[Impy the Impiuos Imp]

I want security, but if access to the data on the phone could potentially save lives, that seems pretty important too.

It will cost many more lives whit loss of eternal freedom. Already the same arguments are used in thugocracies like Russia and China so they can spy on dissidents..

No, we should not force a security camera into everyone's modern living room, their phone. If you do not build the tools of tyrrany, they cannot be misused...everywhere...today.

Re:Torn

[jittles]

The problem is it's not just this phone. It's the 12 others they have on stand by, it's the 175 NY has lined up and ready to go -- for starters.

As long as they have proper warrants, I don't see what it matters if there is only 1 phone, or 10000.

Because there is no precedent or legal reason to force Apple to provide the FBI with evidence they already have. If the Federal government, or any government agency does not have the ways and means to turn that evidence into something useful, how is it Apple's problem? They already have all the NSA collected meta data on every communication these two made. So what value does the phone even provide? The government keeps reaching further and further. By forcing Apple to make new firmware, they are also violating Apple's first amendment rights. Even if they just force Apple to sign the firmware, they are violating Apple's rights. And to save whom? To prosecute what individual? The perpetrators of this act are dead. Their victims have already been harmed. The government should already know who these people are talking to thanks to illegal data collection policies practiced by the federal government. So why do you have so much sympathy for a government that violates your privacy? So that you've got a 1 in 1.00000000001 billion chance of dying due to terrorism instead of just 1 in 1 billion? Feel free to volunteer all of your privacy, but don't take mine or that of anyone else. You're more likely to win the lottery though, I imagine.

Re:Torn

[Antique Geekmeister]

> Don't forget though, Ben Franklin is someone who never had his liberty or his safety threatened.

The signatories of the Declaration of Independence felt that their liberty, and safety, were indeed threatened by a remote and dangerous monarchy. After signing it, Mr. Franklin most certainly was at risk of capture and execution for treason against the British Empire, much as Mr. Snowden is at risk of prosecution if he returns to US soil.

Re:Torn

[slashping]

So that you've got a 1 in 1.00000000001 billion chance of dying due to terrorism instead of just 1 in 1 billion?

When you can guarantee that number won't increase to 1 in 100 over the next 20 years, you can have your privacy back.

Re:Torn

[jittles]

So that you've got a 1 in 1.00000000001 billion chance of dying due to terrorism instead of just 1 in 1 billion?

When you can guarantee that number won't increase to 1 in 100 over the next 20 years, you can have your privacy back.

When you can guarantee that number will increase to 1 in 100 over the next 20 years, you can have my privacy. That's the most asinine argument I've ever heard.

Re: Torn

[Anonymous Coward]

You're a buffoon for not understanding you're basically human rights. The ones our forefathers sought to protect regardless of the technology in place. Again I write. What if these thoughts, orders what have you , had been written on paper handed off in person or through other secret channels then destroyed after committing to memory. Then the government would have even less than they have now. Putting a backdoor in encryption is by far one of the most dangerous ideas ever put forth in all of human history and quite possibly for all of the future. Once the backdoor is there breaking in can become somewhat trivial for those with the means. China Russia crime syndicates who would all be using encryption without backdoors could easily hack into anyone else they wanted take what they want or extort people, corporations and governments over the information

Re: Torn

[Anonymous Coward]

Again if you are alive and they have a warrant to search the phone yes you have to give them access or face the consequences. However, because the government hasn't been focusing on brute force vs more peaceful solutions which is nonlethal weapons the government literally killed that way in. They have no right for a backdoor into the encryption. They don't have a key or combination to a safe so they need to cut it. Thus they need to break the encryption. If they had currently non existent high quality nonlethal weapons then they could have incapacitated the killers and compelled them to release the access code. Something that doesn't exist just like the backdoor that isn't there

Re: Torn

[davidshewitt]

Of course they're doing it for business reasons. The opposition of tech companies to government spying is one of the few situations where corporate interests align (coincidentally) with those of the people. The fact that corporations play a large part in US politics gives a tiny bit of hope that something will be done.

Re:Torn

[slashping]

ISIS is sending thousands of fighters into the West, mixed in with the rapefugees. The risk is very real, and people are working hard to make the risk bigger, unlike for instance, the chance of being eaten by a shark, or being killed in traffic.

Re:Torn

[TheCarp]

It does, but its a silly thing to worry about. Remember the "could potentially" means, you don't even know that it would. The entire scenario is based on hypothetical lives that could be saved, in a fantastical scenario.

The real issue is what happens when these things are easy to break. The ability to access data is often abused, its well documented how often and how many people will abuse access they are given, even for mundane reasons. Do you have any idea how many people with access to medical records try looking up their neighbors? Its staggering.

So you have the real risks of bad security, and the imagined risk. The real risks include the obverse scenario. For every "terrorist" whose phone might betray accomplices, there are 10s or 100s of political dissidents whose lives would be endangered by the same.

Re:Torn

[Mad Bad Rabbit]

Because your phone can't tell whether the person cracking the passcode is an FBI agent with a warrant, or a common thief.
If there are special keys to let other people break into your phone, it can't tell whether they're supposed to have them or not.
Your phone isn't secure unless there's no such special key.

This isn't rocket science: If anyone else can unlock your phone, anyone else can unlock your phone.

Re:Torn

[slashping]

Simple solution: FBI agent hands phone to Apple and shows warrant. Apple installs special firmware on this phone. Apple returns phone to FBI agent.

Re: Torn

[echnaton192]

iPhones are only secure within themselves. If I send you a text, that's open and easily interceptable.

1. Sending a message from one iPhone to another: Not interceptable.
2. Sending a message or calling via Signal from Open Whisper Systems: Not interceptable
3. Using an encrypted carddav- and caldav-provider: Data not accessible as it is encrypted with my long and complex password
4. Using firefox to synch browserdata: Not accessible as it is encrypted end-to-end

So what do you mean by "only secure within themselves"?

Re:Torn

[Mad Bad Rabbit]

Apple counsel gets called into court, ordered to make special firmware that can be installed on anyone's phone by FBI agents, without Apple supervision.
Existence of this firmware is not to be revealed to public. Existence of this court order is not to be revealed to public.

FBI uses this to quietly solve some difficult cases, much high-fiving.

Then FBI agent unknowingly allows a copy to be stolen by his mistress, who sells it to her drug dealer.
Another gives a copy to his buddy, a former agent turned private-eye.
Another (double-agent) gives a copy to his Russian handler.

Within two months, most foreign intelligence agencies have copies
Within a year, ISIS, Mafia, Yakuza, Mexican drug lords, and an unknown number of random hackers have copies.
 

Re:Torn

[nospam007]

"I want security, but if access to the data on the phone could potentially save lives, that seems pretty important too."

That's what the torturers always say.

Re: Torn

[Anonymous Coward]

temporary security.
the phrase is temporary security.

that phrase, taken to its logical end, promotes anarchy.
you've already traded liberty for security by living in a society consisting of more than 1 person.

Re: Torn

[reboot246]

Yes, the rights preexist and the government can't take away what they didn't grant. The United States Constitution does this the right way, something NO other constitution does. The men who founded the country recognized the evil of government and how it can easily get out of control. All attempts to copy it have failed miserably if preexisting rights are left out. You have to protect basic preexisting human rights at all costs, even if it is detrimental to the state. That's what worries me when people are in favor of "collective" types of government, where the state's survival and rights (not individuals') are paramount.

If the government can't get into this particular iphone, something bad MAY happen. If it can get into it, something worse WILL have happened.

Re:Torn

[laurencetux]

okay then try this create a document with all of your passwords/logins seal it in a Tyvek bag and mail it to your local police station with instructions to only open the bag if you are arrested.

the big problem is if we allow some sort of Master BackDoor that in effect has a sign on it that says LEO ACCESS ONLY then within 30 days the Entire "Dark Web" will also have access to the MBD.

can you think of the "fun" somebody can have with full ROOT access to your phone??

Im sure your subscription to "Exotic Lolis Gone Wylde" will be very intertesting when you get arrested.

Re: Torn

[Anonymous Coward]

Much of the beauty of the Constitution is how well engineered it is, and how much of its framework still works and applies today, including the 4th and 5th.

I assume you're talking about the Bill of Rights (which wasn't used at all for the first century or so), not the Articles of the US Constitution, and in which case, that 3rd Amendment gets a lot of use, eh? I mean, people talk about how the 1st and 2nd are so important because they are put in the beginning... the 3rd must get a lot more use than the 4th or 5th, eh?

The Constitution of the United States of America was ratified in 1783 to replace the Articles of Confederacy. Several delegates refused to ratify the Constitution without an explicit list of rights which the state (meaning government whether federal or local) could infringe. This list is known as the Bill of Rights, and consists of the first ten amendments of the US Constitution. The period between 1776 and 1783 doesn't equate to "the first century or so".

Re:Torn

[PopeRatzo]

The signatories of the Declaration of Independence felt that their liberty, and safety, were indeed threatened by a remote and dangerous monarchy.

They were wine snobs who didn't feel like paying taxes.

After signing it, Mr. Franklin most certainly was at risk of capture and execution for treason against the British Empire,

And yet he traveled freely through Europe, partying at Versailles and making a spectacle of himself. And making spectacles.

Re:Torn

[Bob the Super Hamste]

A 9/11 or Pearl Harbor like even seems to be a once in a lifetime event so I really wouldn't worry about that probability changing, and if it does change to be 1 in 100 then a lot has gone wrong to get us there. I'm more worried about the things that would get us there and the erosion of rights and the expanded search and seizure powers of government seem to be a way to oppress people who just might snap and turn our country into something that resembles Iraq or Syria. It isn't like Detroit or Baltimore are that far from that now.

Re:Torn

[macs4all]

I want security, but if access to the data on the phone could potentially save lives, that seems pretty important too.

ANYTHING can be conjectured to POTENTIALLY do ANYTHING. That's the very definition of a strawman argument.

Re: Torn

[Anonymous Coward]

This is not entirely true. iMessages are also encrypted in flight. Apple cannot read them (although if you back up to iCloud, apparently that is a vector for attack).

Re: Torn

[OutOnARock]

From the mouth of Tim Cook himself, can't say it any better:
“The key is for all of the key people to come together and really think through these issues,” Cook said. “Not just look at one — look at all of them and recognize that at the core of this are some of the founding principles of our country, which we should take a huge pause to trample on.”

Re:Torn

[ilsaloving]

And don't forget that lawyer (can't find the link ATM), that publicly declared that he's just waiting for the precedent to be set, so he can demand another 180+ iphones can be unlocked.

And that's just one lawyer. Who knows how many others would also jump at this like a starving piranha.

Re:Torn

[chihowa]

You're conflating two very different issues here: what people want to share with (some) others and what people want to keep private. Even if some, but not all, people put a bunch of stuff online that you wouldn't put online, it doesn't mean that they should lose the right to keep other stuff private. We need to educate people about the impacts of divulging information about themselves to strangers and keep the ability to keep private information private.

Backdoors in devices aren't intended to get at information that people publicly post, but to let those prying eyes get at information that people don't publicly post.

Re: Torn

[Ravaldy]

It states that these rights preexist, AND EXPLICITLY STATES THE GOVERNMENT HAS NO POWER TO INFRINGE UPON THEM.

What the constitution doesn't handle is that the preservation of ones right can result in the misery of millions.

The problem with the current state of affairs is that we don't truly know how much good truly comes from privacy of data (specifically with the state) because we've been without it for so long. Will this enable ill intentioned corporations, governments, people to do more without fear of being watched? Has this level of transparency been a deterrent? Or is it the opposite?

Re: Torn

[sl149q]

The current court order is that the FBI wants Apple to produce a customized version of IOS signed for installation on a single iPhone. Done in this case in open court to sway public opinion. And presumably with some custom installation method because they can't auto-update without the password.

But remember that most of these requests are done under seal with Apple not being allowed to talk about it publicly. So once this precedent is set, the next step is a court order to do similar or other customizations to IOS for a specific customer's phone and then simply put that into the normal IOS update system so that the next time that phone is updated (e.g. when the customer sees that a new update is generally available) the customized version of IOS is installed.

I'll leave to the imagination the types of customizations that the FBI or the NSA (or any totalitarian government e.g. China, Iran, etc.) might think to ask for.

This really is the the camel getting it's nose into the tent. Once it is there we won't be able to get it out. And at that point there will simply be no way to trust our phones are doing what we think they are doing. They will be doing whatever the government wants them to do.

Re:Torn

[Ravaldy]

If the lack of security--due to government mandated back doors--allows for state sponsored persecution of innocents, enemy state or NGO attacks

At the end of the day we need to pick the road that is most beneficial for society as a whole and I'm willing to believe for the moment that "evildoers" benefit far more from said backdoors than legitimate entities.

Re:Torn

[Dcnjoe60]

My point was that given the history of security in the information age, one should not assume that anything you store on a connected device is save. Regardless of the government gaining access, devices lack enough security for identity theft to be rampant.

Most people would not leave their valuables on the front seat of a locked vehicle because it is easy to gain access. The same is true for our phones and tablets. While that doesn't give somebody the right to your data, there is enough evidence to show that it is not adequately protected, backdoor or not. Therefore, if one is truly concerned with security and privacy, one does not store data on such devices.

It matters not whether people want to share it or not, one should assume that anything stored on these devices is not private.

Re: Torn

[Anonymous Coward]

Anonymous Cowards keep posting this in every thread about the Apple v FBI case, and never actually cite any particular case of it happening.

Curious, no?

Re: Torn

[MachineShedFred]

Because there is this concept of a "legal precedent."

You're a certified fucking moron if you think that this case only applies to Apple, or people with Apple devices.

Re:Torn

[david_thornley]

This warrant is for one phone only. Apple is resisting it by claiming that the government doesn't have the power to compel them to construct a tool to break it, particularly when it's against Apple's interests. That can be settled in the courts.

However, it's settled case law that the All Writs law can be used to make a company use a tool they've already got. In other words, if Apple caves on this one, it's very clear that they have no ground not to do it with any iPhone with a court order. Apple considers this not in the best interest of their customers.

So, this is not just about one phone. It's about all phones as long as Apple has the technical ability to break into them.

Re:Torn

[david_thornley]

Don't forget the war unicorns. Never forget the war unicorns. There's about as much evidence for the "thousands of fighters" and the war unicorns.

This is not a fundamentally new situation. There have been religious fanatics as long as we've had religion. ISIS is not something new. Neither is Islam.

Re:Torn

[Khyber]

I have copies of Franklin's writings. You know absolutely NOTHING.

Re: Torn

[ed1park]

And if that something were encrypted, the world would have never known of her.

Re: Torn

[cthulhu11]

There is roughly zero reason to believe the phone in question would save anyone. It's about precedent. The government has chosen this phone to set one, as the perp is prominent. Think about it, why would the perp pay for a personal phone only to put something incriminating on a work phone??

Re: Torn

[Anonymous Coward]

When the phrase "three score years and then" was invented, life expectancy at birth was half of that. So by your logic you're not into your bonus until you hit 160 or so...

How conveeeenient for Apple: I have to upgrade!

[Anonymous Coward]

So basically Apple is telling me that unless I upgrade to the next iPhone, they might sell out my data to the cops, NSA or ???. That's great.

Re:How conveeeenient for Apple: I have to upgrade!

[adamstew]

Maybe. With the security hardware that exists in the iPhone 5S and later devices, it's possible a software update to them could simply fix it.

Is this treason?

[mysidia]

"Treason against the United States shall consist only in levying war against them, or in adhering to their enemies, giving them aid and comfort. "

Developing a measure with the explicit intended goal to deny the US Government Legal access to any random State enemy's communications device by demanding brute-force decryption software through lawful order by making an alteration solely intended to render that as impossible could be argued as an act with the sole intention of "giving aid and comfort".

Re:Is this treason?

[Feral Nerd]

"Treason against the United States shall consist only in levying war against them, or in adhering to their enemies, giving them aid and comfort. "

Developing a measure with the explicit intended goal to deny the US Government Legal access to any random State enemy's communications device by demanding brute-force decryption software through lawful order by making an alteration solely intended to render that as impossible could be argued as an act with the sole intention of "giving aid and comfort".

It could also be argued to be an act intended to keep the noses of the FIB, CIA, NSA, et al out of places where they don't belong i.e. the private data of every Apple iPhone/iPad/Mac using person on the planet.

Re:Is this treason?

