FBI Says It Can't Release iPhone Hacking Tool Because It Might Still Be Useful (zdnet.com)

Justice Dept. officials say that details of a hacking tool used to access a terrorist's iPhone should not be released because it may still be "useful" to federal investigators. From a report: The government is fighting a case against three news organizations, including the Associated Press, which are fighting to release details of the hacking tool that FBI agents used to unlock a passcode-protected phone used by San Bernardino shooter Syed Farook. Details of the hacking tool have remained classified, not least because the Justice Dept. believes the tool may could still be used by the FBI in similar cases. "Disclosure of this information could reasonably be expected to cause serious damage to national security as it would allow hostile entities to discover the current intelligence gathering methods used, as well as the capabilities and limitations of these methods," said David Hardy, section chief of the FBI's records management division, in a court filing released late Monday.

Comments

Duh

[Anonymous Coward]

For every phone that hasn't been updated, it'd still work.

Poor grammar

[chromaexcursion]

Not can't. They most certainly can.
WON'T

Bad grammar reduces a story's credibility.

Re:Poor grammar

[Anonymous Coward]

How's about pointing out actual poor grammar instead of some appeal to emotion:

Details of the hacking tool have remained classified, not least because the Justice Dept. believes the tool may could still be used by the FBI in similar cases.

hello_1984.m

[Kunedog]

You can run this code to see if your Apple machine is compromised by Big Brother:

#import <Cocoa/Cocoa.h>

int main(int argc, const char * argv[]) {

NSDecimalNumber *oneish =
[NSDecimalNumber decimalNumberWithString:@"1.1111111111111111111"];

NSInteger two = 3 - [oneish intValue];
NSInteger othertwo = 3 - [oneish integerValue];

NSLog(@"2 + 2 = %ld", two + othertwo);

return 0;

}

Re:hello_1984.m

[Anonymous Coward]

What's the output result??

Re:hello_1984.m

[Anonymous Coward]

It's supposed to be a joke.

It's a play on the Star Trek: Deep Space 9 episode where Commander Pikard is abducted by Romulans and subjected to mental torture. They keep telling him that two plus two equals six, but he denies this. Each time he denies it they smack him around. Then Captain Data and his star ship get there just in time and teleport Commander Pikard out, just like happens in pretty much every sticky situation in that series.

In this case 3 - 1.1111111111111111111 equals 2.99999999999999999. So if you think in terms of integers then 2.99999999999999999 becomes 2 and so 2 + 2 = 4, but in this fellow's program 2.99999999999999999 + 2.99999999999999999 = 5.888888888888888 when is rounded up to 6. So it outputs "2 + 2 = 6", and then you're supposed to laugh because it's supposed to be funny, or something like that.

Re:hello_1984.m

[Anonymous Coward]

Thanks for explaining this to me, much appreciated! Is there any C trick where you could get the 2 two's to round down like this (float to int)?:

NSLog(@"%d + %d = %ld", (int)two, (int)othertwo, two + othertwo);

2 + 2 = 6

Re:hello_1984.m

[Anonymous Coward]

Well, if I'm reading the root code-block right, it doesn't do any of the alleged joke portion.

two and othertwo are defined as integers, and each set to 2 (because the intvalue of 1.1111111111111 is 1)

The math put into the %ld section of the log record will just be 2+2, integer addition, and end up 4.

If you want to make it into the 2+2=5 joke, you need two and othertwo to be decimal values defined a bit bigger, such as 2.7. Then when you output the intvalue of the sum of two and othertwo, you get 5.

Something a bit more like:

float two=2.6;
float othertwo=2.6;
NSLog(@"%d + %d = %ld", (int)two, (int)othertwo, (int)(two + othertwo));

Re:hello_1984.m

[Anonymous Coward]

You're not talking about Chain of Command are you, because if so you got *everything* wrong. ST:TNG (not ST:DS9). Captain Picard (not Commmander Pikard). Data is a Commander. It was the Cardassians (not Romulans). And he was released, not teleported.

