Slashdot Mirror
FBI Couldn't Tell Apple What Hack It Used, Even If It Wanted To (qz.com)
An anonymous reader writes: The US Federal Bureau of Investigation doesn't own the technique used to unlock the San Bernardino iPhone, so it can't reveal the method to Apple even if it wanted to, Reuters reported, citing unnamed White House sources. The Washington Post reported yesterday, citing unnamed sources, that the FBI had paid a hacker a one-time fee to use a piece of hardware that allowed it to access the iPhone 5c belonging to one of the San Bernardino, California assailants. The vendor that supplied the hack is a non-US company, according to Reuters. But according to the Post report, it is not the Israeli firm Cellebrite, which had previously been named. The FBI would require the vendor's cooperation in order to submit the technique it used to Vulnerabilities Equities Process, a mechanism that allows the government to consider whether it should disclose security flaws to manufacturers. It's a move that mirrors Apple's own efforts to create security systems on its phones that even it wouldn't be able to crack, meaning it can't comply with a government order to hand over user data even if it wanted to.
... but when I do, I prefer them to be unnamed.
My Other Computer Is A Data General Nova III.
At least one of these things has to be false:
1) The FBI paid a hacker to unlock the phone and doesn't have access to the technique
2) The FBI is able to help local law enforcement unlock iPhones
Which of these is false? Assuming the FBI isn't going to foot the bill to pay a hacker each time local law enforcement wants an iPhone unlocked, these things are mutually exclusive. Which lie did the FBI tell?
And because the FBI lied, why should I have confidence in law enforcement at all? I understand that they may not want to disclose the details of an ongoing investigation, but that doesn't justify lying about things that don't have to be kept secret to preserve the integrity of the investigation.
The FBI's ever changing story is flaky to say the least. On the other hand, I don't really care.
If you want news from today, you have to come back tomorrow.
Another reason outsourcing is preferred.
On the other hand, at least they're not claiming a NDA is preventing them from saying.
Certainly someone in government could reverse engineer the code to enable re-use?
Who would be the wiser? I mean besides defendants who suddenly start seeing the contents of their phones used as evidence against them in trial.
I mean, if the company that licensed the software to the FBI tried to force the them to reveal their decryption technique, could the FBI then argue that releasing such code into the wild could result in the widespread hacking of iPhones around the planet? You know, turn the tables a bit?
IANAL, but it seems like they would have a chain-of-evidence problem here or something like that. Let's imagine, instead of a phone, that the FBI wanted to unlock a safe. So they hire a safe cracker, and he says, "I'm going to unlock the safe, but you can't watch me do it." The safe cracker goes into the room, shuts the door. After a few minutes the safe cracker walks out and says, "It's all yours," wherein the FBI finds an open safe. But now we don't know what happened. Did the safe cracker take anything from the safe? Did he put anything in the safe? The FBI doesn't know for sure.
It seems like there could be a similar problem with the phone. If you don't know how it's done, then how do you know if what you see is what was really in the phone? Did the hacker put something in the phone? Did he take anything out? If there is evidence in the phone that says, for example, that Bob Loblaw was part of the conspiracy, can you trust that information?
Basically, it sounds like the FBI hired someone to make it rain. That person lit a fire, and did a little dance, and it rained. And now the FBI is saying, "Hey, we don't know what the guy did. We're just happy that it's raining."
Proverbs 21:19
"can't comply with a government order to hand over user data even if it wanted to."
Which is unfortunately what all manufacturers/software developers should be working towards. We're seeing case after case where government orders effect the purchased and owned products of consumers, most of whom are completely innocent. Cases where people have books deleted off of their E-readers because some court order to the company that makes the reader, DVRs being remotely disabled because of a patent dispute, and cars that become surveillance tools against their owners.
...Is next in the line of FBI excuses.
The problem with not being able to disclose the technique is that legally the evidence cannot be used in court then. Since terrorists are dead, it is not much of a legal ramification to them; however, against anyone else, a prosecution team must provide the technique/technician to a defense team for cross examination. That was one of the objections that Apple had in their brief: If the FBI forced them to assist them, Apple would have to constantly provide their personnel for court cases to testify. In the case of a forensics company that does DNA testing, that is part of the service that they should provide. An unknown "hacker" may not agree to be part of future investigations.
Well, there's spam egg sausage and spam, that's not got much spam in it.
Plausible deniability for your own crimes.
How's that go for everyone else, these days? Oh right, waterboarding.
Maybe the contents of the phone contained NO helpful information pertaining to the investigation - and perhaps the FBI doesn't want to admit that they jumped created this huge FUSS and it provided no distinctive investigative advantage over not having access to the data on the phone.
yeah, that's it. works every time.
How can the FBI ever hope to use data recovered in Court, if they cannot prove chain of custody since they let a 3rd party use "secret sauce" to get the data.
A lawyer could get any data recovered tossed out of court quicker than your mother can unbutton her overalls.
Unless of course you think that the government is undemocratic, corrupt and repressive. Let's face it, the government tries to suppress dissent and marginalizes those not in power.
Perhaps Apple could get a court order forcing the FBI to expend resources to figure out how to get the information it claims it can't access. That would be reasonable, right?
"Grab them by the pussy" -- President of the United States of America
That can't be true. If they found data that led them to a conspirator, they would want to arrest that person. They would need to have evidence to present in that person's trial that they participated in this terrorist event. I can't imagine that their plan is that if the defendant's attorney asks them how they got this data, they'll just say "some un-named third party pulled this data out of their own hardware and assured us their hardware had copied it from this mobile phone." I'm calling bullshit on that one.