[Jahoda]

Oh, well bless your heart! Let me go ahead and guarantee you that the federal government will not be prosecuting Apple, Inc. for treason any time in the near future. LOL.

Re:Is this treason?

[Nethemas the Great]

I guess I had better remove the deadbolt from my front door and the owners of MasterLock best prepare for the death penalty.

Re:Is this treason?

[zenlessyank]

Except that it ISN'T the SOLE intention. The sole intention is to give US citizens a secure method of communication. Just like the interstate's sole intention is to let US citizens travel safely across the country. Just because an enemy or terrorist or undesirable can use these too doesn't make it less stupid. Interstates and secure phones aren't treasonous since they can't have intentions since they have no souls.

Re:Is this treason?

[Anonymous Coward]

Only if you're willing to accept deciding to not personally join or donate to the military is giving aid and comfort to the enemy as they're grateful to you that there's one less person to fight and that our military has less money to use against them. I suggest we execute mysidia for treason as well as every grocery store owner who sold food to anyone who later went postal.

Re:Is this treason?

[R3d M3rcury]

Obviously. That's t-reason they're doing it.

Thank you. I'm here all week. Try the veal.

Re:Is this treason?

[93 Escort Wagon]

Developing a measure with the explicit intended goal to deny the US Government Legal access to any random State enemy's communications device by demanding brute-force decryption software through lawful order by making an alteration solely intended to render that as impossible could be argued as an act with the sole intention of "giving aid and comfort".

You can't give aid and comfort to a dead man - so that's irrelevant in the current case.

On the other hand - if a phone's owner is alive, and if the US Government has enough evidence to obtain a lawful order requiring that person to grant them access to the phone, then if the owner refuses he can be jailed until such time as he decides to comply. I doubt he's going to be launching any attacks from jail.

Re:Is this treason?

[Joe_Dragon]

Well what about them losing the right to sell stuff in some places (may not usa) or may even hard time in guilty til proven innocent places.

Re:Is this treason?

[mspring]

This should then also apply to, let's say, manufacturers of cars used by enemies, right? After all, cars usually do give "aid and comfort".

Re:Is this treason?

[Darinbob]

So you're saying that if someone from North Korea bought a sweet and delicious cupcake from me, I would be guilty of treason?

Re:Is this treason?

[suutar]

Clothing. Particularly warm or loose clothing. And macaroni and cheese. That's even known as "comfort food"!

Re:Is this treason?

[skids]

People can talk secretly. Over large distances. The sooner the government comes to grip with this simple fact, the better.

Re:Is this treason?

[Wrath0fb0b]

It could also be argued to be an act intended to keep the noses of the FIB, CIA, NSA, et al out of places where they don't belong i.e. the private data of every Apple iPhone/iPad/Mac using person on the planet.

I think the idea (not that I agree, I certainly don't on the full picture, but let's at least be fair!) is that an independent judge decides in a court of law whether or not the FBI belongs in a particular phone or not, and that it makes that decision on the basis of the individualized facts around that phone. And that the decision of the court authorizes only the search of that specific phone.

The first step in an honest argument is arguing against the best possible version of your opponent's position, not against a caricature.

Re: Is this treason?

[Anonymous Coward]

hahaha treason

Aiding the enemy. Like shipping them weapons ? Training them so they can perform a regeime change for you ? Looking the other way when they do evil shit because they're a source for oil ?

Locking down a phone so an obviously corrupt government isn't treason. It isn't the same game. Not even the same fucking universe :|

Re:Is this treason?

[Anonymous Coward]

"Treason against the United States shall consist only in levying war against them, or in adhering to their enemies, giving them aid and comfort. "

Developing a measure with the explicit intended goal to deny the US Government Legal access to any random State enemy's communications device by demanding brute-force decryption software through lawful order by making an alteration solely intended to render that as impossible could be argued as an act with the sole intention of "giving aid and comfort".

By your own logic, the amount of time US armed forces have been the cause of "friendly fire" incidents ensures that the US armed forces should all be held accountable for giving aid to the enemy.

Re:Is this treason?

[KGIII]

That's fine. The FBI should be granted all lawful orders to the phone in question - and to all the other phones. They have that already. What they don't have is the ability to force Apple to develop a mechanism to render that device useful. I'm okay with that. That's the way it should be. I've got nothing wrong with the FBI having access to the device. They can do their very best to retrieve the information in a lawful manner. This, this order, is not lawful in my opinion.

And yes, yes I think I'm qualified to hold an opinion. That this is not about physical access is a difference with distinction. They are free to do quite a bit with the device. Well, they're free to do anything with the device they want - just not if they want to use it as evidence. They can try to break in it any way they want. They can even hire people to do it. They can even ask Apple to do it. What they can't do is *force* Apple to do it. Apple can comply if they want but that sets a bad precedent. It's best to not allow it and I feel Apple made the right choice to fight this.

Yes, it sucks that good people might get hurt. That's a price way pay to have some liberties. I'm just as at-risk as you are. Don't let your fear take away my liberty, thanks. Don't worry, I'll respect that same position when it comes time for a liberty you're concerned with losing. And trust me, that time will come.

Re:Is this treason?

[KGIII]

Actually, the Interstate Highway System is built for the sole reason of allowing rapid troop and equipment deployments. That you can use it as a citizen is just a side benefit. If you don't believe me, try to interrupt a convoy on a Federal Highway. Then check and see what your insurance company says to you. And then check the resulting fines.

Eisenhower had them built after seeing the Autobahn in Germany in WWII and on a video of them in action. He saw the movie and said to his Aide De Camp, "Hot damn we need some of that shit up in here." And it was so. They traveled throughout the land planting highway seeds in all the right places, tended them carefully, and they grew into the highway system you see today.

In other words, no... The Interstate is not for you. That's just a side benefit. If you look at the size of the equipment and then look at the mandatory road widths on Federal highways, you'll notice something. If you want a really specific example, look at the width of things like tanks and the HMMWV and then measure the width of your nearest Federal highway - all the way down to the regular old non-toll roads that are actually Federal highways. They're the ones with the funny looking logo around them. On a properly labeled map you'll see they're named things like US Rt. 2, US Rt. 95, etc.

Re:Is this treason?

[sjames]

The U.S. is defined by the Constitution. If that document is null and void, the government becomes nothing more than the machinations of a warlord.

It could be argued that the FBI and NSA have already BECOME enemies of the state and so helping them is itself giving aid and comfort to the enemy.

It could also be argued that the FBI is committing treason by trying to make it easier for foreign powers to hack Americans' phones.

Re:Is this treason?

[KGIII]

If you did so knowingly, probably, yes... At least according to the law. You're not going to get prosecuted but, theoretically that's treason. It's also not cool to sell it to them. They're hungry and don't have any money, give 'em your damned cupcake. But, under certain circumstances, that may well count as treason. Bare minimum, the State Department's gonna be right pissed when they find out about it.

Re:Is this treason?

[Anonymous Coward]

"Treason against the United States shall consist only in levying war against them, or in adhering to their enemies, giving them aid and comfort. "

About as treasonous as justifying warrantless wiretaps of citizens using "war powers", which could be argued as an act of war against the United States.

Re:Is this treason?

[Anonymous Coward]

"Treason against the United States shall consist only in levying war against them, or in adhering to their enemies, giving them aid and comfort. "

Developing a measure with the explicit intended goal to deny the US Government Legal access to any random State enemy's communications device by demanding brute-force decryption software through lawful order by making an alteration solely intended to render that as impossible could be argued as an act with the sole intention of "giving aid and comfort".

You think you have problems? By your logic the entire hospitality industry are now enemies of the state!

Moron troll!

Re:Is this treason?

[argumentsockpuppet]

They need software signed with Apple's private key loaded onto the phone. Leaving aside the reasons why, consider what they could do instead. They could demand Apple's source code and compiling process and Apple's private key. They could modify and compile the necessary software, sign it with Apple's key and thus access the data on the phone, all only by compelling Apple to provide the information it has.

Would you say that Apple should fight that? Would you say that the court was acting within its legal authority if it did that instead?

Re:Is this treason?

[_KiTA_]

"Treason against the United States shall consist only in levying war against them, or in adhering to their enemies, giving them aid and comfort. "

Developing a measure with the explicit intended goal to deny the US Government Legal access to any random State enemy's communications device by demanding brute-force decryption software through lawful order by making an alteration solely intended to render that as impossible could be argued as an act with the sole intention of "giving aid and comfort".

Oh, I love this game. Let me try!

And by demanding we give up our rights in the name of fighting terror, they're giving aid to our enemies. Ergo, the FBI agents pushing for this are treasonous monsters and we should ignore them.

Re:Is this treason?

[mysidia]

They could demand Apple's source code and compiling process and Apple's private key.

I have argued that this is exactly what they should seek a court to order Apple to do, in order to gain the upper hand in bargaining, because ordering Apple to develop and produce a piece of software for them they don't have is essentially unconstitutional (Involuntary labor, equivalent to unlawful enslavement).

However, Apple is not above the law in regards to producing a copy of materials in their possession relating to a 3rd party as required or desired for law enforcement to conduct an investigation.... if Apple are served with a warrant for the source code and all necessary signing keys and build tools, required by law enforcement in order to conduct an investigation (That involves the FBI building a modified version), they must comply and produce the materials, or else be charged with obstruction of justice.

There's no legal argument against producing source code once ordered, since they will clearly be in possession, and clearly be capable of complying with the order, any failure to promptly submit can result in contempt of court and jailtime for managers.

This would also conveniently excuse Apple from appearing as a willing party to any perceived government overreach.

Re:Is this treason?

[mysidia]

they're giving aid to our enemies. Ergo, the FBI agents pushing for this are treasonous monsters

No.... they don't intend to aid our enemies; they are just incompetent.

And the FBI director is a cabinet position; therefore, agents by definition CANNOT be treasonous, since the president is by fundamental definition the opposite of the enemy, unless agents are going outside the orders coming down from the executive.

The US government cannot be treasonous to itself while adhering to its own directives.

Re: Is this treason?

[Anonymous Coward]

That's not even close to right. The Interstate highway system has always been intended both as an instrumentality of interstate commerce and as an adjunct to civil defense. And as time has passed, the civil function has far far outstripped the military one.

Don't believe me? Look at the enabling and funding legislation for the interstate highway system over the years. It all explicitly points to the commercial function of the system and invokes the Interstate Commerce clause of the constitution as its source of authority, NOT the common defense clause. It is also managed entirely by civilian agencies, NOT the DOD.

Of course everyone around here knows that you are a military knob slobber, so it's no surprise you would put forth such a distorted picture glorifying your daddies in uniform.

Re: Is this treason?

[Anonymous Coward]

You would make a poor poor lawyer.

Re:Is this treason?

[ihtoit]

same reason Roman roads were built and built straight - even over mountains (or in some cases, through them). It was zero to do with civilian infrastructure, everything to do with the rapid movement of soldiers and equipment.

Re:Is this treason?

[Maritz]

Good luck with that interpretation. Do you actually, seriously, think that Apple will be charged with treason for putting encryption in a phone?

Re:Is this treason?

[watermark]

And you trust the government with Apple's signing keys? The government will keep them safe and they won't be leaked?

Re:Is this treason?

[wardrich86]

access to any random State enemy's communications device

You seem to be under the impression that there are more enemies of the state than regular civilians. Why should a small percent have to destroy something actually beneficial to the overall majority of people? Doesn't that basically mean the enemy wins?

Also, US Government has nothing to do with other countries that value privacy and encryption. So really, they can still develop it but not release it in the US if it's that big of a deal.

Re:Is this treason?

[MitchDev]

You want to bring up someone on treason charges? Start with Congress who's stated job since Obama was elected was not to help america and do the citizens bidding, but to ignore their job and block anything he tried to do....

Re:Is this treason?

[MitchDev]

No shit, some people's capacity for being pathetic sheep is disgusting...

Re: Is this treason?

[MitchDev]

But you are a fine sheep

Re:Is this treason?

[MitchDev]

It's gotten to the point where the nutjobs in the hills with their guns caches chanting about the evils of the gubbermint are more reasonable, intelligent sounding, and more realistic than the government-supporters....

Re:Is this treason?

[watermark]

You'd probably sway more people in your argument if you argued the issues instead of attacking the individual. When you attack the individual, it makes the argument personal, which makes them less likely to see things from your point of view.

Re:Is this treason?

[Anonymous Coward]

Bad precedent. That means someone making an encryption utility as part of their software is now giving aid and comfort to the enemy by not allowing a backdoor to be present.

Plus, good luck prosecuting treason in general. YouTube and Twitter both gain revenue from Daesh's videos, and no company publishing their work have even been told that they are "giving aid and comfort" even by actively distributing an enemy's IP.

Re:Is this treason?

[shaitand]

Actually Treason is most easily committed by government. Anyone in government intentionally acting beyond the restricted powers we've allowed them via the Constitution or a supreme court justice ruling in a manner inconsistent with Constitution both in letter and spirit.

The right to invade privacy is not granted in the Constitution, nor are "lawful orders" being made here therefore those attempting to get Apple to unlock the phone are committing treason and Apple would be complicit to Treason if they complied.

Re:Is this treason?

[shaitand]

"I think the idea (not that I agree, I certainly don't on the full picture, but let's at least be fair!) is that an independent judge decides in a court of law whether or not the FBI belongs in a particular phone or not, and that it makes that decision on the basis of the individualized facts around that phone. And that the decision of the court authorizes only the search of that specific phone."

I'm afraid I do agree. Furthermore, not all things are possible in this world. An independent judge could grant the FBI a warrant to search the backpack of an astronaut on space station but that doesn't mean they'll be able to get up there to execute it. The supreme court has ruled that the people did not grant the government the authority to invade our privacy. We have no obligation to engineer our world to be transparent to government or law enforcement, further we've reserved the right to engineer it to be opaque. To engineer transparency would be to eliminate our ability to speak and act contrary to illegal laws and acts by government which intrude upon the authority that we, The People, who are the leaders of the United States have reserved for ourselves... which these days is the vast majority of laws.

I beg you, do not aid the federal government in it's illegal and unjust civil war against The People. The FBI, NSA, CIA, and DHS ARE the terrorists.

Re:Is this treason?

[shaitand]

"What they don't have is the ability to force Apple to develop a mechanism to render that device useful. I'm okay with that. That's the way it should be."

"This, this order, is not lawful in my opinion."

Here here.

"Well, they're free to do anything with the device they want - just not if they want to use it as evidence."

That is what has been ruled illegally but we didn't actually grant them the authority to do whatever they want with our property in time of peace. Since we are acting outside a constitutional congressional declaration of war this is in fact a time of peace.

Re:Is this treason?

[shaitand]

"However, Apple is not above the law in regards to producing a copy of materials in their possession relating to a 3rd party as required or desired for law enforcement to conduct an investigation"

A lawful warrant is the key requirement there and parties are not required to produce anything in response to a lawful warrant, a lawful warrant only authorizes law enforcement to look for what they want. There is no requirement that one help. Judges abusing contempt of court authority should not be confused with the creation of law entitling courts to anything it wants nor should judges be allowed to subject you to a contempt of court penalty without due process (your right to have a jury of peers nullify the attempt to imprison you). The courts do not out rank the people.

Re:Is this treason?

[Anonymous Coward]

Seen the YouTube videos about Master Lock product security? I don't think any government has much to worry about. Now, Abus, Abloy, or Sobo... different story.

Re:Is this treason?

[KGIII]

I'm not sure? I'm pretty sure they can do anything with it they want - the owners are still very much alive and have granted unfettered access to the device. They could, if they wanted, smash it with a hammer, set it on fire, or hire someone to look at it all with an electron microscope and try to reverse engineer it. They can JTAG, scope, and move the hardware as desired.

At least I'm pretty sure of that? I am not a lawyer so I am not going to claim that I'm certain but I'm pretty damned certain that they're entitled to do anything they want with that specific device. I'm not sure what all will be admissible in court, be eligible for supporting evidence to be granted additional warrants, or things like that. But, I'm pretty sure they can do anything with the device they want - up to and including blowing it up with C4 out on the demo field at Quantico.

Re:Is this treason?

[mysidia]

Anyone in government intentionally acting beyond the restricted powers we've allowed them via the Constitution or a supreme court justice ruling in a manner inconsistent with Constitution both in letter and spirit.

I would love to see officials being charged with treason for such acts.

But I think the courts (And the public) will never agree that an elected official commits treason, by doing things inconsistent with the Constitution.

Re:Is this treason?