Ohhh, you just played us trekkies. Nevermind. You should have added that they were in the Millennium Falcon.

Re:hello_1984.m

[Anonymous Coward]

3 - 1.1111111111111111111 equals 2.99999999999999999

WAT

Re:hello_1984.m

[fuzznutz]

In this case 3 - 1.1111111111111111111 equals 2.99999999999999999.

I must be missing something. How does 3 - 1.1111111111111111111 = 2.99999999999999999? Integer math should be 2 and real math should be less than 2. I guess I just don't get the Objective C syntax as I am not an Apple guy.

Re:hello_1984.m

[Zocalo]

Give the "hello_1984.m", I rather suspect it's a play on the scene from George Orwell's "1984" where Winston gets tortured by O'Brien over the number of fingers he's holding up rather the number of lights based rip-off Trek did (it was TNG not DS9, btw).

Re:hello_1984.m

[PPH]

New math. Understand what you are doing rather than get the right answer.

Re:hello_1984.m

[Anonymous Coward]

Works better with 2.4. Rounding 2.4 is 2. 2.4 + 2.4 = 4.8, which after rounding is 5.

Re:hello_1984.m

[Anonymous Coward]

It's supposed to be a joke.

It's a play on the Star Trek: Deep Space 9 episode where Commander Pikard is abducted by Romulans and subjected to mental torture. They keep telling him that two plus two equals six, but he denies this. Each time he denies it they smack him around. Then Captain Data and his star ship get there just in time and teleport Commander Pikard out, just like happens in pretty much every sticky situation in that series.

In this case 3 - 1.1111111111111111111 equals 2.99999999999999999. So if you think in terms of integers then 2.99999999999999999 becomes 2 and so 2 + 2 = 4, but in this fellow's program 2.99999999999999999 + 2.99999999999999999 = 5.888888888888888 when is rounded up to 6. So it outputs "2 + 2 = 6", and then you're supposed to laugh because it's supposed to be funny, or something like that.

wow. Talk about bad at math. 3 - 1.1111111111111111111 does not equal 2.99999999999999999. The correct solution is 1.8888888888888888889

Re: hello_1984.m

[ModernGeek]

Casting to int generally just cuts off the digits so (int)4.8 returns 4

Re:hello_1984.m

[Anonymous Coward]

Worth to note- according to police-- every pedophile ever caught is a trekkie.

Re: hello_1984.m

[Anonymous Coward]

Also it was about how may lights he is shown, not addition.

"THERE ARE.... FOUR LIGHTS!!!"

"At the end, I really believed I could see five lights.... *sob*"

Re: hello_1984.m

[Anonymous Coward]

I like how we can joke about the FBI holding onto outdated tools. I would feel bad for them if I knew they cared about us. Holding on to a vulnerability just puts everyone at risk. Even those that can't update could still make something for Cydia users to patch the problem.

Re: hello_1984.m

[Anonymous Coward]

#include <stdio.h>
#include <math.h>
int main(int argc, char **argv) {
float a = 2.9, b = 2.9;
float c = ceil(a + b);
    printf("right? %d + %d = %d\n",(int)a,(int)b,(int)c);
    return 0;
}

The deep state says no!

[Anonymous Coward]

Support President Trump's efforts to fire as many as possible.

Re:The deep state says no!

[gweihir]

Well, he certainly has experience dismantling and shutting down large organizations. Let's see whether he can to it to a whole nation as well.

One thing is for sure

[Anonymous Coward]

I don't trust the US government any more than I trust the "bad guys". In fact, I make no distinction. They both are driven by self-interest, and neither has the slightest respect for individual rights.

