FBI Director Says Unlocking Method Won't Work On Newer iPhones (cnn.com)

Even though the FBI was able to gain access to the San Bernardino terrorist's iPhone without Apple's help, the Apple-FBI saga continues. It was reported yesterday the FBI is telling members of Congress of the methods used to break into the iPhone 5c. The most recent tidbit comes from FBI Director James Comey in regard to how many iPhones are at risk from the unlock tool.

An anonymous reader quotes a report from CNN: FBI Director James Comey said Wednesday that the government had purchased "a tool" from a private party in order to unlock the iPhone used by one of the San Bernardino shooters. "Litigation between the government and Apple over the San Bernardino phone has ended, because the government has purchased, from a private party, a way to get into that phone, 5c, running iOS 9," Comey said. The FBI director also said the purchased tool worked only on a "narrow slice of phones" that does not include the newest Apple models, or the 5s.

Comments

WE PROMISE

[axewolf]

You know we would never lie to you....

You KNOW that

Re:WE PROMISE

[diesalesmandie]

You know we would never lie to you....

You KNOW that

Its been said numerous times that the iphone 5c is less secure than the more recent models, they could be telling the truth. Sounds more like they are setting themselves up to have another legal battle against apple. The US government cant even protect their own data yet they want direct access to private communications of US citizens. To me that just says they just want more control.

Re:WE PROMISE

[mobby_6kl]

Yeah this is just exactly what they want us to think.

Re:WE PROMISE

[Plumpaquatsch]

You know we would never lie to you....

You KNOW that

What's your point? That the FBI couldn't unlock the phone? Or that you believe the FBI as long as you like what they claim?

Re:WE PROMISE

[macs4all]

You know we would never lie to you....

You KNOW that

Its been said numerous times that the iphone 5c is less secure than the more recent models, they could be telling the truth. Sounds more like they are setting themselves up to have another legal battle against apple. The US government cant even protect their own data yet they want direct access to private communications of US citizens. To me that just says they just want more control.

So basically, they're saying is that if the device has Apple's Secure Enclave chip, then their hacking tool won't work. Night surprised.

Re:WE PROMISE

[0111 1110]

I believe the point would be that you'd have to be a total moron to believe anything the FBI says. Anything. In this case these fascist fucks may have just realized that they have shut down a major information channel by showing the whole world that the iPhone encryption is ineffective. Who is going to use it now for any sort of private communication? Someone may have finally realized how dumb it was to advertise their ability to do this to the whole world. So they're backpedaling a bit now.

motivations..

[Anonymous Coward]

"The people we bought this from, I know a fair amount about them, and I have a high degree of confidence that they are very good at protecting it, and their motivations align with ours," he said.

So their motivations are the systematic destruction of Americans' civil rights?

Re:motivations..

[NatasRevol]

they are very good at protecting it

Just like the FBI. Who have never been hacked. Well, except for that year of exposure that was just reported.

Re:motivations..

[gweihir]

That is how it goes in a police-state. Are you really surprised? The US population is giving them no actual resistance, so expect full-blown fascism in the not too distant future.

Anti Circumvention Laws

[Layzej]

FBI Director James Comey said Wednesday that the government had purchased "a tool" from a private party in order to unlock the iPhone

I wonder how that squares with 17 U.S.C. Sec. 1201 of the DMCA which prohibits the distribution of tools that enable a user to circumvent access controls.

Re:Anti Circumvention Laws

[NicBenjamin]

The way the law applies to the government is completely different then the way it applies to you because the government has Powers and you have Rights. In this case they are proceeding as part of a lawful investigation. That means they are using their capital-P-Power of "Search," and the only laws that restricts their use of that power are the ones governing that power. So Fourth Amendment, a bunch of case law, some statutes that explicitly deal with law enforcement, etc. unless there's some clause of the DMCA that says "and this means that search warrants can't circumvent encryption" you're barking up the wrong tree.

And if you read the actual law everybody's safe. It explicitly does not apply to law enforcement. It does not apply to reverse engineering, encryption research, or security testing.