[david_thornley]

There's limits as to what the courts can ask from uninvolved third parties, particularly when it's to their detriment.

Re:Is this treason?

[david_thornley]

Fun fact: shortly before WWII, Eisenhower was put in charge of an Army road convoy to investigate the feasibility of cross-country movement by road, and it did not go smoothly. I think this had something to do with his establishment of the Interstate system.

Re:Is this treason?

[david_thornley]

That's unclear. The limited case law on US courts requiring passwords suggests that the government needs to already know what's on the device, and can't go on a fishing expedition.

Re:Is this treason?

[david_thornley]

That Constitutional clause doesn't say anything about intent or motive, so, at least in the strict sense, being an idiot and mistakenly giving aid and comfort to our enemies is treason.

I think you'll find that agents of the US government can indeed be convicted of treason. It doesn't say that anyone gets a free pass. Were we at open war with Latveria, and the President delivered munitions to them, that would be treason.

Re:Is this treason?

[KGIII]

Yup. In Rome's case, the roads were built by the Legion. It's amusing, sad really, that they're "insightful" for the post. No... No, that's not right. That we benefit is a good thing but it sure as hell is not a priority. The FHS/NHS (Federal Highway System/National Highway System) was quite specifically created for military use. The reason that they spend so much money on them (and they do spend a ton of money) is because of the military value.

Yes, there are side benefits and they're considered. However, if we didn't need to move military equipment then they'd be paying a lot less. I can also speak first-hand to the results of interfering with a military convoy on the FHS. It will end badly for you. Do not do this. We have rovers with flashing lights, we have signs mounted on the lead and rear vehicles. When we say "DO NOT INTERFERE WITH CONVOY" or "CONVOY DOES NOT STOP" we mean it. If you put your little red Honda in the way, slow down, and take a picture - we will not slow down. We will, maybe, slow a little so that we can push your vehicle off the edge of the road, watch it flip on its side, and laugh hysterically while we drive by.

And the resulting phone calls will be funny. The paperwork is a bit much, so it appears - I was behind them and driving a different vehicle. We are told, "Do not stop unless you're given orders to do. If someone pulls in front of you, hit them. You will not stop." We don't stop. We were, by then, on a limited access highway. On the regular routes, we've got spotters and rovers. We pull up, stop access and feeder routes, and stop traffic until we've gone through. You will not interrupt the convoy. Even on closed access, we drive where we want. We pull off, up, and on. We drive backwards down the on-ramp and stop traffic. We've got like 50 extra vehicles out there. We occupy one lane plus the rover's in the second lane. We stay to the right. Do not interfere with convoy!

I can definitely state, with some authority, that this is NOT correct:

Just like the interstate's sole intention is to let US citizens travel safely across the country.

There is no way that's right. In fact, that's so far wrong that it's as opposite to of correct as it can possibly be. A more accurate statement would be that the highway's sole intention is purple. It would make more sense.

As an aside, I'm kind of partial to highways... The reason that none of the original Roman roads have curves and only have right angles is because they lacked the math to make the roads curve. So, Rome's original roads are all straight and have right angles. I forget the name of the documentary but it goes into that as well as how the roads were made. They go out and actually do some experimental archeology, use the correct tools, and even speak in Latin (as I recall - not sure if I'm conflating it with others).

At any rate, it's laughable to think the interstate highways are made for letting US citizens travel safely across the country. No, we've got plans to shut 'em all down if there's a crisis. The civilian use is secondary. As I'm sure you know, see the width of the lanes and the size of an HMMWV or even an Abram and all will become clear.

Re:Is this treason?

[KGIII]

Thanks! I'd heard that one not too too long ago. There's an excellent documentary on Eisenhower. I forget the name but I happened to bump into it not that long ago. It was since I was on the road, so since last September. I want to say it was before I got here in Florida. It's hard telling. I think I watched it at a site other than YouTube so I can't just go through my history and find it. It turns out that he and his wife were rather popular long before he had any power/rank.

I'm not sure if I'm conflating him with someone else? I think, if I remember correctly, he also had access to a great general and that general's library. They had some sort of falling out and he was fired while he was away on leave, or pretty much like that. He returned to the base and his role as an aide had been filled by someone else. I'm thinking it was Eisenhower but, as I've explained, these are entertainment pursuits and not scholarly in nature. If the goal was learning, I'd not necessarily enjoy it as much. Learning (and remembering) is incidental. ;-)

Re: Is this treason?

[Anonymous Coward]

Even *prior* to Eisenhower...

Wilson was an ardent advocate of good roads and made them a party platform in 1916: "The happiness, comfort and prosperity of rural life, and the development of the city, are alike conserved by the construction of public highways. We, therefore, favor national aid in the construction of post roads and roads for military purposes".

For more information:
https://en.wikipedia.org/wiki/...

For a better citation:
https://en.wikipedia.org/wiki/...

Note the first link in the planning. Then, calmly, sit down and be quiet. The adults are speaking.

Posted as an AC 'cause you're not worth tracking the reply. Wow, we really need to consider a test for letting people post here. I don't mind being wrong, I'm okay with that. At the same time, it's annoying to have to correct people who try to correct me. You're wrong metrix007, you'll be wrong tomorrow, and you've always been wrong. There's the fucking citations to prove it now stop wasting my time.

Re:Is this treason?

[ihtoit]

width of UK highway lane: 3.65m
width of Challenger main battle tank: 3.5m

width of US highway lane: 3.7m
width of Abrams main battle tank: 3.66m

Coincidence? Methink not.

Re:Is this treason?

[mysidia]

That Constitutional clause doesn't say anything about intent or motive

No.... Criminal liability does not attach to a person who merely acted with the absence of mental fault. hTe concept of a strict liability crime is a fairly modern one and doesn't apply to Treason or other crimes mentioned in the constitution, unless there has been a new law to set different standards; didn't come about until the 1800s, when the idea of strict liability became necessary to hold employers accountable for worker safety standards in industry; before then, business management could fail to abide by the law (And they did), without having any (provable) criminal intent: making them impervious to prosecution.

So only a very small number of crimes are prosecutable without showing criminal intent. Even if the law itself doesn't mention intent.

Re:Is this treason?

[KGIII]

^^ THIS ^^

It's tough but I've managed to actually get people to alter their views in meaningful ways. It takes two to do that, they have to be receptive to changing their views and have to be able to do it without their ego being in the way. You're not going to do that if there's an attack on the person.

I like this example...

You probably don't know about it - but I've been telling people about it for about 15 years now. You can actually read some of the Windows source code. It's called the Shared Source Initiative. We, a bunch of Microsoft MVPs, were the ones that got that started. We are the ones who showed that it was important and needed. We were the ones who got MS going on their open source.

It wasn't the spittle flecked zealots. It wasn't the people who were vulgar. It wasn't the idealist. It was the pragmatic, it was the calm, it was the polite, and it was the communicative with clarity. It wasn't RMS. It wasn't Slashdot. It was the MVPs, the "Most Valuable Professional" award winners who were given true insider access (nothing like the Insider Access program of today). By the way, I participated for about a half dozen years. I mis-typed earlier, in another post, and said a dozen years. It was half that. I've not actually taken part since 2006 or 2007 so I can't speak about today's program.

When you're specked with spittle, smell bad, and ranting - nobody listens, no matter how correct you might be. Like it or not, how you carry yourself and how you portray yourself is significant. It is not the message that matters but how it is delivered and the sooner people realize it then the sooner those of us who have cooler heads can actually start to have meaningful discourse. It's the zealots who hold back progress more than the those who are opposed to the ideals.

Re:Is this treason?

[KGIII]

;-)

I didn't even cheat and go look at the numbers first. There are also very few stretches of single lane highways in the FHS. That's because convoys need to have a second lane in order to have some flexibility and safety. Yes, it has added benefits where civilian traffic is concerned. However, convoys need to be able to route around a damaged vehicle, be able to move specialty vehicles up and down the line, and things like that. The feds can, and will, come stomp that highway closed if they need to.

Of course, the fecal matter will have needed to hit the fan by then... There are still occasional drills and convoys. By the way, you can fit 3 HMMWVs on a 2 lane federal highway with room for the mirrors. Turned sideways, they will block a complete 2 lane highway and the breakdown lane. Staggered in a line, a full five lengths apart, will create a slalom that a semi can fit through. Three is enough for the M1 Abrams to fit through. One is enough for your average passenger vehicle at five miles per hour. And if folks don't think they'll stop, I'd like to remind them that they carry a .50 cal on them if needed. I believe, I'm not positive, that two M1s at a 45 deg angle blocks the entire 2 lane highway.

And people think that's just coincidence... No, they do... If you expand the sub-thread, you'll see an "enlightened" AC has decided to tell me that I'm wrong. I gave them a citation all the way back to the beginning - in 1916, before Eisenhower. Then I gave 'em a second citation to let them check and see that it was the earliest start of our federal highway system as ordained by the government. *sighs*

You can lead 'em to water, but you can't make 'em drink. At any rate, thanks for pulling the numbers out. If you want to see how close they cut it, check the width of the HMMWV with the door's on both sides open to full extension. They'll fit - and the doors will be able to open, fully, with enough room to walk between them though I think it's a tight squeeze. The lines for parking them on-base are that same width, there are training courses that are that same width, and you will learn to operate them safely and effectively in that same width. Depending on your height, when you look out the passenger side window from the driver's seat and line it up so that the bottom of the door-handle is even with the top of the passenger side bottom window sill, you'll be the exact distance apart. (Or close enough for government work.) Oddly enough, that'd put you "exactly" dead center with your lanes on the highway system if traveling in parallel.

Surely, it's just like you said - coincidental. *snickers*

There's more... There's the reflectivity of the marking paint used at a certain number of lumen. Coincidentally enough, that lowest value would actually have a strong correlation with the lumen used with blackout lights. Coincidentally enough, that reflectivity (different for signage) is also using that same lowest value for the minimal amount.

Yup, like you said, it's surely coincidental. Oh, the USSR is like that too... So aren't the main routes in China. So aren't they in Israel. As you noted, the UK, etc...

You know, you're right! It must be coincidental! *sighs* No, I've no idea why the AC wanted to argue. I do feel like making fun of them. I'm tired and about as mature as a five year old.

Re:Is this treason?

[mysidia]

There's limits as to what the courts can ask from uninvolved third parties

There's an argument that Apple is an involved party, because they supply current software and updates to software for the criminal's device, And Apple is essentially the landlord who rents the device to the customer, Because Apple maintains ownership of the software only allowing use through a EULA, and by doing so they leave the ownership of the copy of the software with Apple (since the user only acquires a "Limited license to use it", so long as the end user abides by the Lease), and also, Apple fails or refuses to deliver even basic source code and device schematics to the user, So it is essentially equipment Owned, Maintained, and Managed by Apple.

Re:Is this treason?

[mysidia]

A lawful warrant is the key requirement there and parties are not required to produce anything

My bad.... They can pursue several routes for example (1) File with a court against Apple and Bring it before a judge to get a court order to deliver the Source code and signing keys., (2) Subpoena the source code and keys, Or (3) A National Security Letter under the Patriot Act to secure delivery of source code and crypto keys,

Re:Is this treason?

[mysidia]

And you trust the government with Apple's signing keys?

Is it relevant whether I trust them?

Courts regularly require businesses to hand over internal secret memos and trade secrets. That's what Source code and Crypto keys are: trade secrets.

They can be secured by a court and placed under protective seal to keep the public out, then the court can use them, or allow the investigators or designated third parties to use the secured secrets to accomplish the desired investigation project.

They are the government. They have the technical police power. They can use the police power to get what is required (If possible to be produced) to investigate crime and enforce the law.

The 4th amendment protects innocent citizens against search and seizures, BUT it does not protect against authorities investigating crimes and securing the means to investigate criminals.

The 4th amendment does not say the police cannot secure the means that COULD IN THEORY BE ABUSED. The constitution secures against actual unlawful searches by making unlawful searches illegal.

Re:Is this treason?

[shaitand]

1 and 2 go back to that abuse of contempt of court powers to violate the Constitution and 3 refers to an illegal act of congress outside their authority and in direct violation of the law that is the only thing granting them any authority in the first place.

People tend to forget that The People are in charge, not the bodies they gave some limited and restricted authority via the Constitution.

Theatre?

[Anonymous Coward]

How much of this is theatre? Is the only improvement is to make it more difficult to download new software while the phone is locked? Which models does this apply to - is it a hardware change that applies only to new models, or is it just an OS change that might also apply to some (or all) older models? From the prior discussions here on slashdot I came away with the impression that there are hardware modules (secure enclave???) on newer model iPhones that would render useless the OS changes requested by the FBI.

Re:Theatre?

[skids]

You know what, I don't actually care if it is theater if it keeps people talking and thinking about security, for a change.

Re:Theatre?

[AHuxley]

"Justice Department Seeks to Force Apple to Extract Data From About 12 Other iPhones" (Feb. 23, 2016)
"Apple embroiled in phone court fights beyond San Bernardino; cases don’t involve terrorism charges, sources say"
http://www.wsj.com/article_ema...

Also the service providers have a lot of details and so do all the other gov linked workers on gov issued platforms.
The end product been requested is a new backdoor operating system. Once the US federal gov gets this, so will Canada, Australia, the UK, NZ. Then third party "friends" of the US gov/mil in the EU, all their staff, contractors and gov workers. The keys to a generation of devices will be requested around the world and govs will use the new OS for any reason they want. So will ex and former staff, contractors who got cleared for the same work but then moved to the "private" sector working for anyone with cash.
Every phone of that generation will need a "Charlie is listening" sticker as any random gov or ex gov worker around the world will have the backdoor keys over time.
Once US smartphones get the court ordered access, so will every other US designed networked device. Spying on citizens will be designed into every US device legally and for anyone else with the cash to access.

Re:Theatre?

[Elfich47]

The change to the phone I can see: While the operating system can be updated, the "Secure Enclave" hardware cannot be bypassed, and the software controlling this function cannot be bypassed unless the user enters the unlock code on the phone. Yes, I realize that there are many hurdles to make that happen.

Re:Theatre?

[KGIII]

Given that this has potential for some damning consequences, do the ends really justify the means in this case?

Its the only way out for them

[Anonymous Coward]

They should unlock the phone if they can, then fix the bug that let's them unlock it.
Also, is systemd still supported mostly by creepy dudes that fondle goats inappropriately?

Re:Its the only way out for them

[Anonymous Coward]

is systemd still supported mostly by creepy dudes that fondle goats inappropriately?

No, those men just stare at goats.. on /.

Ban Apple from the USA!!

[Anonymous Coward]

After a good-bye tax, of course.

Meanwhile in Redmond...

[ModernGeek]

Microsoft is disguising "Tips and Tricks" as a way to sell out your lock screen and is having you store your files on their cloud so that the government, Microsoft, it's "partners", and advertisers have full access to all your data.

Guess I should consider looking at OpenBSD

Re:Meanwhile in Redmond...

[fisted]

Guess I should consider looking at OpenBSD

Yeah, I'm also seriously considering to consider the consideration of potentially maybe looking at OpenBSD, or their Website anyway, if Microsoft does this again more than five times, at least if it wasn't for all the Windows-only programs that I need and have no replacement.

I'm sure MS is shaking, considering my consideration.

FEDGOV says make software.

[Anonymous Coward]

AAPL makes software and hardware in "response". Yea!!

Precedent

[Dorianny]

It would be trivial for Apple to disable all IPSW image installations without a unlock code making what the FBI requested technically impossible, however if the FBI were to prevail in court the Judiciary is likely to take a dim view of Apples actions

Re:Precedent

[Anonymous Coward]

It would be trivial for Apple to disable all IPSW image installations without a unlock code making what the FBI requested technically impossible, however if the FBI were to prevail in court the Judiciary is likely to take a dim view of Apples actions

That's assuming that you are booted in the OS.

All iPhones have a BootRom that is programmed to only accept a next-stage bootloader that is properly signed by Apple. At that stage of the game, the phone does not have access to the passcode in order to perform a verification, nor does it have a GPU driver to display a prompt or a touch-screen sensor to read user input. And this BootROM is available at any time on your phone by holding down a magic button combination.

Protecting the phone in the attack scenario where the DOJ can compel Apple to use their signing key to authorize an arbitrary bootloader (and by extension the rest of the stack, since it's a chain of trust) is non-trivial. It will require cooperation from the ROM to entangle the file encryption keys, the bootloader identity and the user's passcode in a highly non-trivial way. This is doubly so when the update process (when the user consents) needs to be bulletproof.