Re:One thing is for sure

[Anonymous Coward]

Are you willing to take away the tools or methods needed by the government to combat the "bad guys"? There is certainly a hard limit on the government in a lot of areas but in today's environment it seems like people are willing to handicap law enforcement to such an extent that the "bad guys" can keep on doing what they do without worry. And the most worrisome attack on national security and counter intelligence agencies is the idea that the US should extend the protections of the Constitution and Bill of Rights to foreigners operating internationally or domestically. The CIA and NSA are not the only intelligence agencies in the world but you would never know that by reading all the complaints launched on them. And the government is more vulnerable to data breaches than the average citizen. All you need to do is look at all the successful attacks carried out against the government agencies over the past year. And I dare say that the government has a lot more to lose than the average citizen when it comes to having their data compromised. Why most people think the government or anyone else for that matter would be interested in "stealing" their data is a mystery. Some paranoia can be justified but most people don't do anything that would interest the government in the slightest. As long as you don't post your detailed plans to topple the government in the Cloud you should be pretty safe. I would also recommend not posting your plans to commit some type of mass atrocity against your fellow citizens. If you do feel that someone is collecting your data there are quite a few things you can do to protect yourself. Personal firewalls, multiple proxies, encryption, and avoidance of social media sites should help you sleep better at night. But if you personally do something to popup on the NSA, FBI, or CIA radar you are basically screwed.

Re:One thing is for sure

[AF_Cheddar_Head]

" And the most worrisome attack on national security and counter intelligence agencies is the idea that the US should extend the protections of the Constitution and Bill of Rights to foreigners operating internationally or domestically."

Fucking aye right we should extend these to foreigners. The bill of rights is a basic template of right that all human beings should have not just citizens. How can we be any kind of example if we say "Nope, you're French so no freedom of speech for you." or "Nope, you are here on a visa so you don't have "habeas corpus" right so we can imprison forever without redress."

Nothing in the Bill of Rights inherently limits these rights to only US citizens.

Re:One thing is for sure

[Anonymous Coward]

Are you willing to take away the tools or methods needed by the government to combat the "bad guys"?

You say that as if it's possible. On the contrary, "we" did not give them the tools, and "we" cannot take them away.

Re:One thing is for sure

[cavreader]

If the world wants protection under the Bill of Rights and Constitution they should start paying US taxes. And I think the other poster was talking about foreign intelligence operatives not the people visiting for vacation, education, or other such mundane reasons.

"Nothing in the Bill of Rights inherently limits these rights to only US citizens." Only because the idea is so ludicrous that nobody gave it a second thought.

Re:One thing is for sure

[Anonymous Coward]

Wrong, "We hold these Truths to be self-evident, that all Men are created equal, that they are endowed by their Creator with certain unalienable Rights, that among these are Life, Liberty, and the Pursuit of Happiness", While not from the constitution this line from the Declaration of Independence indicates that the founders believed that rights were universal not just for citizens of the United States.

Partij Voor de Vrijheid

[Anonymous Coward]

De enige partij die luistert naar het volk!

Stemmen voor Geert

Re:Partij Voor de Vrijheid

[Anonymous Coward]

I hope you are saying something derogatory of Islam.

Re:Partij Voor de Vrijheid

[gweihir]

No, he is advertising a pretty repulsive right-wing populist that promises the world if elected, but will deliver nothing. Kind of like Trump, but worse.

Is this part of the adult conversation

[Bob the Super Hamste]

I wonder if this is part of the "adult conversation" about encryption that FBI director James Comey mentioned last year that he was preparing to have this year. Also when ever mentioning that fucking iPhone it should also be pointed out that nothing of value was found on it. This way it becomes clear that encryption wasn't something that hampered the case in any way so they can't trot out that old saw to try and make their case against the public having access to strong encryption.

Re:Is this part of the adult conversation

[Anonymous Coward]

The fact that something happened (or didn't happen) in this particular case doesn't invalidate their point, since their point doesn't depend on finding something useful in every single instance. There may be other facts or issues that do invalidate their point, but not this one.