Doesn't the DMCA have some anti-circumvention measures in there? While the FBI may be immune to that sort of thing, I'm pretty sure that circumventing encryption for profit is not exempt, aside from being a criminal offence. Despite the fact that the phone belonged to an alleged criminal, afaik it is still illegal for a private individual to hack into it.
the above is my personal opinion and does not necessarily reflect that of the little voices in my head
But But But .... Global Warming Deniers need to be prosecuted!
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
Now Apple has no alternative but to finally get serious about finally spending all the money they hold in the reserves properly.
They will be forced to spend a shitload on a bunch of security teams to hack their own software, find loopholes and vulnerabilities, and fix that shit up.
Apple is the 3rd worst vendor in terms of security on CVE listings. Hopefully, this will fix them up. Given the recent months of really bad news in regard to the
field of cyber security, lack of experts and proper education and effort in it, hopefully Apple will finally invest its riches properly, and everyone will benefit from a surge of programming talent oriented at security and exploits.
Most Federal laws are not Mens Rea anymore; they are mostly Strict Liability. Add to this the fact that the Federal Government doesn't even know how many laws there are, and you get a situation where your ignorance of the law is a given and no excuse, and you don't even have to know what you were doing was wrong. Looks pretty bad for you doesn't it? But add to this situation the fact that the prosecutor/DA has total immunity for his actions and can get a grand jury to indict a ham sandwitch, and you've very likely broken three laws today without knowing it.
So what have we learned? You can't "stop breaking the law" and be safe. Your safety is purely due to the fact that no one in power in the Criminal Justice system has decided they want to prosecute you. As soon as they do, they'll go and look through all the records they've gathered about you, break into your phone, and find the laws you've broken and arrest you. You know they have a greater than 98% conviction rate, so you'll likely plea to something so you don't go to prison for the rest of your life.
Welcome to Soviet Amerika!
Was it worth all this commotion? Will they stop future terrorist attacks from the information retrieved?
Why is this not the question everyone is asking??
It is pitch black. You are likely to be eaten by a grue.
If a witness reports a crime/event to the police they can't claim they can't tell anyone who the witness was because they don't 'own the information'...they may not be able to disclose the details of any equipment used (but even THAT is a spurious claim) but nobody 'owns a bug' other than Apple. I call it a 'bug' because it is clearly not a behaviour that Apple intended the phone to have as such I'm sure they'd like to fix it. The FBI has a responsibility to tell them. This is absolutely no different than someone telling the FBI about a manufacturing defect in a safe, the FBI would have a responsibility to tell the manufacturer about it. In fact if they don't tell them & a safe is broken in to because of it I'd claim they were legally negligent/responsible.
"I saw someone kill someone but I can't tell you who it was or how they did it because I don't own the information"...that's a bullshit piece of logic if I ever saw one...no stretching of logic can make this a reasonable statement. This is exactly the type of behaviour by government/law enforcement that promotes citizens to ignore/bend the law themselves...'heck if the government can get away with it so can I'...thankfully the majority of citizens don't think that way but some do & more will as law enforcement insists on 'bending the rules just a little more'...
it seems like they would have a chain-of-evidence problem here
There is no problem, because the terrorist is dead. They are not prosecuting him, thus there is no defense team nit-picking their tactics.
Can you answer a question for me?
Suppose rooting around on the phone they find evidence of someone helping them plan and execute their crimes. Suppose the evidence doesn't directly indicate culpability, but strongly implies it.
Can that be used as evidence against such a 3rd party conspirator?
Would chain-of-evidence be broken, and could that be used as a defence in court?
I posted relevant portions of the law last week, if you care to read the details. There are two sections that are mainly relevant.
First, DMCA explicitly says that circumvention by or FOR the government is legal. So you can hack it if the government asks you to.
Secondly, and this is important to my job developing security testing tools, DMCA says twice that it is legal to create tools to research on the security of the measures as long as those tools aren't used, or intended to be used, for copyright infringement as specified in DMCA.
So it's a lot like gun laws in areas that have Constitutional gun laws - using a gun to commit a felony is an additional crime, but just having a gun is legal. Similarly, building a circumvention tool FOR THE PURPOSE of copyright violation is unlawful, but building it for research, security, and investigation purposes is fine.
by going around the protective mechanisms?
So FBI hired someone they consider a criminal and ignored the crime.
She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
I love how US taxpayer dollars go to support this organization created by and ran for homosexuals
Perhaps some "clerical errors" in processing all that money we send to Israel to help them murder innocent women and children in Palestine. Perhaps then the vendor would be willing to cooperate with the preservation of human rights, if only just a little?
We all know Israel has the worst human rights record IN THE WORLD, but perhaps if you gut the little money grubbers off from the teat, they'll come around enough.
Supposedly, the exploit works on the 5c, but wouldn't work on the 6. It should not be that hard for Apple to check the design history to see what holes they plugged between those designs.
Angleyne: You can't bend that girder - it's unbendable! Bender: Well I don't know anything about lifting, so that ju
Like most of us they will do what the courts tell them to, and unlike high level government officials lying to Congress, the courts tend to take a dim view of that when someone is caught doing it on the witness stand. That is one reason they are so anal about keeping Stingray and evidence laundering (aka parallel reconstruction) out of the eyes of the courts.
Did they get anything useful off of the phone?
Also, they could find out how it was done if they want to, forcing the company to divulge it, much like they (attempt) to force everyone else.
Contact geniushack08'at'gmail'dot'com to hijack emails,school grades,social networks,mobile phones and phone calls,web servers and database,credit cards,bank accounts,text messages,criminal records,etc