Re:Precedent

[tricorn]

If the Secure Enclave has non-volatile storage it can access directly, the boot ROM can do this.

Adding additional hardware support (e.g. a write-once write-only key register) could make it easier, but even without that you could require that the passcode be entered in order to mark a new SE firmware image as being usable without wiping all keys.

Re:Precedent

[Anonymous Coward]

If I understand correctly, this is exactly what they are trying to fix.

life was like a box of chocolates

[turkeydance]

you never know who gets hacked.

Obligatory George Carlin

[R3d M3rcury]

If Apple is all-powerful, can they make a phone that they can't hack?

HA HA HA! We got him now!

Nee phone

[Anonymous Coward]

Maybe they're coming out with a phone not marketed towards fags?

OMG

[Anonymous Coward]

Just legalize cocaine for those dirty aristocrats fill their asses and they will forget about the government.

Why does Apple get props for doing the obvious?

[Xylantiel]

Why does apple get headlines for doing what they should have done in the first place? Anything else is a broken, insecure device. If the vendor has a backdoor, it's not secure, whether they allow the government to access it or not.

Re:Why does Apple get props for doing the obvious?

[Anonymous Coward]

Because other phone companies don't?

Re:Why does Apple get props for doing the obvious?

[Anonymous Coward]

Each model has become progressively more secure. No company survives by waiting to release the perfect product. You release what you have and then keep on improving for the next model.

Additionally, nobody has perfect foreknowledge. Look at how many versions of TLS/SSL we've had to deprecate because we later learned of flaws in their design. The cryptographers who developed them thought they were safe at the time.

Re:Why does Apple get props for doing the obvious?

[scdeimos]

You release what you have and then keep on adding features to the next model.

FTFY. In the software world there's almost never improvement in subsequent releases, just new features to keep the marketing people happy.

Re:Why does Apple get props for doing the obvious?

[timholman]

Why does apple get headlines for doing what they should have done in the first place? Anything else is a broken, insecure device. If the vendor has a backdoor, it's not secure, whether they allow the government to access it or not.

Apple's encryption is still very secure. It hasn't been broken, and even Apple won't be able to break it for the FBI. What the FBI wants Apple to do is hack the unlock code for them.

The only "vulnerability" is this case is that Apple potentially has the ability to push new firmware onto this model of iPhone (the 5c) using its own signed certificate, even if the phone is locked. The FBI wants this new firmware to do two things: (1) bypass the "10 wrong tries on the unlock code and the iPhone erases itself" routine and (2) reduce the time interval between unlock code entries. Once this is done, the FBI will brute force input combinations until the iPhone unlocks.

The only problem is that Apple hasn't written this firmware. Even if the firmware existed, you'd need Apple's own certificate to push it onto the iPhone. So the iPhone is still quite secure, relatively speaking, provided the courts don't compel Apple to develop a forensics tool for the FBI at Apple's expense.

Of course, Apple doesn't want this situation to ever, ever happen again. You can bet the iPhone 7 will plug this potential vulnerability by making it impossible for anyone to push firmware onto a locked iPhone, even with Apple's own certificate. At that point, the FBI will no doubt petition Congress to legislate that Apple (and Google, Samsung, LG, etc.) provide a means for altering the firmware of any smartphone sold in the U.S., on court order. And that's when this fight will really get interesting.

Re:Why does Apple get props for doing the obvious?

[wvmarle]

What is more: the current line of products with their "secure enclave" chip and so, are already supposedly unbreakable by Apple themselves. So is this an admission that Apple can actually break into the current iPhone 6 line? Or do I miss something here?

Re:Why does Apple get props for doing the obvious?

[Anonymous Coward]

There are degrees of security/insecurity.
Apple doesn't have a backdoor to the iPhone and has no intention of writing one if it can be helped.

Re:Why does Apple get props for doing the obvious?

[Anonymous Coward]

Why does apple get headlines for doing what they should have done in the first place? Anything else is a broken, insecure device. If the vendor has a backdoor, it's not secure, whether they allow the government to access it or not.

Because they're Apple, with shiny butts? : D

Re:Why does Apple get props for doing the obvious?

[davester666]

Android phones don't have this "problem". The gov't has no trouble getting whatever data they want from them.

Re:Why does Apple get props for doing the obvious?

[Anonymous Coward]

Yeah, all those Nokia engineers turned evil the moment MS embraced them?
No, wait. They got fired.

Re:Why does Apple get props for doing the obvious?

[Anonymous Coward]

"Apple won't be able to break it for the FBI." But they can just push a software update that changes the maximum number of tries to INT_MAX and let an intern try all the possible codes (there aren't that many). In fact, the current story is an admission by Apple that they can do this.

Re:Why does Apple get props for doing the obvious?

[AmiMoJo]

Google's Nexus devices are secure and don't have the same firmware update flaw that iPhones do. In fact all Snapdragon 810 based phones are immune because the 810 does not allow firmware updates to the secure memory, it's a ROM burned into the silicon.

Android has in fact offered full device encryption with the key held in secure storage for years now. Since the Nexus 6 it was enabled by default, and Google has been pushing for other vendors to enable it by default too.

Samsung has been offering it's "Knox" security for phones for many years now too. No idea if that it hackable, but it's not true to say that no-one else has offered full device encryption that was claimed to be unbreakable.

Re:Why does Apple get props for doing the obvious?

[AmiMoJo]

You can bet the iPhone 7 will plug this potential vulnerability by making it impossible for anyone to push firmware onto a locked iPhone

That would be a bad idea. You would want the ability to push firmware via the DFU without unlocking the device, in order to effect repairs (like replacing the fingerprint sensor) without having to unlock the device and give the technician access to your data.

What they need to do is make sure that the firmware for the secure memory built into the ARM CPU can't be updated or modified, and enforces the 10 try and rate limit. The secure memory has its own little processor core that operates independently of the main CPU and should use firmware burned into ROM so it can never be changed. That's been standard practice for years now.

Re:Why does Apple get props for doing the obvious?

[houghi]

Apple's encryption is still very secure. It hasn't been broken, and even Apple won't be able to break it for the FBI. What the FBI wants Apple to do is hack the unlock code for them.

So why are they working on a phone that can not be hacked if they already have one?

Re:Why does Apple get props for doing the obvious?

[drinkypoo]

That would be a bad idea. You would want the ability to push firmware via the DFU without unlocking the device, in order to effect repairs (like replacing the fingerprint sensor) without having to unlock the device and give the technician access to your data.

I don't want the ability to push firmware via the DFU without confirmation. It doesn't matter how locked the device is, you should be able to do that, unless of course the digitizer is hosed. No plan is perfect.

Re:Why does Apple get props for doing the obvious?

[Anonymous Coward]

Google's Nexus devices are secure and don't have the same firmware update flaw that iPhones do. In fact all Snapdragon 810 based phones are immune because the 810 does not allow firmware updates to the secure memory, it's a ROM burned into the silicon.

When Google and/or Samsung publicly stand up and tell the FBI to go fuck themselves, then we can applaud them.

And it's not (entirely) about how 'perfect' the security of certain devices is. It's about intentions: Apple/Cook want people's data to be safe. They're trying to protect people's privacy. Are Google/Samsung trying to make user's data safe? Are they basing their decisions around privacy? Or was it accidental?

Samsung has been offering it's "Knox" security for phones for many years now too. No idea if that it hackable, but it's not true to say that no-one else has offered full device encryption that was claimed to be unbreakable.

Knox is aimed at the government market. If they intended for every user to be secure, it wouldn't be an optional add-on, but baked into every device.

Re:Why does Apple get props for doing the obvious?

[JBMcB]

FTFY. In the software world there's almost never improvement in subsequent releases, just new features to keep the marketing people happy.

That comment is so off the mark, I'm not sure that you actually use software. How did you type this sentence into a web page?

Re:Why does Apple get props for doing the obvious?

[mcrbids]

...at Apple's expense.

FYI It's normal and customary for companies or individuals who are compelled to perform a significant task to be paid for their time and effort. I had an employer once get subpoena'd in a law suit and I was the admin and the compelling party (a private party) had to pay for the administrative cost for me to do a data recovery from a backup.

Re:Why does Apple get props for doing the obvious?

[wiredog]

The Secure Enclave is hackable via the update method. Apple pushes an iOS update that disables the 10 tries to unlock function, and then another update to the Secure Enclave. Neither of those updates requires that the phone be unlocked by the user.

Re:Why does Apple get props for doing the obvious?

[c]

Google's Nexus devices are secure and don't have the same firmware update flaw that iPhones do.

No. But I suspect Google could push a Google services update targeted at a specific phone, and those can do darn near anything. I don't believe Apple is quite as prolific about OTA updates to very powerful core services; unlike Google, they can bundle that stuff into the core O/S without being worried that it won't make it to end users.

On the other hand, the option is there to lock down an Android phone pretty solidly by unlocking it, installing a Google-free ROM, and then encrypting storage.

Re:Why does Apple get props for doing the obvious?

[Anonymous Coward]

You're missing the fact that the phone in question, the San Bernardino shooter's work phone, is locked with a four-digit numeric code. This means that no matter how secure the algorithms on the phone may be, removal of the 10 login attempt limit automatically makes the phone trivially brute-forceable. If the shooter had used a stronger, alpha-numeric, passcode, there wouldn't be an issue here, the Feds could try passcodes till kingdom come and still not get in.

Re:Why does Apple get props for doing the obvious?

[gl4ss]

i find this news bit strange since they already have secure enclave on 5s->

Re:Why does Apple get props for doing the obvious?

[AmiMoJo]

So if you forget the PIN you want the device to be permanently bricked, with no way to recover it even by doing a full wipe and reset?

Not a great plan.

Re:Why does Apple get props for doing the obvious?

[drinkypoo]

So if you forget the PIN you want the device to be permanently bricked

Your imagination is totally Apple user-level. There's no reason why it can't prompt for confirmation without the PIN. That way, at least it can't happen while the phone is in the owner's possession.

Also, it's obvious that there is another middle ground; if a DFU is forced without user permission, then wipe the phone, or at least wipe the crypto key. Let the user use the phone to make phone calls only, until they get back home and unlock it with their stored copy of the key.

Re:Why does Apple get props for doing the obvious?

[AmiMoJo]

You are talking about something other than what the person I replied to was talking about. I agree with you, no firmware updates to a phone that is booted into the OS, but if you go into the DFU the option to execute code from RAM and wipe should be there. That's what the FBI wants to make use of.

Re:Why does Apple get props for doing the obvious?

[Anonymous Coward]

It seems you need to set a special mode where it doesn't require password for firmware update.
That on newer phones deletes your drive encryption key. So while you can replace the firmware, your data is lost.
So it a case of that model phone... newer ones should be immune to that approach..
That is not to say one cant think of other ways to circumvent the defenses, and probably Apple knows a few, and is working on removing them, before it is asked to use them.

Re:Why does Apple get props for doing the obvious?

[AnalogDiehard]

the FBI will no doubt petition Congress to legislate that Apple (and Google, Samsung, LG, etc.) provide a means for altering the firmware of any smartphone sold in the U.S., on court order. And that's when this fight will really get interesting.

Where it will really get interesting is if Apple invokes the anti-circumvention clause of the DMCA to prevent hacking into their copyrighted iOS. The DMCA does not contain any exemption to cases of criminal acts. Congress has already tried to reform the DMCA to get around the anti-circumvention clause in the interest of national security but has met up against fierce opposition from the entertainment industry.

This would be the perfect storm especially coming from a company whose motto at one time was "rip, mix, burn". In order for the government to enact such legislation, the DMCA would have to be weakened to prevent conflicting laws and you can count on Hollywood putting up a big fight. Even it they did enact such a law without weakening the DMCA, a federal court would grant an injunction against it.

Re:Why does Apple get props for doing the obvious?

[shawn2772]

Google's Nexus devices are secure and don't have the same firmware update flaw that iPhones do. In fact all Snapdragon 810 based phones are immune because the 810 does not allow firmware updates to the secure memory, it's a ROM burned into the silicon.

As an Android security engineer I appreciate you standing up for Google, but this isn't true.

The relevant software for device encryption includes:

1. The system image. This contains the vold daemon which mounts the encrypted disk and configures the kernel with the key.
2. The boot image. This contains the Linux kernel, which includes dm-crypt, the code that does device encryption.
3. The trusted OS image (TOS). This contains the code that knows how to use device-specific hardware-bound secrets. Vold calls into it when decrypting the disk encryption key to pass to the kernel.
4. The bootloader image. This is used to load all of the above. The details vary, but generally the TOS is verified and loaded first, then the bootloader switches out of secure mode (I'm describing the process for ARM-based devices; it's a bit different for others), then verifies and loads the boot image and boots the kernel. The kernel mounts the system image and configures dm-verity which does run-time verification of system image blocks.

All of the above are flashable images, and replacing them would enable bypassing the security controls they implement. The bootloader image is the most critical one, since it verifies and loads both the TOS and the boot image. If you can change the keys it uses to verify those, you can change everything else. The bootloader (including the keys it contains) is signed by a key whose public part is burned into ROM. That key can't be changed, and the private key is held by the device OEM. I believe the keys used to sign the system and boot images for Nexus devices are held by Google (not sure), and the key used to sign the TOS is held by the TOS maker (Qualcomm, on the recent Nexus devices).

You could compromise Android device encryption with the assistance of any of these parties. Getting the OEM to sign a new bootloader allows you to provide your own versions of any of the higher-level pieces, though these things are pretty intricate and writing replacements from scratch that would work is a big, big job. If I were working for the FBI, I probably wouldn't take that approach. Getting Google to sign a modified system image would, from a technical perspective, be much better. You'd still have to brute force the password, and you'd still have to have the TOS perform a 50ms operation for each password you try, but that would be no problem for a four-digit PIN. If the user used, say, an eight-character password, though, it wouldn't be enough. Also, Google's response to a request for a modified system image would probably be about the same as Apple's.

The best point of attack would be Qualcomm (for recent Nexus devices; other platforms and older Nexus devices use different TOSes). Get them to sign a TOS image that takes the device secrets and simply exports them in response to some request. With those secrets in hand, and a copy of the device flash, you can then brute force the device encryption key off-device, on big hardware. No realistic user password would stand up to that. The process is complicated so I won't bother explaining it here, but it would be very doable.

To be clear, the Android security team considers these multiple points of entry a bug, not a feature. I, personally, want to get to a state where if you don't have the user's password, you aren't getting in, barring direct attacks that involve peeling apart chips to extract secrets. Doing that requires a separate secure processor (something most Android devices don't have) running non-updateable software. Working to make this possible is one of my current projects.

It's a much tougher problem in the Android world than for Apple, though, because of all of the players in the ecosystem. Not because they're unw

Re:Why does Apple get props for doing the obvious?

[shawn2772]

But I suspect Google could push a Google services update targeted at a specific phone, and those can do darn near anything.

You suspect wrong. Play services can affect some things, but all of the device encryption stuff is at a much lower level. Breaking encryption would require changing the core OS, and even a little deeper. See my reply to the GP for more detail.

Re:Why does Apple get props for doing the obvious?

[Anonymous Coward]

uhh, that is BS. the feds broke all IOS years ago.
this is just more lies/security theater.

Re:Why does Apple get props for doing the obvious?

[AmiMoJo]

Wow. Thanks for that, it's quite incredible... Can you please clarify some things.

Many Android devices include secure storage. Looking at the documentation for the Qualcomm SoC, it includes such storage. Like a TPM chip, once locked it can't be unlocked without a code (typically a hash of a password) and enforces its own security in terms of the maximum attempt rate and refusing to allow more attempts after a number of failures.

Android 4.3 introduced support for this kind of hardware secure key storage. There is some detail here: http://nelenkov.blogspot.co.uk...

Are you saying that Android on Qualcomm SoCs that have secure storage don't use it? Because if they do use it then what you say about being able to update the bootloader, boot image, system image etc, is all irrelevant. Go ahead, replace any of them, the SoC isn't going to give up the master key unless you present it with the right hash, and there is nothing you can do to reduce the delay between attempts or the maximum number of attempts per power cycle.

This is why TPM on computers is secure. Obviously you can boot any OS image you like, or flash the BIOS any time you like. It doesn't matter, the TPM has its own processor and isn't giving up that key until you give it the right hash. Naturally the TPM's firmware is, in every case I've ever seen, burned into ROM.

Re:Why does Apple get props for doing the obvious?