Re:Is this part of the adult conversation

[Anonymous Coward]

It's also of benefit to future investigations to claim the phone was of no value where suspects may have been frightened away from using their phones.

give me a break

[nimbius]

it would allow hostile entities to discover the current intelligence gathering methods used

news flash: that six months of PR Hell after the San Bernadino shooting? that was broadcast across the world. they already know damn well to avoid the iPhone.
the question is, just how long will you keep this exploit to yourself, in the hopes that nobody else knows it, only to randomly find out its been used against you.

Re:give me a break

[Kkloe]

i think they know about it and it is a risk they are willing to take, so it is not so much of a news flash

Licensed tool

[Anonymous Coward]

Although a third-party company, said to be made up of professional hackers, created the hacking tool that was used to break the passcode lock on the iPhone 5c, the company's name has not been revealed

If the FBI is the licensee of this software, then maybe they can't release it because they don't actually own the code? Also, releasing details about the tool may violate trade secrets of the company which developed it so that may be another factor preventing release.

Re:Licensed tool

[AF_Cheddar_Head]

NOPE and NOPE. This dodge is what the company that makes the "Stingray" tries. Put it into the contract that a police department cannot reveal that they use the "Stingray". Then when the judge/defending attorneys ask about methods the Police state they are contractually bound not to reveal them.

The general method can be discussed without revealing details. AKA we purchased hacking tool "X" to perform the mission, details are contractually limited. Then the judge can make a ruling as to the validity of said contract limiting discussion.

Re:Licensed tool

[Anonymous Coward]

>The general method can be discussed without revealing details

How do you know?

>Then the judge can make a ruling as to the validity of said contract limiting discussion.

But that's not what news organizations are asking for.

The federal government must be made to choose

[El Cubano]

To me, there is definitely solid reason to classify intelligence sources and methods. However, I think that we have to continue to resist the blurring of lines between foreign intelligence and law enforcement. Certainly law enforcement gathers intelligence (really, they gather information) as part of the investigative process. Our standard for evidence should allow for two possible choices on the part of the government:

• 1. The operation or activity in which the classified source/method was employed was a foreign intelligence concern. In such cases, classification should be allowed to prevent disclosure because the intelligence apparatus will undoubtedly strive to exploit it for as long as possible. This brings with it all the legal restrictions regarding employment against a US person (yes, that part of the system has problems that need to be fixed, but that is a different issue).
• 2. The operation or activity in which the source/method was employed was a law enforcement concern. In such cases, the evidence should only be legally considered admissible if the source/method was disclosed (with key exceptions for the identity of human sources; for example, their disclosure may be only to the judge hearing the case, etc.). Think of it as the evidence's chain of custody is broken without the disclosure of the source/method.

Foreign intelligence is used to make strategic, operational, and tactical military decisions as well as national policy decisions, while information gathered in the course of a law enforcement investigation could be used to support criminal prosecution.

This way the spooks and feds get to argue to higher authority (probably the AG, DNI, and National Security Council) which is more important: continued use for foreign intelligence or disclosure to support criminal prosecution. That way the decision makers get to earn their keep and everything stays on the up and up.

Re:The federal government must be made to choose

[Anonymous Coward]

So, identity of human sources, which is actually one of those things the constitution guarantees the defendant, you want to hide, but you're okay with trashing people's proprietary technology, indiscriminately disclosing security vulnerabilities, and throwing away tactics, techniques and procedures because "digital" is different and should be immune to discovery?

Let me put the same question in a different light. Say it was a hedge fund employee. Should they be able to hide evidence by encrypting it? If not, then why should some people's rights be different than others?

Re:The federal government must be made to choose

[flink]

Agree with everything you said except this:

(with key exceptions for the identity of human sources; for example, their disclosure may be only to the judge hearing the case, etc.).

This denies the defendant's right to face their accuser and prevents the defense from cross examining. There are very limited exceptions to this, such as dying declarations, but they should be few and far between, and event then the witness's identity isn't concealed.