Re:Anti Circumvention Laws

[gweihir]

The law does not apply to the Feds, or haven't you heard? Standard operating procedure in a police-state.

Was he under oath?

[mi]

If he was not under oath, he could lie easily. If he was, however, then he probably was telling the truth — lawmen tend to take that sort of thing seriously.

But he was quite explicit about continuing to search for other methods... The man is doing his job, I would not be jeering the way you do.

Re: Was he under oath?

[TheReaperD]

He's doing part of his job. The parts of his job he is conveniently ignoring is upholding the Constitution and the civil liberties of US citizens.

Re: Was he under oath?

[mi]

The parts of his job he is conveniently ignoring is upholding the Constitution and the civil liberties of US citizens.

Dunno, what you are talking about. FBI's mission does not contain those things you listed:

Our Mission

As an intelligence-driven and a threat-focused national security organization with both intelligence and law enforcement responsibilities, the mission of the FBI is to protect and defend the United States against terrorist and foreign intelligence threats, to uphold and enforce the criminal laws of the United States, and to provide leadership and criminal justice services to federal, state, municipal, and international agencies and partners.

Re: Was he under oath?

[fnj]

You left out some vital stuff.

Their avowed core values:

Rigorous obedience to the Constitution of the United States;
Respect for the dignity of all those we protect;
Compassion;
Fairness;
Uncompromising personal integrity and institutional integrity;
Accountability by accepting responsibility for our actions and decisions and the consequences of our actions and decisions;
Leadership, both personal and professional; and
Diversity.

Only the last of those is gag-worthy.

Their solemnly sworn oath:

I [name] do solemnly swear (or affirm) that I will support and defend the Constitution of the United States against all enemies, foreign and domestic; that I will bear true faith and allegiance to the same; that I take this obligation freely, without any mental reservation or purpose of evasion; and that I will well and faithfully discharge the duties of the office on which I am about to enter. So help me God.

Re: Was he under oath?

[mi]

Yeah, sad... The actual iPhone case did not violate anybody's Constitutional rights, of course, but there are other questionable cases, so I shan't quibble.

But what if, seriously, doing one's job requires departing from this oath?

Don't say, it can't happen — it can. For example, you are chasing a guy, who just robbed a bank, and he gets into a car which speed of. The last thing you see him is, he pulls out a cell phone and starts dialing.

You can't catch him, but you can ask the nearby Stingray to intercept the call. Will you violate his 4th Amendment rights, or will you let him escape?

Re: Was he under oath?

[KingBozo]

Well the iPhone case didn't violate the San Bernardino persons rights, since it was the employers phone and the employer gave consent to search the phone. It may/may not have violated Apples rights under the constitution, but since they pulled the case it has not been ruled upon.

Second If you use a Stingray to intercept the call you would not be violating the robbers 4th Amendment rights, since there is probably cause. What you would be doing in violating everyone one else's rights who's cell phone connects to the Stingray and their data is captured, this is where the constitution comes into play with being secure in ones papers. Although a cell phone is not paper and could be ruled differently depending on the courts, but I would consider it as violating everyone else's rights.

IANAL.

Re:Was he under oath?

[RoknrolZombie]

Why do you assume that lawmen take their oaths seriously? Or why would you assume that this one is?

If there is no barrier to you lying on the stand (other than your ethics) then there are even fewer barriers for the FBI.

Re: Was he under oath?

[Ralph Wiggam]

We have a Judicial Branch that enforces that.

Re:Was he under oath?

[nbauman]

If he was not under oath, he could lie easily. If he was, however, then he probably was telling the truth — lawmen tend to take that sort of thing seriously.

But he was quite explicit about continuing to search for other methods... The man is doing his job, I would not be jeering the way you do.

Half true. I heard of lawyers who were disbarred for lying under oath, and as a result lawyers take it seriously.