[Anonymous Coward]

Because everyone's promised they'll do this and didn't. How many times has one of my friends told me about the blackphone they're waiting for to get the bugs out of?

Re:Why does Apple get props for doing the obvious?

[shawn2772]

Some small clarifications:

First, I'm not 100% sure that the TOS vendor signs the TOS. That may also be signed by the OEM.

Second, my comment that Qualcomm would be the "best" point of attack was only because the TOS is the best point of attack, from a technical perspective, not because I think Qualcomm would cooperate. I have neither the knowledge nor the authority to say anything about what Google's partners would or would not be willing to do.

Third, I want to point out that my project to add a separate secure processor to Android devices and to no one can brute force passwords has nothing to do with the current Apple/FBI issue. It's ongoing work that I initiated some years back. I should also mention that it may or may not be successful. These things are complicated.

Re:Why does Apple get props for doing the obvious?

[shawn2772]

Android 4.3 introduced support for this kind of hardware secure key storage. There is some detail here: http://nelenkov.blogspot.co.uk... [blogspot.co.uk]

Better link, reflecting the massive improvements in M: https://source.android.com/sec...

Note that until L there was no relationship between disk encryption and the hardware-backed keystore. In L we added a dependency on the keystore, though I think it's still not quite where it should be (even in M). We'll continue improving it, obviously.

Are you saying that Android on Qualcomm SoCs that have secure storage don't use it?

They don't use it for this, exactly. The usey bits of it for master keys used to derive keys that are used for this. I don't believe there's any equivalent of a TPM that in QC SoCs that requires presentation of a certain hash (or sequences of hashes) in a PCM or similar to unlock a key in secure storage.

Because if they do use it then what you say about being able to update the bootloader, boot image, system image etc, is all irrelevant. Go ahead, replace any of them, the SoC isn't going to give up the master key unless you present it with the right hash, and there is nothing you can do to reduce the delay between attempts or the maximum number of attempts per power cycle.

Yeah, that would be awesome wouldn't it? Unfortunately, no. The secure storage you're talking about is just storage. The software that manages it runs on the main CPU, is loaded from flash, etc. Various ARM features are used to keep this all completely walled off from Android and the Linux kernel, and largely even from the trusted OS and applications that use it. But they're still all loaded from flash.

This is why TPM on computers is secure. Obviously you can boot any OS image you like, or flash the BIOS any time you like. It doesn't matter, the TPM has its own processor and isn't giving up that key until you give it the right hash.

Right. To really do this you need a separate secure processor that has its own storage and its own code... ideally code that physically cannot be updated, though that assumes the code is perfect, which is never true so some tradeoffs have to be made. Apple has done this, I believe, though I don't know the details, with their Secure Enclave chip. Samsung has done something with KNOX. Nexus has no equivalent, and neither do most Android devices.

One interesting side note: Since Intel doesn't have any equivalent of the ARM TrustZone, the typical implementation of the hardware-backed keystore on Intel devices is to actually use a TPM chip. That has some nice properties, though TPMs are fixed-function devices and so cannot implement the access controls added to the hardware-backed keystore feature set in M.

Re:Why does Apple get props for doing the obvious?

[Anonymous Coward]

Okay. I accept that encryption operates at a much lower level. That protects me when my phone is off or locked. When I start it up and/or sign in, and Google Services starts doing stuff, how can I tell that it's not at the behest of DOJ?

Having a phone that is only secure when it is off is about as good as having a NoPhone.

Re:Why does Apple get props for doing the obvious?

[c]

You suspect wrong. Play services can affect some things, but all of the device encryption stuff is at a much lower level.

If the phone is turned off, true. If the phone is on, locked, network aware, and the filesystem has been mounted (i.e. like 99.9% of Android phones in use at any time) then a Google services attack would be feasible; this is similar to the iCloud-based approach they could use on an iPhone is someone hadn't messed with the password.

If law enforcement's SOP with seized phones is "turn it off" rather than "put it on a charger and stick it in a faraday cage" then yeah, Android encryption isn't too bad.

I'd assume that for any random Android device it's possible for someone (oem, carrier, Google) to unlock the bootloader, allowing a custom recovery which can, basically, do what they've ordered Apple to allow with the iPhone. The majority of Android phones have some mechanism for bootloader unlocking allowing unsigned ROM installs, so this should be a fairly realistic threat...

Re:Why does Apple get props for doing the obvious?

[AmiMoJo]

Thanks for the reply. I don't have access to it any more, but I read in the Snapdragon 810 datasheet that there is a secure storage area only available to code running in the Trusted Execution Environment, and it requires unlocking. Unfortunately it's all under NDA so even if I still had access I couldn't post an excerpt, but like Apple and Samsung they do have protected storage.

It's part of their "Haven" security platform IIRC. Required to enable contactless payments.

Re:Why does Apple get props for doing the obvious?

[shawn2772]

Hmm. Maybe. Play services doesn't have root access, but it does have pretty deep hooks. It probably couldn't get everything, but it might be able to get quite a bit. I hadn't thought about that one. Thanks.

Re:Why does Apple get props for doing the obvious?

[JesseMcDonald]

I'd assume that for any random Android device it's possible for someone (oem, carrier, Google) to unlock the bootloader, allowing a custom recovery which can, basically, do what they've ordered Apple to allow with the iPhone.

Sure, you can unlock the bootloader; just connect to a PC and run "fastboot oem unlock". However, both locking and unlocking the bootloader have the effect of a factory reset, so this won't allow you to get at the user's data.

Re:Why does Apple get props for doing the obvious?

[c]

However, both locking and unlocking the bootloader have the effect of a factory reset, so this won't allow you to get at the user's data.

It does when I do it, and I assume it does when you do.

I won't assume that there aren't others (the manufacturer or a telco, for example) who couldn't unlock an Android bootloader without wiping it, and recent history suggests that the only backbone a telco would show against a law enforcement request would be if their shirt slides up while they're bending over.

Re:Why does Apple get props for doing the obvious?

[david_thornley]

This doesn't look like a back door so much as a security vulnerability. It's pretty obvious that Apple had no intention of deliberately creating this vulnerability. It should also be obvious that Apple is trying to make an easy-to-use and forgiving device that is proof against all possible attacks, and that's difficult. They're doing better.

Re:Why does Apple get props for doing the obvious?

[Anonymous Coward]

You missed a lot; the phone at the center of this case is a 5C.

Re:Why does Apple get props for doing the obvious?

[Anonymous Coward]

Theoretically ... I mean, this wouldn't break into the iPhone by any means. Someone would still have to try brute forcing the password.

What this does is potentially allow them to push firmware that'll turn off the auto wipe function and to remove the delay between password attempts.
The updated firmware by itself still can't bypass the encrypted data.

Neither of these things directly unlocks the phone, but together make it much easier to brute force a 4-digit PIN. If the person has a secure password rather than a PIN, it'd be much more difficult, even with these changes.

which brings to mind the old question ...

[swell]

Can God make a chili pepper so HOT that even He can't eat it?
Yeah, makes you think, doesn't it?

Re:which brings to mind the old question ...

[U2xhc2hkb3QgU3Vja3M]

No, it does not make me think at all. If there was a "god" he'd be able to kill me right n

Re:which brings to mind the old question ...

[Anonymous Coward]

ow. Level up!

Re:which brings to mind the old question ...

[Anonymous Coward]

Man, I hate Ronin!

Re:which brings to mind the old question ...

[Anonymous Coward]

Can God make a chili pepper so HOT that even He can't eat it?
Yeah, makes you think, doesn't it?

Kind of makes you think about global warming and all the precipitation we are getting these days!

Re:which brings to mind the old question ...

[Anonymous Coward]

there is nothing god can't do, so there can be nothing so hot that he *can't* eat.
i thought this fallacy was debunked many times already, why does this question keep popping up?

Re:which brings to mind the old question ...

[coinreturn]

there is nothing god can't do, so there can be nothing so hot that he *can't* eat. i thought this fallacy was debunked many times already, why does this question keep popping up?

Whoosh!

Re:which brings to mind the old question ...

[ender8282]

I'm not sure how it'd work but that could be way better as a Chuck Norris joke:

Re:which brings to mind the old question ...

[Anonymous Coward]

Yes, He can. But He eats it anyway and the next morning Mauna Loa erupts...

Re:which brings to mind the old question ...

[Anonymous Coward]

Apparently, he couldn't make humanity sufficiently well that he didn't need to drown all but 8 of them, or for that matter he couldn't find a better way of getting rid of all the bad people from that time than a giant flood with massive collateral damage, if he was all powerful he could have waved his magic wand and just stopped the hearts of all the bad people instead. I don't know where you get this ridiculous notion that the God of the Bible is all-powerful, because in the Bible he demonstrates time and again that he isn't.

The Bible makes much more sense if treated like the work of fiction that it is, understanding that God was made by man, not the other way round.

Android?

[irrational_design]

What I haven't heard yet is where Android lands on the security spectrum. Are they already as or more secure than what the rumors are now saying Apple is trying to achieve? Are they as or more secure than where Apple is right now? Are they as or more secure than where Windows is right now?

Re:Android?

[armanox]

I think that falls on the individual implementation of the phone. If my understanding is correct the operating system does support being at least that secure, but that doesn't mean that the version of Android that actually ships is,or that the phones hardware supports it either. The downside to the fragmented Android community - there are few baselines.

Re:Android?

[Anonymous Coward]

They are far, far below Apple. Everyone is far below Apple in terms of device encryption. You don't hear about the other's because there's no need, they're easily hacked.

Re:Android?

[VValdo]

I think it depends on the OEM. There are factors such as whether the device storage is encrypted by default, whether the bootloader is locked by default, what kind of security hardware is available on the SoC and whether it is used, whether exploits are patched, whether there is a continuing roll out for discovered exploits, whether updates are automatically installed w/o authentication, whether the baseband contains known exploits and attack vectors (cough), etc.

So there's no one answer because there's no one Android device and many phone OEMs (and the manufacturers of the underlying hardware platform) may be implementing security to different degrees. Though many of these considerations do have google guidelines and policies in place, some of which may be enforceable via google compatibility tests, there is a wide spectrum of what you can expect from Android generally speaking I think.

You might look to Google's policies and recommendations, and more importantly their Nexus devices themselves as models for what they consider best practices to be. Then there is blackphone and other distros that have security as their primary focus, so they may be good to consider as well.

Re:Android?

[Anonymous Coward]

What I haven't heard yet is where Android lands on the security spectrum. Are they already as or more secure than what the rumors are now saying Apple is trying to achieve? Are they as or more secure than where Apple is right now? Are they as or more secure than where Windows is right now?

There's a reason why your not hearing news about the FBI needing to unlock Android phones. Hint: it's not because Android is more secure.

Re:Android?

[Anonymous Coward]

What I haven't heard yet is where Android lands on the security spectrum.

Updates for all non-Nexus devices and even some Nexus devices are signed by the manufacturer, not by Google.

ChromeOS updates are still signed by Google, though. All Chromebooks and Chromeboxes lock the manufacturer out of the device.

You might argue the best plan is to have your device's update signing key held by a company with no presence in the country likely to persecute you. For an American journalist, maybe it's better to have a Huawei phone than an Apple phone.

I think this is not the case, that Huawei would roll over and cooperate with US gov't instantly, and would have poor security practices besides, and would furthermore be only one of several back doors into the phone. I think Apple / ChromeOS and further lockdowns is the right path to take. However, reasonable people may disagree, and this is an important point: if we don't have rule of law and some reasonable bounds on discovery in the United States, companies with significant presence here won't be able to export products that require users to trust them, and what else is the US supposed to export, anyway? Wheat?

If I were Google, I'd consider moving cloud platform and operating systems development to Switzerland, and reorganizing Mountain View and other US offices as a distrusted subsidiary with no access to anything important. This government overreach issue could become catastrophic. US companies need to hedge against it. None of the presidential candidates promise anything reasonable.

Re:Android?

[throx]

What I haven't heard yet is where Android lands on the security spectrum.

Updates for all non-Nexus devices and even some Nexus devices are signed by the manufacturer, not by Google.

I'm pretty sure devices that allows for user-driven unlocked bootloaders (and therefore access for things like Cyanogenmod) doesn't require signing by the manufacturer - otherwise there would be no method to put Cyanogenmod on there. For example, my Galaxy Note 3 just put a big warning up when I went to update the firmware, but allowed me to do it.

Re:Android?

[bingoUV]

For example, my Galaxy Note 3 just put a big warning up when I went to update the firmware, but allowed me to do it.

But my experience is that encrypted data from earlier operating systems is gone if such things are done to the phone. That is the point here - not only to change the operating system but do it in such a way as to preserve encrypted data.

Re:Android?

[Anonymous Coward]

Android is insecure in each and every respect and Google is actively collaborating with authorities to ensure it remains so.

Re:Android?

[Kartu]

The question comes down to: "which Android phones can have firmware forcefully upgraded without owner's consent?"
I don't know the answer.

Re:Android?

[Anonymous Coward]

Uh oh. You're summoning swillden, the APK of gushing Google praise.

Re:Android?

[shawn2772]

What I haven't heard yet is where Android lands on the security spectrum. Are they already as or more secure than what the rumors are now saying Apple is trying to achieve? Are they as or more secure than where Apple is right now? Are they as or more secure than where Windows is right now?

Android devices with L or M are roughly as secure as the pre-Secure Enclave Apple devices (like the 5C). That is, the security software is all in flashable components which are signed, and if the holder of the signing keys can be coerced into signing a custom image, it's possible to bypass all of the anti brute-force protections. Brute force is still necessary, then, but it's trivial for four-digit PINs and may be feasible even for better passwords (or patterns).

That's in general. Some OEMs have gone a bit further, such as Samsung's KNOX. I don't know the details and can't comment on whether or not they actually improved the security above the baseline required/defined. by Google.

I'm the Google Android engineer responsible for lots of these bits.

Re:Android?

[Fahrvergnuugen]

The fact that the FBI isn't complaining about Android should tell you something.

Should be more concerned about controlling guns...

[Anonymous Coward]

Than some stupid phone.

And then....

[Anonymous Coward]

And then the FBI will demand the source to iOS, toolchain, and Apple's signing keys.

Re:And then....

[brantondaveperson]

Apple's signing keys.

You mean, everyone's signing keys.

This might not be a fight Apple wants

[the_Bionic_lemming]

The U.S. Government can conceivably ban the sale or possession of that type of phone.

They do it all the time with other products, or require licensing and training and over site after purchase.

Re:This might not be a fight Apple wants

[Anonymous Coward]

Apple can conceivably move to another country too, no real need to be in the US after all.

I have to wonder

[Krishnoid]

I suspect that Tim Cook as an LGBT individual, has an intimate, proximate, and/or cultivated personal interest, with historical and current backing, in personal privacy. In these particular circumstances, it would express itself as the importance of data privacy on a personal device.

If I had to guess, it could come down through the ranks indirectly as unstated support from the top.

Re:I have to wonder

[swb]

I've always thought that since he came out. It seems like concern for privacy would be a fairly strong value for a man who lived in fear of being exposed.

Re:I have to wonder

[Anonymous Coward]

Posting anon:

Couldn't agree with this more, Tim is one person who could definitely appreciate privacy significantly more than most CEO's simply as he has, likely anyhow - a more intimidate knowledge of how much some people desperately cling to their privacy.

I sure as heck know there are things on my devices I would want NO ONE to ever ever see or know about, including family.

Re:I have to wonder

[Anonymous Coward]

You people are deluled. This has nothing to do with values. Apple would bend over and provide the government with the vaseline if they thought to do this would be more profitable in the medium/long term. Decisions like this aren't made based on the personal and private struggles of 1 CEO.

Clearly, their analysis has shown them that bending over threatens their profit and market share in the near future, hence their firm and very PR-supported resistance campaign against this. Also, they get to tout their products as more secure than the alternatives to all of the progressive hippies who are prone to buying their stuff.

This also explains Microsoft's opposite stance, Microsoft being the main supplier of cloud services for the federal government right now.

Re:I have to wonder

[Anonymous Coward]

I suspect that Tim Cook as an LGBT individual.

I'm pretty sure he is only gay. He can't be a lesbian, doesn't appear to be interested in women, and has not expressed a desire to "change" his gender.

Btw: LGBT is an outdated term. It's now LGBTIQ, to be more politically correct.