But yeah, absolutely, if the method of acquiring evidence can't be disclosed because it is too valuable to national security or whatever, then you obviously value the method over the conviction and the evidence should be thrown out. That also serves as an incentive to keep a strict firewall between our intelligence agencies/military and domestic law enforcement.

Re:The federal government must be made to choose

[El Cubano]

(with key exceptions for the identity of human sources; for example, their disclosure may be only to the judge hearing the case, etc.).

This denies the defendant's right to face their accuser and prevents the defense from cross examining. There are very limited exceptions to this, such as dying declarations, but they should be few and far between, and event then the witness's identity isn't concealed.

Yeah, I realize I left a key piece of that. I was referring to certain human sources, something which would have to be severely limited and done with careful oversight. I was thinking of instances like people whose relationship to the case could result in their life being threatened if their identity is revealed. I know that there is witness protection, but I assume that is not the appropriate solution in every case. I was just trying to make room for the possibility. A real legal expert would need to figure this out, and I am no such person.

It's about trust

[sgrover]

If they reveal the tool, and it is revealed it is faulty/suspect in anyway, then the information they "recovered" from the phone(s) all become untrustworthy. That does not support the verse the authorities are trying to play out to the general public. So instead of being proactive and helpful, we get innuendo, and "trust me" type comments, with no hope of verification/validation by the public.

Re:It's about trust

[Bob the Super Hamste]

Well it was already disclosed that nothing of value was found on the San Bernardino iPhone so it doesn't matter at this point anyway for that case. As you point out if the tool is used in other cases and there is some juicy bit of evidence found any flaw in the tool will be used to discredit it. The longer that is put off the better chance to get convictions based off of evidence produced by the tool.

Re:It's about trust

[evolutionary]

It will probably get leaked by concern citizen, just like the rest. Of course what could be next are the tools that the CIA uses to KEEP secrets in general. That could get interesting. what is also interesting, is we don't hear about this happening in Russia or China. At least not in our mainstream news.

Re:It's about trust

[Anonymous Coward]

Not sure which is worse, your argument that they want to conceal the (weak) validity of their claims, or if we take their argument at face value, and they care more about 'catching bad guys' than protecting the public.

Both options are scary.

Re: It's about trust

[Anonymous Coward]

The evidence will get thrown out in court. You can't bring a black box in and say this box gave us all our evidence, but we can't show you how it works. The judge will throw the case out. We have these protections for a reason. So either you want convictions or this is a ruse to hide their secret hacking.

Re:It's about trust

[richardellisjr]

I don't think you understand how this works... There will never be any useful information found, or at the very least never any information that's presented as evidence. That way the government still gets the information, without ever having to disclose how.

Re:It's about trust

[Bob the Super Hamste]

Unfortunately I do understand and realize that what most likely will happen is that any evidence collected wont be used in court or will be used in parallel construction to get what they want. This year there is going to be another push from the likes of the FBI, CIA, etc. to get the laws changed on encryption just like they have been doing for the past couple of years. With the media circus that is Trump they might actually succeed in getting what they want. Here is what congress knows about encryption and while reasonably unbiased there still is the pro state slant in it. Also there is this document that came out at the end of last year that I missed that has some more details on the questions and what congress should be thinking about in regards to encryption.

Sounds like a non sequitur

[Anonymous Coward]

If it's so useful then release it so everyone can have this useful tool...

Re: Sounds like a non sequitur

[Zero__Kelvin]

That was the point. Everyone is assuming they are saying the problem is that it is still useful to them. What they really mean is that they don't want to release it because it still might be useful to others .

lets wait for wikileaks to reveal it

[JcMorin]

Maybe wikileaks will reveal it for them.

FBI / DOJ are Full of Shit as Usual

[Anonymous Coward]

Just saying.

By the way, the "department of *justice*" is not under the "judicial branch", it reports directly to the president as part of the executive ... ie: it's a police and prosecution force... not a judge. And generally speaking "justice" means exacting puritanical colonial revenge, not more enlightened evolved and advanced rational rehabilitation that has come to play in Europe and far surpassed the US.