However, prosecutors do lie all the time, and get away with it. It's a rare judge who calls them to account for it.

http://www.slate.com/articles/...
For Shame
The criminal justice system encourages prosecutors to get guilty verdicts by any means necessary—and to stand by even the most questionable convictions. Can one crusading court stop the lying and cheating?
By Lara Bazelon
Slate
April 7 2016

Cops, on the other hand, lie routinely, and almost always get away with it, even when they get caught on video. It happens in New York City all the time.

There was a demonstration against the Iraq war, where among their many violations of the Bill of Rights, the pigsxxxcops indiscriminately arrested people who were on the steps of the New York Public Library, demonstrators and uninvolved bystanders alike, and charged them with assaulting an officer.

Assaulting an officer is a felony, and if they insisted on defending themselves in court, they would have to pay thousands of dollars in legal fees, and would have been likely to get a felony conviction and a jail term, since juries usually believe pigsxxxxcops over defendants. So the prosecutor forces them to plead guilty to a misdemeanor that they never committed.

This time, there were videos, including the pigs' own videos, as well as the videos taken by bystanders, which clearly showed that the defendants weren't assaulting an officer, but instead were assaulted by the pigs without justification. I think they may have sued the city for false arrest. But I know that none of the pigs were charged with perjury. I once heard a city official on the radio explaining why they didn't. He said cops sign affadavits under oath all the time that they had seen a crime when they really didn't. In other words, the "everybody does it" defense. They basically admitted that cops routinely lie. One good thing that came out of it is that those cops can never appear on the witness stand themselves, because the dense lawyer can always bring up their false statements under oath in the past.

Re: Was he under oath?

[mi]

Second If you use a Stingray to intercept the call you would not be violating the robbers 4th Amendment rights, since there is probably cause.

The probable cause may help you get a warrant from a judge — but you still need a warrant. One fairly high court has already said so...

What you would be doing in violating everyone one else's rights who's cell phone connects to the Stingray and their data is captured

Maybe, but I doubt it. But, suppose it is a violation — would you rather the robber escaped?

Re: Was he under oath?

[andymadigan]

Here's a question, if a warrant were required to use a Stingray (it is, in some places) and if the Stringray intercepts everyone's calls, shouldn't the warrant have to cover all of the phones that would be affected? And if that's the case, how could you possibly justify searching the communications of someone you know isn't a suspect?

Imagine if the police said they wanted a copy of every bank statement issued by Bank of America in the last ten years, because they had evidence that the proceeds of a robbery had moved through that bank. Now imagine they wouldn't tell you how long the irrelevant information would be kept or what they would do with it. Of course, in reality, the police don't tell judges that they're using a Stringray, and they certainly don't tell them what extraneous information they'll pick up. They also don't obtain a warrant, but they do get a court order. I wonder if there's even a prohibition against the police department selling the information they collect to a third party.

Unless there are very strict rules about what the police can use the information they captured for and how long they can keep that information, yes, I'd rather let the robber get away. It's only money.

Re:Was he under oath?

[Shoten]

If he was not under oath, he could lie easily. If he was, however, then he probably was telling the truth — lawmen tend to take that sort of thing seriously.

But he was quite explicit about continuing to search for other methods... The man is doing his job, I would not be jeering the way you do.

Half true. I heard of lawyers who were disbarred for lying under oath, and as a result lawyers take it seriously.

However, prosecutors do lie all the time, and get away with it. It's a rare judge who calls them to account for it.

http://www.slate.com/articles/...
For Shame
The criminal justice system encourages prosecutors to get guilty verdicts by any means necessary—and to stand by even the most questionable convictions. Can one crusading court stop the lying and cheating?
By Lara Bazelon
Slate
April 7 2016

Cops, on the other hand, lie routinely, and almost always get away with it, even when they get caught on video. It happens in New York City all the time.

There was a demonstration against the Iraq war, where among their many violations of the Bill of Rights, the pigsxxxcops indiscriminately arrested people who were on the steps of the New York Public Library, demonstrators and uninvolved bystanders alike, and charged them with assaulting an officer.