Re:I have to wonder

[Anonymous Coward]

I suspect that Tim Cook and the entire Apple board are shameless corporate careerists, who have long since whored their users data and devices out to the marketers in general, and the NSA in particular, in return for solid bucks and especially government kudos.

You think someone's sexuality is going to have bearing on what they do when presented with cash/access on the table? Not a fucking chance. People with that kind of principle don't make it up to the board. They resign, turn nihilist, or give in to the dark side.

The iPhones have backdoors now. They will have backdoors in five years time. The ones Apple put in, and the ones the NSA finds. No-one is going to take them out because their is no money in it, and it will only draw sound and fury from petty government beuracrats and their lickspittle media buzz-monkeys. It doesn't matter if Tim Cook or every Apple executive sexually identifies as straight, gay, or a camera shy agoraphobic attack helicopter. They are businessmen and their business is to sell us out for their own personal gain.

You want results, stop pussyfooting around. Pass a law: No fucking backdoors, no exploiting backdoors. Period. Stop pretending you can ask nicely.

Re:I have to wonder

[Anonymous Coward]

I sure as heck know there are things on my devices I would want NO ONE to ever ever see or know about, including family.

Like the phone number?

Re:I have to wonder

[Anonymous Coward]

Anybody with a reasonable amount of paranoia fears exposure. Just look in the mirror.

Re:I have to wonder

[dywolf]

He may be LGBT, but when a CEO actions just happen to be in the best interests of his company's stock price, I'm more inclined to believe it's rooted in his being a CEO and the typical concerns those types have over stock prices, company valuations, etc, rather than necessarily being rooted a personal conviction.

Re:I have to wonder

[Anonymous Coward]

Tim was never living in fear of being exposed. He was not living "in the closet" prior to the public announcement. He just did not previously bring his personal life into the public eye.

If all it takes is an OS update to get access

[hsmith]

to the data on the phone (disabling wipe after 10 attempts) - is the phone really all that secure?

Re:If all it takes is an OS update to get access

[Anonymous Coward]

We should be clear about this; this is only correct assuming that you used a PIN code for your phone access. If you followed standard security polices and had a long passphrase then this problem wouldn't occur on either platform. Not, of course, so easy on a small phone keyboard. The point is that Apple had implemented almost (but not completely) secure use of a PIN code. Almost is not, unfortunately good enough, but it's probably a better trade off than Android which didn't even try but still most people use PIN codes.

Re:If all it takes is an OS update to get access

[Anonymous Coward]

"all"?

So, you will have that right after lunch, eh?

Whats going on

[Smiddi]

The security "war" is not longer about country versus country, but about "the people" versus the government.

Re:Whats going on

[Anonymous Coward]

This is a war that Tim Cook can not win. He's basically weaponizing his product, and the US Government has rules about encryption that could get tighter the more Cook tries to cram unhackable encryption into his products. This is how we will end up with government mandated back-doors. If Trump becomes president, with his anti-terrorist and islamic hate speech, you can bet that Apple will be a 'huge' target for him, and an easy one, and likely an early one as he asserts his presidential prowess. God I hope that doesn't happen, but Cook is half way down a slippery slope when it comes to fighting the government on encryption.

Re: Whats going on

[Anonymous Coward]

Why? Should he not even bother? Do like all the other Silicon Valley shills have done, roll over, say, "yes, whatever you want master," and comply? Just because it comes from "the government" doesn't make it in our best interests. That literally is the reason the US was founded.

On a side note, maybe they should bring back civics classes. Give people a bit of a clue.

Apple should move its HQ & offices to Manhatta

[Anonymous Coward]

that way they'll have some skin in the game. Cupertino population density according to WP: 5,200/sq. mi. --- Manhattan population density --- 71,671

Everyone else gets access as well

[Elfich47]

This issue become if another country that is not bounded by the search and seizure laws (China) forcing a deep investigative search of all phones entering the country, and possibly leaving long term trap doors in the phone. If this person later becomes a person of interest (for any reason) the country immediately downloads your entire phone remotely and turns it upside down looking for sedition/treason.

Any knowledgeable international travelers already know to leave their laptops at home or bring a burner laptop on the assumption that Chinese customs and immigration *will* load your computer up with five different flavors of spyware during the immigration process. I expect they would love to do the same with every phone that enters the country.

welcome to the 21st century, Apple!

[ooloorie]

Apple engineers have already begun developing new security measures that would make it impossible for the government to break into a locked iPhone using methods similar to those now at the center of a court fight in California

This is how Apple should have designed these phones from the start. We've only had the necessary technology widely and cheaply available for, oh, about, 25 years?

Re:welcome to the 21st century, Apple!

[wvmarle]

Is that so?

I know we have this technology against MITM attacks or wiretaps, provided by SSL and the like. Keys can be securely exchanged, all data is encrypted to a level that makes it virtually impossible to break. But when you have direct hardware access to the device in question? That's a whole different ballgame. You then get someone's private SSL key in your hands and you can start to brute force the password - you could rewrite SSL (open source) if needed to do so. Extra protections have to be in place to prevent just that from happening, and that's what this is all about. The protection of the keys against direct access to the very hardware they're stored on.

Re:welcome to the 21st century, Apple!

[ooloorie]

Yes, that is so. These extra protections are secure computing elements. They have been around for decades. Every SIM card has one.

All devices require passcode to upgrade?

[SuperKendall]

Why does apple get headlines for doing what they should have done in the first place?

Why do you think Apple should have "in the first place" required a PIN code to install an OS update? As a technologist do you not find it reasonable you should be able to put the phone into a recovery mode and then install the OS again in case something was messed up?

Indeed if it's what they "should have done" then you must be apoplectic that no other company has taken this "obvious" step to date.

Should you be required to log into your PC in order to install an OS?

Re:All devices require passcode to upgrade?

[Anonymous Coward]

Should you be required to log into your PC in order to install an OS?

No, but if I did ever lose my passphrase and have to reinstall the OS, all of the data currently on my PC would become meaningless random numbers. This is certainly a desirable property for many people. In the case of my PC, this property is enforced by mathematics; in the case of the iPhone, Apple is trying to enforce this property through software (thus allowing users to authenticate using a simple PIN rather than a secure passphrase), but there isn't really a qualitative difference.

Re:All devices require passcode to upgrade?

[argumentsockpuppet]

You should have to enter the password or PIN in order to preserve the data. In fact, that's how most system recovery options I've encountered for encrypted systems work.

You'd like to reinstall the OS? Sure, no problem, but the data will be lost. You want to keep the data that requires a password? Then you need the password.

Re:All devices require passcode to upgrade?

[adamstew]

The best way to handle it is to make it an "if the unlock code is provided, then you can update the software of the OS and firmware of the device without wiping the encryption keys. If the unlock code is not provided, then I will let you update the software but first I will wipe the encryption keys." Since the encryption is all done in a hardware chip with it's own separate OS and update process, it would not be difficult to accomplish.

Re:All devices require passcode to upgrade?

[bingoUV]

Should you be required to log into your PC in order to install an OS?

If the previous OS's encrypted data is supposed to be preserved? Hell yes.

Re:All devices require passcode to upgrade?

[goose-incarnated]

Should you be required to log into your PC in order to install an OS?

Actually, yes - the BIOS can be secured with a password. If the user of that particular model motherboard so wished, they could arrange it so that you need to login into the BIOS to allow booting off installation media.

Re:All devices require passcode to upgrade?

[AmiMoJo]

There is a lot of confusion about what Apple can do and what the FBI is asking for.

The FBI is NOT asking for an OS update. That is impossible without unlocking the phone. That is how encrypted Android phones and Windows systems work too. The disk is encrypted and the OS stored on it can't be updated until it is unlocked with the correct key.

What you can do with the recovery mode (DFU as Apple call it) is load and execute software in RAM. That software could wipe the flash memory, encrypt it with a brand new key and install a fresh OS image. That would make the previous data permanently inaccessible, which is obviously not what the FBI wants.

The FBI wants Apple to load some special software into RAM via the DFU. This software would remove the 10 attempt limit and the delays between attempts, and allow attempts to be automated over USB/Wifi/Bluetooth. It wouldn't touch the installed OS, just allow the brute force attack from RAM.

passcode complexity

[Anonymous Coward]

to the data on the phone (disabling wipe after 10 attempts) - is the phone really all that secure?

It's not that the data is automatically accessible, it's that if your PIN is only four digits, then it's easy to brute force (which is that the FBI wants to do: go through all ten thousand combinations).

If, however, you enable "complex passcodes", and you enter a 10+ character string, then it's going to be a lot harder to go through all the combinations--even if Apple is forced to help.

Re:passcode complexity

[Anonymous Coward]

If, however, you enable "complex passcodes", and you enter a 10+ character string, then it's going to be a lot harder to go through all the combinations--even if Apple is forced to help.

It is hard to enable a longer keys on something you use regularly. Sure maybe you could do it when you first turn on the phone, but not for a quick unlock. Of course, you also have to use the code often enough to retain it in memory. What you can do is to use non obvious things as part of the pass code. Any piece of data the phone has access to could conceivable be used to aid in the unlock process, For instance, if 8 of 10 internal checks the secure device did revealed normal conditions, then the short code might be prompted for, but if the stars did not align, then your back to the full length code, and of course once you hit that state, you stay in that state until you put in the full code.

For instance, if you entered 3 incorrect short codes, then immediately demand the full code, and keep demanding it, and as I noted earlier, their could be additional non obvious checks that would also put you back to the full code.

Of course, none of this helps if you can rewrite the bit of the code that makes that decision to say always try for the short code. There, your only defence, as alluded to is to have just required a long code in the first place.

Evil

[Anonymous Coward]

At a moment very very soon, the US Government should determine that Apple Inc. is and Enemy of the USA and take the most direct measures to annihilate Apple Inc. and it's ... Fuhrer.

Mr. Timothy Donald Cook and Apple Inc. are the cancer within humanity.

Bye Bye

Re:Should be more concerned about controlling guns

[Anonymous Coward]

Precisely ... When I aim my 9 mm out the window I have a really good grip compared to when I am grasping my cell phone, texting down the highway at 80 mph, primed to kill someone as soon as auto-correct makes me bring the screen closer to my face.

Can you point me to a more secure smartphone?

[Brannon]

Go ahead, I'll wait.

Re:Can you point me to a more secure smartphone?

[ooloorie]

More recent iPhones and Android phones are a lot more secure. In addition, any app that runs directly on the SIM card is more secure (that kind of secure app has been around for more than a couple of decades).

Without exception uniformly worse than Apple.

[Brannon]

I'm not sure why it's so hard to just say the truth instead of wishy-washy crap like "I think it depends on the OEM". We aren't having this debate about Android phones because it is trivial for the FBI to crack an Android phone.

Re:Without exception uniformly worse than Apple.

[Anonymous Coward]

Because it does depend on the OEM - as Apple is showing the only way to solve this issue is in the hardware because it is too easy to bypass software based solutions.

So there isn't much Google can do with Android itself (now the Nexus hardware is another story, but that's not Android).

Re:Without exception uniformly worse than Apple.

[irrational_design]

This is frankly astonishing to me. I use an iPhone because it is what my work gives me. But I've had so many techies deride me for using an iOS instead of Android that I was sure the answer would be that Android devices are far more secure than Apple devices since techies tend to put a lot of value (lip service?) towards security. I guess when it comes to pros and cons, the pro of being able to root your device is more important than the con of the FBI being able to root your device.

Re:Without exception uniformly worse than Apple.

[bingoUV]

I guess when it comes to pros and cons, the pro of being able to root your device is more important than the con of the FBI being able to root your device.

That is correct. The multitude of devices and configurations also means that FBI has to work hard at every device rather than around 4 or 5 iPhone models.

Though the multitude also gives a false sense of security to Android phone users - when a security vulnerability is found and publicised in one Android device, owners of other Android devices don't explicitly think theirs is vulnerable too. They should, but they typically don't.

Can you point me to any perfectly secure phone?

[Brannon]

Presumably you've made a perfectly secure smartphone yourself--that would certainly justify your 'holier than thou' attitude. Can you point me to where I can buy it?

Failing that, just point me to any perfectly secure consumer computing device. Go ahead, I'll wait.

Re:Can you point me to any perfectly secure phone?

[Anonymous Coward]

Well, perfectly secure is a brick. But drive encryption on a typical PC or laptop is reasonably secure, no? And we've long established that a smartphone is just a computer with a radio in a small form factor.

Missing the point

[argumentsockpuppet]

I RTFA this time. It, like so many other other articles, missed the actual legitimate issues of the case. Every time you read an opinion that says Apple should "unlock the phone" or "decrypt the phone" misses the point that Apple must create software which doesn't exist. Whether Apple should do that or not is itself an interesting discussion, but the real issue here is whether government agencies should be able to force software companies to create hacking software, especially when the software company isn't accused of breaking any law in the case.

I don't have any issue with the idea that a government agency should be allowed to create hacking software. I wouldn't object if the NSA had required Apple to sign a software update created by the NSA for the purpose of hacking into the phone. In fact, I think that's what the government should do. However, I'm very troubled by the fact that most people are in favor of Apple being forced to unlock a phone when that's not what is really going on.

Compulsion of speech is an issue that has been supported in food labeling laws and denied in other cases. Creating software is fundamentally different than providing existing information. I believe creation of software is a form of speech, and I think the courts have upheld that viewpoint, so this case is really hinging on whether a judge under "All Writs Act" has the authority to force someone, not even someone accused of a crime, to create something new.

I think it is important in this discussion to understand how the software the government wants Apple to create would work. Apple updates happen automatically for phones which automatically connect to a known wifi access point. Those updates don't just get pulled from Apple though, the phone creates a code which is encrypted with Apple's public key, so that only Apple with it's private key can decrypt. The update is then provided to the phone, with the code provided by the phone re-encrypted so that only the phone can decrypt it, and only then is the update, signed with Apple's key, loaded into the phone.

If the government wanted to, they could require Apple to provide source code to their existing software and the government could modify it and either ask Apple to sign it or require Apple to provide its private key. However, by requiring Apple to create the hacking software, they're introducing an idea that software companies cannot refuse to create software when required by the government. Once someone does something for a government official, often that's taken as a reason that the government can require them to do it again. (See In re Boucher - case citation: No. 2:06-mj-91, 2009 WL 424718)

Apple had asked that the request be sealed, thus kept secret and not able to be used as precedent but the Department of Justice refused and thus made their request both public and able to be used as precedent. If they succeed in forcing Apple to create hacking software they get access to the information on this phone, but more importantly, the hundreds or thousands of phones they'd like to access are much more likely to be accessed by forcing Apple to repeat the process over and over. Apple doesn't want to be in the business of creating hacking software for the government. Much of law enforcement would consider this a victory, but I think the FBI is hoping to lose this case as a general might be willing to lose a battle, in order to win the bigger war. By losing the case, the FBI gains public support that they can use to pressure Congress to create laws forcing software companies to build in backdoors. Such a thing could be done securely, so that it wouldn't open the software to hackers. I have zero faith that Congress or software companies actually would do it in a secure way, but that's not the reason I am against the backdoor. Encryption is math and the math is known and freely available to anyone who searches for it. The ability to create securely encrypted software is something that can't be made to disappear, but it can be made illegal to do in the US. By d

Re:Missing the point

[AchilleTalon]

I'm very sorry to tell you so, but Apple needn't to create software that doesn't exist. It needs to modify an existing piece of software, called firmware that set a limit on the number of attempts with a wrong password before deleting data on the phone and it needs to remove the delay they introduced between attempts to avoid an automatic system to try passwords at a rate no human can. So, the piece of software exists and the modification is about two lines of code and maybe something like less than 10 characters to change in the code. Then, they can reload the firmware remotely on the device they are asked to collaborate to render the data accessible to the FBI. It is not possible to remotely flash the firmware on later versions of the iPhone without the authorization of the owner. This is not the case with the iPhone 5c under investigation.

Now, the reason only Apple can make the modification is the piece of code, the firmware, must be signed with Apple's private key. Otherwise, the iPhone will refuses to execute the code.

Most ot the rhetoric from Tim Cook is pure bullshit in this case. He tries to expand the request to all iPhones in order to create a wave of sympathy and pose as a champion of privacy while in reality he doesn't give a shit, unless this can be a sales point. Pure marketing here.

Re:Missing the point

[kybred]

Most ot the rhetoric from Tim Cook is pure bullshit in this case. He tries to expand the request to all iPhones in order to create a wave of sympathy and pose as a champion of privacy while in reality he doesn't give a shit, unless this can be a sales point. Pure marketing here.