Re:FBI / DOJ are Full of Shit as Usual

[Anonymous Coward]

Funny how you mark people who speak the truth as "troll".
The truth is always inconvenient to states, and state's apologists like you.
Which is why you and they are trying to stamp out leaks and leakers.
So you can keep your lies and secrets and power, over the truth and sunlight of the people.

Fruit of the poisoned tree

[Macdude]

If the use of the tool and the workings of the tool can't be examined in court, then any evidence provided by the tool or any evidence found because of any information provided by the tool can't be trusted in court. "Trust us" isn't good enough in a court of law.

Re:Fruit of the poisoned tree

[EmagGeek]

That's what Parallel Construction is for...

Re:Fruit of the poisoned tree

[Macdude]

That's what Parallel Construction is for...
Unfortunately you're right...

Re:Fruit of the poisoned tree

[gweihir]

And if they are caught lying under oath, nothing happens to them.

Really?!

[LifesABeach]

There's a better one on WikiLeaks.

The FBI would rather...

[TsuruchiBrian]

The FBI, et al. would rather exist in a world that is very dangerous and they alone possess the tools to (sometimes, maybe) protect us, than live in a world that is a little safer and no one has those tools. This is in the interests of the FBI and not necessarily in the interests of the society it is tasked to protect.

Fast Forward into Reverse!

[Anonymous Coward]

Do you think now that FBI agents can do it that there aren't people right now reverse engineering this??

And what have they found so far?

[Anonymous Coward]

Did they find anything of value on the phone? Given the fact that they haven't been shouting from the treetops "See we needed this capability!!!!" I'm guessing they found bupkis. Too many people, even those who actually work in law enforcement, seem to have watched too many police dramas. They think everything is some global plot and if they get some minor piece of data they can "enhance" the heck out of it and uncover said plot. Realty is much different, the damage to society from insecure devices FAR outweighs the tiny number of cases each year where it MIGHT benefit law enforcement.

What about what was recovered?

[ukoda]

Was it ever disclosed what was discovered on the phone? The whole fuss in the first place was the extreme importance of getting access to the contents of the phone. At the time I was dubious that they would find anything of any great value on the phone and therefore forcing Apple to break the security of their products was not justified. So now they have that data what value was it? Has it saved the lives of thousands or do we now know what he ate for lunch on Wednesday?

Re:What about what was recovered?

[Anonymous Coward]

It was the Wednesday lunch menu thing.

As posted by others, the phone contained nothing relevant at all. Unless the FBI wishes to claim that Wednesday's lunch menu is somehow relevant!

http://www.npr.org/2016/02/26/468216198/san-bernardino-police-chief-weighs-in-on-whether-apple-should-unlock-shooter-s-p

The value of this phone and the incident it came from was to give the FBI some kind of "moral claim" to the phone data, hoping to set precedent for all encrypted/secured phones. In other words leverage people's natural horror at the terrorist incident and hope they will overlook the obvious problems that giving the FBI access will cause.

The idea that the phone ever contained anything of value was a Hail Mary play and so profoundly unlikely.

"National Security" = We have no good reasons...

[gweihir]

... but we do not want to tell you and this way we do not have to explain ourselves.

No one saved, but plenty more lies

[Anonymous Coward]

"The innocents we're illegally using this on might obtain a patch to lock us out if we do this, so we'll pretend the other terrorists (not us) will kill your children if we do."

You know, there's probably some witty statement to be done to counter their newest "lolno" claim, but by this point I can't imagine anything resolving their abuses that does not somehow include sharp farming implements, welding torches, and incendiary tar-like gels.

Phony

[Anonymous Coward]

What sad news - not that I needed it anyways, as I'm NOT phony nor a cow

I don't get it.

[nospam007]

For the thousands of iPhones in their evidence locker it will still work and also on all the old/non-updated phones out there, publishing the tool won't change that.

But them telling us that old phones are vulnerable, might boost Apple sales.