Assaulting an officer is a felony, and if they insisted on defending themselves in court, they would have to pay thousands of dollars in legal fees, and would have been likely to get a felony conviction and a jail term, since juries usually believe pigsxxxxcops over defendants. So the prosecutor forces them to plead guilty to a misdemeanor that they never committed.

This time, there were videos, including the pigs' own videos, as well as the videos taken by bystanders, which clearly showed that the defendants weren't assaulting an officer, but instead were assaulted by the pigs without justification. I think they may have sued the city for false arrest. But I know that none of the pigs were charged with perjury. I once heard a city official on the radio explaining why they didn't. He said cops sign affadavits under oath all the time that they had seen a crime when they really didn't. In other words, the "everybody does it" defense. They basically admitted that cops routinely lie. One good thing that came out of it is that those cops can never appear on the witness stand themselves, because the dense lawyer can always bring up their false statements under oath in the past.

I think you're getting something mixed up. When trying a case, lawyers are not under oath; in fact, they're never under oath in that capacity. They aren't testifying...in fact, except in very rare circumstances (and even then, against standard advice and professional guidance) they aren't even parties to the criminal or civil matter being discussed and thus they *couldn't* testify because they have no direct knowledge of the case. Everything they know is what was told to them by someone who is a direct party.

I'm not a fan of the way the criminal justice system tries every dirty trick in the book to go after people. But let's focus on the problems that actually do exist, rather than making up ones that don't.

Re: Was he under oath?

[Impy the Impiuos Imp]

It is implicit for all government employees that they not deliberately violate constitutional rights.

Re:Was he under oath?

[nbauman]

This may require a lawyer to straighten it out, but a lawyer friend of mine (in New York State) told me that everything a lawyer says in court or submits to a court is considered to be under oath. A lawyer doesn't have to get his statements notarized, they're, in effect, already notarized. The signature at the end of the documents often says, "I hereby swear or affirm that the statements in the above document are true."

Lawyers would also be committing something like perjury if they knowingly allowed a defendant or witness to lie in court. This is a rule that defense lawyers follow, especially low-paid legal aid lawyers. That's why lawyers often say, "I don't want to know whether or not you committed the crime." This is a rule that prosecutors often ignore, and get away with.

This is what Lara Bazelon wrote in the Slate article:

Vinegrad then called his colleague, Deputy District Attorney Robert Spira, who was in charge of prosecuting Melendez. Under oath, Spira told the jury that Melendez had agreed to plead guilty to voluntary manslaughter in exchange for Spira recommending a 14-year prison sentence. Spira was emphatic, however, that this deal was based solely on Melendez's decision to inform on his co-defendant in the Gomez murder. Melendez's testimony against Baca, Spira told the jury, had no bearing on the stateâ(TM)s leniency, which was substantial. Melendez's initial murder charges carried the possibility of a life sentence.

Several months before Baca's trial, Spira had made the same representation to Melendez's sentencing judge, H. Dennis Myers. The judge was incredulous that Melendez would testify against Baca simply out of the goodness of his heart, thinking, in Myers' words, "Well, heck, I will go up and testify in another murder case and just--I don't expect anything from them." Melendez's attorney chimed in, telling Myers that his client had in fact been "led to believe there would be a reward at the end of the rainbow...."

Although Melendez and Spira had perjured themselves, the judges found that their false testimony did not prejudice the outcome of the trial.

If you read the cases of The Innocence Project, where people were exonerated mostly with DNA evidence, you'll see that one of the most common reasons for false conviction is false testimony by a jailhouse snitch. Very often a prosecutor is forced to commit perjury in the process. I don't think a prosecutor has ever been punished for that.

And as Bazelon explains, the Republicans passed federal laws to make it difficult or impossible for federal courts to review state appeals court rulings, even when they are obviously wrong and outrageous, which is often.

A private party?

[CRCulver]

FBI Director James Comey said Wednesday that the government had purchased "a tool" from a private party...

I'm sure that John McAfee has already spent all the money on bath salts.