Perhaps you missed this story

The twelve cases are similar to the San Bernardino case in that prosecutors have sought to use the 18th-century All Writs Act to force Apple to comply, but none are related to terrorism charges and most involve older versions of iOS software.

Re:Missing the point

[argumentsockpuppet]

When I write software, and I do, I almost never start with nothing. I usually start with a template that has the basic things I usually want and then start adding in or snipping out pieces to make the resulting software accomplish something specific to the task at hand. Sometimes I start with a program I've already written with a lot of code and chop large parts out, paste in other parts from other programs and write the bits that didn't exist before. At some point, I think it is fair to call the result new software.

To say "create software that doesn't exist" to me, means that the binary that runs in memory is different than the one that would have run before. By comparison, if you say that the modification of software (firmware is just software for a specific type of use) doesn't create something new, then it wouldn't be something new so long as they used any of the code that existed before. That would rule out pretty much every version of iPhone software as being something new since it is all just a modification of something that existed before. I doubt most people would agree. How you use words to describe something doesn't change what the something is. If you like, please re-read my previous post with this phrase instead: "create something which hasn't ever before existed in exactly this way but is substantially similar to things which did exist before, created for a purpose different than the original purpose of the thing which existed before."

I don't mind a bit of typing to convey my thoughts more clearly, but that sort of thing would make my long winded posts even more unbearable.

Re:Missing the point

[shess]

I'm very sorry to tell you so, but Apple needn't to create software that doesn't exist. It needs to modify an existing piece of software, called firmware that set a limit on the number of attempts with a wrong password before deleting data on the phone and it needs to remove the delay they introduced between attempts to avoid an automatic system to try passwords at a rate no human can. So, the piece of software exists and the modification is about two lines of code and maybe something like less than 10 characters to change in the code.

So if the government handed you a piece of paper and said "Read this into the microphone", you'd consider that not to be restricting your freedom of speech because you didn't have to actually create the message yourself?

This Apple software is written a certain way for reasons specific to the desired functionality. Just like you might choose specific words to get across your specific point, and might not agree to choose alternate words which make an entirely different point.

Re:Missing the point

[Anonymous Coward]

"By doing that, Congress could make the US the country with software no other country will trust, destroying our ability to compete internationally."

Sorry chumps, that has already happened. I will never trust US technology or software again. Period. You guys are fucked.

Re:Missing the point

[AchilleTalon]

How is it different from a lock on a door? If the tenant receives a court order to open the lock, he will do. It seems the point that evades you is there is a court order. It is not just the police is asking anyone without a warrant or even better, a court order, to open the lock.

Re:Missing the point

[AchilleTalon]

Nonsense. Compiling code is not a creative activity, the code exists from the source and by the source. Everyone knows the source code is everything.

Re:Missing the point

[AchilleTalon]

And all by court order or warrants. Where is the problem? It is not like they unlock any iPhone without any reason and authorization by a judge or a court.

Re:Missing the point

[kybred]

And once this special iOS is developed, the next request could be in an NSL.

Re:Missing the point

[Anonymous Coward]

Perhaps they can compel Ford to make an "ideal" police car. Or Nike to make "improved" super sleuth shoes.

I don't mind if they do this by submitting a RFP and paying willing parties, but if you forced manufacturers into making items they didn't want to make, it seems there would be a major risk in day-to-day operations of having the FBI show up with a list of demands.

Re:Missing the point

[JesseMcDonald]

How is it different from a lock on a door?

It isn't.

If the tenant receives a court order to open the lock, he will do.

Only to avoid the expense of replacing the door. The warrant gives the police the authority to break in; it's up to them to find the means to do so. The warrant imposes no obligation on the owner, much less any third party (like Apple), beyond staying out of the officers' way while they conduct their search.

Re:Missing the point

[Anonymous Coward]

> I wouldn't object if the NSA had required Apple to sign a software update created by the NSA for the purpose of hacking into the phone. In fact, I think that's what the government should do.

If wingnut Republicans can claim Religious/Ethical exception to providing contraception, so can Apple / I.T. engineers. SCOTUS said so, n`est pas.

If a corporation is an individual, vis-a-vis SCOTUS` Citizens United, therefore a corporation also has religious / ethical / moral right to refuse, `cause it goes against their religion, c`est bien? King Fucker Chicken

Re:Missing the point

[Anonymous Coward]

The whole "Apple is being forced to work" meme seems to me to miss the point by a mile. In all kinds of legal proceedings, people who aren't themselves accused of any wrongdoing can be "forced" to assist the authorities with their investigation. Even if you refuse to talk to police, you can still be subpoenaed and forced to testify in court.

Re:Torn -- Damage done by the terrorists...

[neurocutie]

"This couple purposely and specifically destroyed their phones and computers before going on their rampage. Do you really thing they left incriminating evidence on the guys's work phone?"

Its interesting to consider that by leaving their iphone in the situation they did, this terrorist couple may end up doing far more damage to US society than their shooting spree...

Apple

[wulfmans]

I have disliked Apple since i used apple IIs as test beds in test engineering. Apple pascal was an abortion and it only got worse from there. Apple hardware is real nice but the company was never going to get my support till it stopped being so tight fisted with their hardware. That being said I applaud Apple for fighting the proper fight. Today's smart phones have so much in them that I would consider them a brain extension. Do you want the government to have access to your brain? No I thought not. Cheers to apple.

I hope they're not hosting iOS repo in the U.S.

[Anonymous Coward]

They'd better be working on this entirely from outside of the country, otherwise I wouldn't put it past the various U.S. agencies to try and sabotage this next release somehow, either via hacking legal asshattery, or both.

Re:I hope they're not hosting iOS repo in the U.S.

[sethstorm]

That won't stop the US.

Apple only wants to protect celebrities.

[sethstorm]

The only reason they really go this far is to protect celebrities, not normal people.

(For this, I'm thankful to have an Android phone)

Re:Apple only wants to protect celebrities.

[watermark]

I'm not sure why you're glad you have an Android. I've seen zero evidence that Android's encryption is more secure, but I have seen much to the contrary. (I've always owned Androids and never owned an iPhone).

Larger issue: Computer science needs to change

[VikingNation]

It would be nice if this issue would generate additional discussion and action to fix the failure of technology companies as a whole for delivering secure products. It is clear that computer science departments in the United States have failed. It is also clear that many companies are failing. Computer scientists should have a mandatory requirement to take a class in cryptography. Students need to learn concepts about securing communications, data on devices, and creating solutions to authenticate users and commands passed to software. They should also be required to take a senior level elective on ethics and be made to study case studies on the impact to society and economies due to poor design and implementation of software systems.

There have been several stories on Slashdot about the total failure of IoT devices. Reading about the failures in design of the software solution made me think that 'software hacks' made the systems and not professionals. There is a lot of energy and passion being spent by technical folks on both sides of the Apple and FBI/DoJ issue. I for one would love folks on Slashdot who are in product development to turn this passion into improving security of products as a whole at their companies.

The fastest way to make Apple's life a PITA

[sethstorm]

Then Apple is one San Bernadino event away from being on the wrong side of things.

Re:The fastest way to make Apple's life a PITA

[Maxo-Texas]

No it's not.

If we can sacrifice 30,000 lives a year to protect our freedom from government tyranny with guns, we can sure as heck sacrifice a dozen lives to protect ourselves from government tyranny.

And the guns don't even stand a chance against government weaponry any more*. At least the privacy actually works.

* Put a person with any gun against an apache helicopter that can put fourteen 30mm shells center of mass while the person is in soft cover under trees. From 12,000 feet away.

** Breaking peoples' privacy is much less public and much more dangerous to our way of life.

Re: Apple Is Said To Be Working etc. etc.

[Anonymous Coward]

If Tim Cook cannot produce an iPhone that he cannot hack, would that constitute proof that he is not omnipotent?

I wonder

[Black Parrot]

how much of this is just an attempt by the FBI to convince everybody that they don't already have a quantum computer that will break anything?

Re:I wonder

[Bongo]

that's just a cover for the fact that they have a time machine which they used to go back and watch the guy type in his code, which they then used to read all his stuff, and then turn off the iCloud backups

Re:I wonder

[Bob the Super Hamste]

None of it. Just because quantum computers, and quantum annealers may seem like magic with some problems doesn't meant they are. Breaking AES256 with a quantum computer still takes something close to the energy output of the sun over its entire lifetime (a couple of orders of magnitude) running on an ideal quantum computer, or the same energy required to crack AES128 on an ideal classical computer. It isn't like they are trying to crack RSA or a number of other public key algorithms (things based on the following problems discrete logarithm, integer factorization, elliptic curve discrete logarithm) have solutions that are trivial for quantum computers. Instead they are stuck with a symmetric key crypto that while quantum computers offer an impressive speedup it is still an ocean boiling difficult problem.

There is *NO* back door ...

[perpenso]

If the lack of security--due to government mandated back doors--allows for state sponsored persecution of innocents, enemy state or NGO attacks, etc.

There is no back door. There is only Apple digitally signing a modified version of iOS. That's it, just like with every patch for iOS that goes over the wire.

What the FBI needs is for a modified version of iOS that skips the delays between passcode entry attempts and destroying the encryption key currently used if there are too many failed passcode attempts. Apple could add code that limits this version of iOS from running on any other iPhone. Apple's digital signature would prevent the FBI from using this version on any other phone, exactly the same way the FBI can not hack around and change iOS themselves today. Apple could unlock this phone without giving the FBI a tool that could be used on any other phone.

The real problem is that the government's claim that this is a one time event is bogus. I don't see why any judge on any case could not order similar technical assistance from Apple.

As for this supposed unhackable phone. All it would require is that the passcode delays and encryption key destruction after too many failed passcodes be moved into the hardware and not be in iOS where it is "patchable".

Re:There is *NO* back door ...

[MachineShedFred]

Nobody ever claimed the iPhone 5C was "unhackable" - to wit, that is exactly what this argument is about. It is hackable, and the FBI want to compel Apple to do it.

Digital signature can prevent widespread use

[perpenso]

The only "vulnerability" is this case is that Apple potentially has the ability to push new firmware onto this model of iPhone (the 5c) using its own signed certificate, even if the phone is locked. The FBI wants this new firmware to do two things: (1) bypass the "10 wrong tries on the unlock code and the iPhone erases itself" routine and (2) reduce the time interval between unlock code entries.

Note that Apple can introduce code to this modified firmware/iOS so that it only runs on this one particular phone. The FBI would be no more able to remove this restriction than they can remove the current passcode delay. Apple's digital signature can prevent this code from being used on any device.

Also note that making the firmware unpatchable in unlikely. More likely is that the passcode entry delay, and maybe the encryption key destruction after too many failures, would be moved into the hardware, permanently embedded into the silicon. Unpatchable.

Re:Digital signature can prevent widespread use

[Anonymous Coward]

Unless the FBI can modify the "ID" of a iPhone. Then the special iOS would work on any iPhone in FBI possession.

Re:Digital signature can prevent widespread use

[Anonymous Coward]

Apple could indeed produce a firmware for this phone only this time and suppose that they do that. Do you honestly believe that will be the last time the FBI or the government asks? Apple would not want to have to reproduce the code every time the government came knocking so they would have to build a tool(s) to create special builds for the government made-to-order and then use them to provide data dumps to the government. So it doesn't really matter how many times Apple has to do this and that's their point: that the request is necessarily (a) iterative and (b) requires Apple to build, operate, maintain tools and provide special services to select customers. Apple could do this, but they really don't want to for a lot of reasons, not the least of which would be the hassle and annoyance of fielding a never ending stream of requests from police agencies and governments everywhere. Moreover, doing this even once effectively destroys security on the iPhone which is the argument that Tim Cook makes and why he suggests that such tools are simply too dangerous to create. The government is free to try and create these tools, but Apple has made it pretty clear that they aren't going to help, at least for the time being. Personally, I hope Apple doesn't give in. There are other ways to catch terrorists besides ruining security for everyone.

Re:Digital signature can prevent widespread use

[Anonymous Coward]

Unless the FBI can modify the "ID" of a iPhone. Then the special iOS would work on any iPhone in FBI possession.

I think that ID is also burned into the silicon, into a processor, unpatchable.

Re:Digital signature can prevent widespread use

[Maxo-Texas]

Note, the FBI chose this particular case to push publicly but they have 10 other phones not owned by terrorists that they also want Apple to break.

They've had lots of phones of criminals but chose not to push this until they had a good "test case".

The answer to them is no. Hell no.

Re:Digital signature can prevent widespread use

[Anonymous Coward]

Do you honestly believe that will be the last time the FBI or the government asks?

Absolutely not. That is the real problem, not getting Apple to sign a file. I see no reason why any other judge presiding over any other case could not also order Apple to provide technical assistance. Maybe at best there is some excessive burden argument that could protect Apple from low level BS like a divorce case where cheating is suspected.

Also there is the possibility that this case is not the precedent the FBI might hope for. My understanding is that the murderer is not the owner of the phone, rather his employer is and his employer has given permission to the FBI to search the phone.

Apple would not want to have to reproduce the code every time the government came knocking ...

That is not strictly true. The FBI has the technical ability to modify an iOS binary. They only need Apple to digitally sign their file(s).

Moreover, doing this even once effectively destroys security on the iPhone which is the argument that Tim Cook makes and why he suggests that such tools are simply too dangerous to create.

No, that is untrue in the case where Apple modifies iOS and adds the phone ID specific code. Also keep in mind that Apple has already admitted that they have helped law enforcement gain access to iPhones many dozens of times in the past.

Re:Digital signature can prevent widespread use

[perpenso]

Keep in mind that this case may be unique in that the murderer may not be the owner of the phone. His employer may be the actual owner and his employer may have given the FBI permission to search the phone.

Re:Digital signature can prevent widespread use

[serviscope_minor]

More likely is that the passcode entry delay, and maybe the encryption key destruction after too many failures, would be moved into the hardware, permanently embedded into the silicon. Unpatchable

That's what I'd do. Imagine the storage is protected by AES-256. You need a chip which has the following proeprties:

1. Can store 256 bits of an AES key.
2. Can store a few bits of a pin.
3. Can store a few bits of the number of tries.

I think you could make one with COTS parts tomorrow, though Apple could of course get it done fully custom. Going COTS, take a PIC12F675. That has flash, EEPROM and some GPIO. First implement an SPI bus ver GPIO for communication.

You can then implement a communication protocol where you provide a PIN and it replies with either success (and the key) or failure. Naturally on failure, it increments the "number of tries" counter and on success it clears it. If the counter gets too high, then rease they key. You could even provide a function to simply overwrite the key for unbricking purposes. A bit of care would be required to make there be no power supply differences for success and fauliure. After that's done, blow all the fuses so the debugging interface can't be used to inspect the memory, and the thing can't be reflashed. That way key management is delegated to some dedicated hardware which cannot be updated, and is so simple there is no need to update it.

I wouldn't claim it's 100% secure, but it would probably take very significant effort per-phone to crack and there would be no generic software only backdoors.

That's how I'd do it for a low volume system. Given Apple have custom system processors, that could all be built in to the main chip and the security device ROM could be set at manufacturing time.

Your passcode removes all the fancy protection

[perpenso]

What is more: the current line of products with their "secure enclave" chip and so, are already supposedly unbreakable by Apple themselves. So is this an admission that Apple can actually break into the current iPhone 6 line? Or do I miss something here?

More secure in the sense of defeating the encryption since part of the key is embedded in silicon and "unreadable"? Which is something quite different from your passcode which is normally all that prevents one's data from being decrypted by all this fancy hardware. Unless the passcode retry delay is burned into silicon, part of a processor, it would seem to be software that is patchable. If so the only thing the FBI needs is for Apple to digitally sign a tampered iOS or firmware.

On a positive note if Apple provides the modified firmware/iOS then they could make this modification only run on the one iPhone in question. Their digital signature would prevent the FBI from altering this code, just as the FBI is prevented from altering any of the current code.

The real problem is that if one court can compel Apple to do this than any court on any case can likewise compel them. Any claim that this is a one time thing seems false, in what way is any court so limited?

Re:Your passcode removes all the fancy protection

[wvmarle]

What is more: the current line of products with their "secure enclave" chip and so, are already supposedly unbreakable by Apple themselves. So is this an admission that Apple can actually break into the current iPhone 6 line? Or do I miss something here?