Re:A private party?

[OzPeter]

I'm sure that John McAfee has already spent all the money on bath salts.

And hookers, don't forget the hookers

Re:A private party?

[Ralph Wiggam]

Was it confirmed that the FBI bought it from an Israeli company?

this tool doesn't

[turkeydance]

the other one will.

From sources ...

[Are You Kidding]

it has been revealed that the method used will only work on a narrow slice of other phones for which the terrorists write the pass code on a slip of paper they hide at the bottom of their underwear drawer.

It is allowed by (e) and (j)

[raymorris]

It is not a violation to test the security, if you don't then use the results of the test to infringe copyright:

(2) Permissible acts of security testing. â" Notwithstanding the provisions of subsection (a)(1)(A), it is not a violation of that subsection for a person to engage in an act of security testing ...

It is also not illegal if done by or for the government:
(e) Law Enforcement, Intelligence, and Other Government Activities. â" This section does not prohibit any lawfully authorized investigative, protective, information security, or intelligence activity of an officer, agent, or employee of the United States, a State, or a political subdivision of a State, or a person acting pursuant to a contract with the United States ...

Re:It is allowed by (e) and (j)

[sl149q]

It is not illegal for the government to do it.

But it is prima facie illegal for the third party to develop the tool unless they where hired specificallyto create the tool by the FBI. I.e. specifically it would be illegal for them to create it, but not illegal for the FBI to use it.

Not sure why the FBI bothered to pay for it. They could have just arrested said third party and to verify that the tool was illegal tried it out on certain phones. That is a win-win situation for sure!

Re:It is allowed by (e) and (j)

[SvnLyrBrto]

If the rumors (I think they're still just rumors at this point anyway.) about who provided the tool are true though, the "third party" is a company operating out of Israel. So the DMCA would not apply to the tool developers. Nice and neat little way for the FBI to circumvent any applicable US laws, courts, and due process, that. And certainly not a channel they'd close down by enforcing any laws that they couldn't enforce anyway, or getting the Israeli government to enforce whatever anti-piracy laws they might have there.

Re:It is allowed by (e) and (j)

[fred911]

In addition, the market isn't regulated by the US government. The world provides plenty of sellers and providers of high quality services and products located outside of US. Additionally, the FBI stated they were receiving help from Cellebrite http://www.cellebrite.com/Abou... , and Israeli company.

  This is no mystery. It's not the first time this company had been the first to market with these type solutions.

Re:It is allowed by (e) and (j)

[Altus]

The company that built the tool was not located in the US.

That's why I quoted (j) for you

[raymorris]

That's where (j) comes into play. That says it's NOT illegal to examine the security and build tools to break IF you don't then either use or market the tool for copyright violation under the act.

It ends up being like (Constitutional) gun law - using a gun in the commission of a felony is a separate crime, but having a gun is lawful if you don't use it for another crime. Similarly, building a hack tool intended for copyright infringement is illegal, but the tool is not illegal if there's no infringement, actual or intended.

Ps - whenever I post what the law is, people get mad at me, arguing that shouldn't be the law. I didn't write the law, I just read it.

Re:That's why I quoted (j) for you

[sconeu]

Except they sold it to the FBI. Therefore it's marketed.

Pps: I write hack tools for a living, so I pay att

[raymorris]

Ps, at work my team is Vulnerability Assessment > Tools. My official job title is Vulnerability Assessment Engineer. Basically, I write hack tools for a living, so the law on the subject is a tad important for me. This is something I pay attention to.

On the other hand, it's illegal for me to possess slim jims REGARDLESS of intent, since the locksmith licensing laws changed where I live. I should have taken advantage of the grace period after the law was enacted to get my locksmith license.

Re:XKDC "wrench decryption".

[Plumpaquatsch]

Still unlocks ALL phones.

Didn't work on the phone in question. See, you gotta keep people alive to use that technique, "shoot first, then ask questions" has been proven to not give many useful answers.

Not for the purpose of copyright of infringement

[raymorris]

It was marketed for investigative use. The law says it's illegal marketed for the purpose of unlawful copyright infringement.

So what... but what was in the famous phone.

[niftymitch]

So what... but what was in the famous phone #1.

I'm looking for some honest value equation that invasion of
data privacy is a universal good thing.

Citizens in other countries are incarcerated and locked up
for things we take for granted.

These products are international.

Nothing protects us from one time pads and text messages.
s;akls fsf lasfasf jljljl = __________ ?

Re:XKDC "wrench decryption".

[gweihir]

As they are not actually after answers, but at scaring everybody into thinking all secrets are open to them, that is fine. This whole thing is really a coordinated effort to establish the most effective chilling effects they can. Nothing works better than people self-censoring what they think and for many people their phones are now an extension of their minds. It used to be an all-seeing, all-knowing "God", but as that has lost its effectiveness, they are now trying (and succeeding) to establish a technological surrogate.

Re:Achievement *UNLOCKED*: You are now an IDIOT!

[Dan Ost]

Is that true of the new iPhones that have dedicated hardware for holding the encryption key?

How it played out

[Shoten]

When asked if the hack would work on the newest versions of iPhones, which use a feature called "secure enclave," Comey shook his head "no," and his wooden nose swept everything off of his desk and onto the floor.

Re:Pps: I write hack tools for a living, so I pay

[edtice1559]

Where do you live? What did they change in the locksmithing laws? I was actually considering getting my license. I thought it was relatively easy. Take your class, pay your fee. What is the new requirement that makes it hard?

Another scary thing he said recently

[Anonymous Coward]

Here's something else he said the other day, quoted in Thursday's Columbus Dispatch: “I can imagine a world, maybe, where a local police department, in a case they can’t otherwise solve, can send us a device, with the understanding that we’re never going to testify, we’re never going to tell you how we opened it, so you’re never going to able to use what’s on the phone as evidence, but it might be a lead to something that would be useful,” he said.

To me, his casual assumption that all local police departments will routinely do parallel construction based on secret FBI information is scarier than whether they know some secret iPhone backdoor. Chain of evidence goes out the door, because terrorism.

From no license to 648 hours of school in Texas

[raymorris]

When I did locksmith work in Texas, no license was required. Several years ago they passed a licensing law. To be fully licensed to work on your own, you need 648 hours of school plus 1(?) year apprenticeship, or two years apprenticeship and I think just the 48 hours of classroom. There was a grandfather provision in the licensing law saying anyone who had already been working as a locksmith could get a license without the new training requirement. I somewhat wish I had done that, just so I could legally carry my picks and auto entry tools, even though I haven't worked as a locksmith in a long time.

The same office regulates private investigators, locksmiths, people installing security systems, and some others. There is some overlap between these fields, so any of the licenses will, in practice, allow you to do work somewhat in the other fields. To investigate a crime, you need your private investigator license, and computer hacking is a crime. Therefore, a computer security person checking out a hacked computer is supposed to be a licensed PI. Setting up security for a computer network? That's a security system, and you're supposed to be licensed. I was licensed as a private investigator, allowed to work for a licensed company, and I may go proceed with that to have my own licensed company at some point.

 

Re:From no license to 648 hours of school in Texas

[edtice1559]

Thank you for the thorough reply.

ONE QUESTION

[TheCarp]

Very simple.... WHEN was the EXACT MOMENT when the FBI KNEW that this was an option?

Was there ANY time AT ALL where the legal case with apple was going on and they knew they had an out? Because it looks to me like the FBI tried to get the court to agree to things by withholding information. Seems to me, if this is the case, the FBI has attempted to defraud the courts and use the courts to overstep their authority through unecessary actions.

Seems to be....people at the FBI should be facing prosecution.

Re:Idiot slashtards

[TheReaperD]

The only reason the courts were involved this round was because the DOJ and FBI were hoping you use them to beat Apple into submission when they refused to cooperate "off the books" after "patriotism," rewards and coercion failed.