More secure in the sense of defeating the encryption since part of the key is embedded in silicon and "unreadable"? Which is something quite different from your passcode which is normally all that prevents one's data from being decrypted by all this fancy hardware. Unless the passcode retry delay is burned into silicon, part of a processor, it would seem to be software that is patchable.

Based on the various comments here, it appears that this is exactly the case. As in, the secure enclave is a separate computer that has its own software where the delays and the limits are enforced - and this software should be a write-once system (by e.g. destroying the hardware connections that allow for this write).

Re:Your passcode removes all the fancy protection

[Anonymous Coward]

Unless the passcode retry delay is burned into silicon, part of a processor, it would seem to be software that is patchable

That is part of what the secure enclave chip does. It's a separate computer so the delay persists even if you restart the phone.

The only reason the FBI should be able to request what they are is that it's an iPhone 5 and that chip is only in the 6.

Not going to RTA

[Trax3001BBS]

This is called flaunting.

No wait ...

[Anonymous Coward]

we forgot to turn it on.

No chip is secure in the light of a synchrotron.

[dsmatthews9379]

Apple can never create a secure phone unless it completely destroys itself the moment it leaves your hand.

Same as the ITunes DRM cat-and-mouse game

[wherrera]

Remember back in the Jobs days when Apple sold music with digital rights (mis)management? Back then, they would re-update iTunes to re-encrypt every time the music player's encryption dll was (re)cracked.

So now it's a new decade, but same old same old cat-and-mouse game, except that:

This time it's Apple doing the cat and mouse game with its own people :).

Re:Same as the ITunes DRM cat-and-mouse game

[david_thornley]

Remember that Jobs publicly announced that he didn't want the DRM, and removed it as soon as he could?

Hmm

[Anonymous Coward]

Don't get too excited, folks. It's unlikely that such a device will ever be released. The governments will make sure that it will be banned, as are drugs or explosives. If current laws don't allow this, then they will be changed. And Apple knows this very well. They are making this news only as a tool in their negotiations with the FBI and DOJ.

Steve Jobs...

[antdude]

If he was still alive today, I wonder what say and do about this privacy issue.

Re:Steve Jobs...

[zioncat]

From June 2010: Steve Jobs on privacy

It's worth noting that Apple was the longest hold out from PRISM and joined them only after Jobs passed away.

Re:Should be more concerned about controlling guns

[sg_oneill]

apple do not make guns.

Although if they did, they'd be amazing looking

and only shoot rubber bullets

Oh wait ...

[thoughtspace]

the power was off.

Apple, the new mark of terrorists.

[sethstorm]

So you're only willing to sacrifice someone else, most likely some normal person, just to stick it to the government?

At the very least, an Apple phone is now the mark of a criminal or terrorist.

Re:Apple, the new mark of terrorists.

[Maxo-Texas]

As stated, I'm willing to sacrifice my own life to continue to have liberty for everyone.

You really think if Apple folds that bad guys won't migrate to another actually secure device?

Terrorists and criminals own clothing. Owning clothing is the mark of a terrorist or criminal.

Terrorist and criminals write down evil plans with pens and paper. Pen and paper are the mark of a terrorist or crimianl.

Terrorists and criminals eat food...

Police Work?

[Anonymous Coward]

What happened to good old-fashioned police work? When did it all go down the drain, when did people begin to even accept such a thing as lazy law enforcement that simply wants to have access to every tiny bit of a person's privacy?

Re:Torn -- Damage done by the terrorists...

[Anonymous Coward]

almost certainly, emotions aside 14 dead people is not really a concern for anyone but those directly involved. ~90 people die in traffic accidents every day

Re:No chip is secure in the light of a synchrotron

[Anonymous Coward]

>Every encryption is hackable, it might just take the 'lifetime' of few universes to do it.

There's 100% completely utterly unhackable and there's 99.99999999% when someone without the budget of top10 1st world country can't.
The later is good enough for most practical purposes.

Someone

[Anonymous Coward]

The funny thing is you know out there somewhere someone has already done it.

More friendly to ordinary end users.

[sethstorm]

Security is something that is in the control of the end users. You choose the level you want.

On the other hand, Apple only designed their security to protect celebrities and people of means.

Really, Apple Shill?

[sethstorm]

Only if you consider choice to be a problem.

Marketing Ploy

[Anonymous Coward]

Apple already has given away the backdoor but they are positioning themselves so that they look like they care about their customer privacy.

One flew over the cyberpunk's nest.

[Anonymous Coward]

Please, just stop this cyber-punk pink unicorn cloud-castle daydreaming, stop it now! Why?

- Uncle Sam can resort to the old and efficient 5$ wrech and hose method.

- Apple execs can die, in shipwrecks of their yachts, contacting unexplained illnesses, during bizarre sex acts, etc. Next round of Apple CEOs will wizen up that it is better to play golf alongside politicians in office. The political elite is ruthless, for them ritual human sacrifice is as common as boiling an egg.

- The giant called Nokia was intentionally wrecked for as little as getting US permission to buy 72 units of JASSM-158 stealth cruise missiles. Apple is now the new Nokia. There is a price, where US national security concerns or political-military interests justify wrecking Apple and replace it with Teslaphone or whatever.

Isn't this simple for a chipset maker?

[TheRealHocusLocus]

Encrypted filesystem, tiny OS kernel stored as on-chip PROM and a bit of NVRAM. Sorry, no updates to it are possible so they'd better get all the bugs out before release. Kernel has just enough to support to display a prompt and accept the PIN, set up encryption, relinquish control of screen and keyboard and trigger a real OS boot, presenting plain data to the device as if it were a disk controller or memory stick. The phone or whatever doesn't know its data is encrypted.

Let's say three strikes and you're out. First time it's used, a random salt is generated and 3 copies of the salt are written to its NVRAM, along with a hash of the PIN. The encryption key is hash(salt+PIN). Destroying all copies of the salt would render data inaccessible.

Every time a PIN is entered (attempt x=1,2,3) its hash is computed and then salt(x) is read into memory, then salt(x) is destroyed in NVRAM (zeroed). Then the hash of the PIN is checked against the stored hash.

If the PIN is bad, we move on to the next entry. salt(x) remains destroyed.

If the PIN is good, the salt held in memory is rewritten to salt(x), un-destroying it. All other salt() entries are checked to see if they match the salt stored in memory and if they don't match, they are rewritten so there are now 3 good copies. Then encryption is set up and the boot proceeds.

This using of three salt buckets and always writing to them is to protect against a brute force attack where the attacker power-cycles the chip to gain "free" attempts. But also, if you use separate "game over: you lose" code that sets out to destroy the salt, a side-channel attack may be possible where the attacker listens to chip emissions to detect it starting to run and aborts it somehow. By destroying a copy of the salt on every attempt the chip's emissions should offer little or no clue of such branching behavior.

A downside is that yes, NVRAM is being written to and will degrade over time. That's why it is good to have good escrow system in place so the government can help you recover your data. /SARC It probably wouldn't hurt if on first use the user has the option of selecting the salt rather than random generation, and a separate option (after successful PIN entry) that displays the salt. This would allow a technician to ''migrate' you onto a new chip that can access the (copied) encrypted filesystem. And the chip itself should be removable so in case of a device failure it can be moved to a new one.

Re:Isn't this simple for a chipset maker?

[TheRealHocusLocus]

Encrypted filesystem, tiny OS kernel stored as on-chip PROM

Of course I meant ROM not PROM.

To avoid distracting replies like this, head on over to my "How can we improve Slashdot?" suggestion that Slashdot implements an edit feature and show your support. Of course, "[That] discussion has been archived. No new comments can be posted." so you won't be able to show your support. Maybe send them an email or add it to your sig. I will as soon as I figure out how magnets work. If you work in the same building, pull the fire alarm to get their attention.

This was a company phone

[trout007]

Is there anything a company can do with the software in a phone they provide to make sure it isn't being used illegally?

Such a phone would have to be licensed

[Anonymous Coward]

...by the FCC. Apple is not free to flout the law. Apple has no right to be communications provider to world terror.

This fix will bring back

[wiredog]

Error 53.

Good for Apple!

[MitchDev]

More power to them!

The government does NOT have the right to do whatever it wants whenever it wants...

US Fifth Amendment

[Anonymous Coward]

The government does NOT have the right to what you know (5th Amendment).

This only applies to self-incrimination.

Read the whole thing: "... nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation."

An article explaining the logic:

* http://arstechnica.com/tech-policy/2016/02/forget-the-1st-amendment-apple-to-plead-the-5th-in-iphone-crypto-flap/

BULL S^%$

[Anonymous Coward]

With the way the internet works, it is IMPOSSIBLE to create a hack proof phone. First the auto updates, The phone has to get updates from somewhere, That somewhere is a closely guarded secret for a reason. If the hackers got a hold of that site, and spoofed it, You could in theory update the phone to whatever hack you wanted. Second there is the downloaded content every time you go on the internet, A small rookit, on a site that the user sets to allow, POOF its hacked. In some cases the user does not even need to "allow". People without a background in security should NOT be writing stories and spreading rumors about security.

Re:BULL S^%$

[jschultz410]

Yes, if attackers can successfully disseminate software that looks legitimate (e.g. - signed by Apple certificates), then that could allow them to install "keyloggers" or similar that could allow them to skirt around most any security codes. They'd just have to wait until the user enters their password again to unlock whatever secured files there are and then they could leak the contents or the password could later on be used to access the data as needed.

Still, that's a far more difficult hack than simply plugging into the phone and being able to easily brute force defeat any security there.

If you secure the data using AES-128 or AES-256 and the owner uses a decent password, then the only way to get at that data today is through some form of keylogging that subsequently captures the owner accessing their data again.

TFA is right

[Anonymous Coward]

This is Obama, pure and simple. The most anti-constitutional President ever. He studied the Constitution so he could DEFEAT IT.

Right to privacy - /me ducks

[infernalC]

The government opposing currently-undefeatable encryption is incongruous with the supposed constitutional right to privacy (which, by the way, isn't there, but the Supreme Court said it is). Consider the following excerpt from the majority opinion in Roe v. Wade:

The principal thrust of appellant's attack on the Texas statutes is that they improperly invade a right, said to be possessed by the pregnant woman, to choose to terminate her pregnancy. Appellant would discover this right in the concept of personal "liberty" embodied in the Fourteenth Amendment's Due Process Clause; or in personal, marital, familial, and sexual privacy said to be protected by the Bill of Rights or its penumbras.

The Constitution does not explicitly mention any right of privacy. [T]he Court has recognized that a right of personal privacy, or a guarantee of certain areas or zones of privacy, does exist under the Constitution. This right of privacy, whether it be founded in the Fourteenth Amendment's concept of personal liberty and restrictions upon state action, as we feel it is, or, as the District Court determined, in the Ninth Amendment's reservation of rights to the people, is broad enough to encompass a woman's decision whether or not to terminate her pregnancy. The detriment that the State would impose upon the pregnant woman by denying this choice altogether is apparent. Specific and direct harm medically diagnosable even in early pregnancy may be involved. Maternity, or additional offspring, may force upon the woman a distressful life and future. Psychological harm may be imminent. Mental and physical health may be taxed by child care. There is also the distress, for all concerned, associated with the unwanted child, and there is the problem of bringing a child into a family already unable, psychologically and otherwise, to care for it. In other cases, as in this one, the additional difficulties and continuing stigma of unwed motherhood may be involved. All these are factors the woman and her responsible physician necessarily will consider in consultation.

Apply the same reasoning, and you'd have:

The principal thrust of appellant's attack on the application of the All Writs Act is that it improperly invades a right, said to be possessed by the owner of the smartphone, to choose to erase his or her data. Appellant would discover this right in the concept of personal "liberty" embodied in the Fourteenth Amendment's Due Process Clause; or in personal, marital, familial, and sexual privacy said to be protected by the Bill of Rights or its penumbras.

The Constitution does not explicitly mention any right of privacy. [T]he Court has recognized that a right of personal privacy, or a guarantee of certain areas or zones of privacy, does exist under the Constitution. This right of privacy, whether it be founded in the Fourteenth Amendment's concept of personal liberty and restrictions upon state action, as we feel it is, or, as the District Court determined, in the Ninth Amendment's reservation of rights to the people, is broad enough to encompass a person's decision whether or not to erase data stored on his or her computing devices. The detriment that the State would impose upon the device owner by denying this choice altogether is apparent. Specific and direct harm may be involved. Data, or even the disclosure of personal contact information, may force upon the owner a distressful life and future. Psychological harm may be imminent. Mental and physical health may be taxed by the damage done to interpersonal relationships. There is also the distress, for all concerned, associated with the data, and there is the problem of removing the data, once disclosed by a third party, from a world of interconnected computing devices designed for data retention. In other cases, as in online dating service users, the additional difficulties and continuing stigma of adultery may be involved. All these are factors the device owner should consider when configuring his device.

The court has already established a precedent here that saving a life is subordinate to the right to privacy.

Oh yeah? Apple, meet my wife

[Anonymous Coward]

If she ever suspected that I was cheating, there'd be no stopping her from getting into my phone.

Mod parent up!

[GlobalEcho]

I was wondering about this...thank you for posting.

If they build it they can hack it.

[Anonymous Coward]

Fist if is made by humans it is hack-able. This has been proven time and time again.
Second if they make it and know what keys/software/code they used they can undo it or come up with some way around it.

false security

[rch7]

Apply may increase their profits by providing false sense of security, but it is just delusional to assume there is any security in your phone against governments and regimes of big countries. Everything on it can be read using zero-day exploits and you will never know it was read. Even if your phone is locked and you are dead and can't readily provide pin code to interrogator with a big wrench, he can always hire electronics engineer, connect your phone RAM and ROM and change all the bits he needs to brute-force full access. Very long unpractical passphrases may give another level of security illusion, but basically it is very old dilemma - you are trying to create security on device that is connected to all kinds of communication channels and can't be trusted at all, you have no clue what exactly is running on it at given moment of time.

Mr Timothy Donald Cook CEO Apple, Public Enemy

[Anonymous Coward]

Step 1.

Ban iPone from Federal procurement and possession by Federal agencies and employees personal iPones on Federal property.

Step 2.

FCC revokes iPones access to telecommunication codes and airways.

Step 3.

Arrest Mr. Timothy Donald Cook, CEO Apple Inc. for conspiracy, interfering with a Federal investigation, destruction of Federal property, accomplice to the murders of 14 and accomplice to terrorism, treason.

BOOK THE GOAT FUCKER Dan'O!

The cat is truly out of the bag... and running

[Anonymous Coward]

Although I disagree with Apple's stance (because you don't have the right to privacy once a warrant is issued, and that includes data in computers, labtops, and yes your phone) I see the creation of an unhackable phone to be inevitable. Strong encryption coupled with impossibly hackable hardware is coming, like it or not.

No subpoena or search warrant will allow a government to get the data, because the device will be unhackable. And although the judge can stipulate that you are out of order and are in contempt of court for not providing your password (and thus, could be imprisoned basically indefinitely on continuing counts of contempt) this would in no way help at all when faced with a dead terrorist.

It's very much like gun control after everyone has 3d printers and cad software able to print guns. You can make all the laws controlling guns you want, but if I can just print one out in my bedroom, it'll be moot.

This is probably ok. The FEDS certainly have poisoned the well of trust. We're in a post-snowden world where a large majority of people don't trust the government, and a signficant minority believe the government to be 'the enemy'.

What we need to do is fix the government and its agencies so that the damaged trust is repaired. It's a dangerous position to be in when a society doesn't trust their government. That's when civil war breaks out and democracies fall. This won't be easy or quick, and may be painful as some in the government lose their power, jobs, castles in the sand etc.

Jesus

[sacrilicious]

Apple Is Said To Be Working On an iPhone Even It Can't Hack

It's like that old rhetorical question about if Jesus is all-powerful then can He microwave a burrito so hot even He couldn't eat it?

Re:Should be more concerned about controlling guns

[Anonymous Coward]

Don't worry. They have enough folks controlling guns. They hire new folks to control phones. They will hire new folks to control what you eat tomorrow morning. They will hire new folks to monitor the cams you will be required to have up in your house.

Don't worry. Your wish is on the way.

Not

[RockDoctor]

Well that's a fucking surprise. Not.

I'll bet they're doing it with people who are not US subjects, and through a management chain which removes them from US legislation. And they've got enough financial and political muscle that they may make it stick.

Apple, the protector of celebrities.

[sethstorm]

The only reason they really go this far is to protect celebrities, not normal people.

(For this, I'm thankful to have an Android phone, which gives more options)