Documents Prove Local Cops Have Bought Cheap iPhone Cracking Tech (vice.com)

GrayShift is a new company that promises to unlock even iPhones running the latest version of iOS for a relatively cheap price. From a report: In a sign of how hacking technology often trickles down from more well-funded federal agencies to local bodies, at least one regional police department has already signed up for GrayShift's services, according to documents and emails obtained by Motherboard. As Forbes reported on Monday, GrayShift is an American company which appears to be run by an ex-Apple security engineer and others who have long held contracts with intelligence agencies. In its marketing materials, GrayShift offers a tool called GrayKey, an offline version of which costs $30,000 and comes with an unlimited number of uses. For $15,000, customers can instead buy the online version, which grants 300 iPhones unlocks.

This is what the Indiana State Police bought, judging by a purchase order obtained by Motherboard. The document, dated February 21, is for one GrayKey unit costing $500, and a "GrayKey annual license -- online -- 300 uses," for $14,500. The order, and an accompanying request for quotation, indicate the unlocking service was intended for Indiana State Police's cybercrime department. A quotation document emblazoned with GrayShift's logo shows the company gave Indiana State Police a $500 dollar discount for their first year of the service. Importantly, according to the marketing material cited by Forbes, GrayKey can unlock iPhones running modern versions of Apple's mobile operating system, such as iOS 10 and 11, as well as the most up to date Apple hardware, like the iPhone 8 and X.

Comments

FBI feigning incompetence?

[VeryFluffyBunny]

So now that the cat's officially out of the bag, are all these calls for backdoors and special access by the FBI simply PR? I wonder how many years they've sat on this, without telling anyone, and without helping law enforcement solve crimes? It would seem that the FBI has lost sight of its primary objective, i.e. public safety.

Re:FBI feigning incompetence?

[Anonymous Coward]

I guess FBI just wanted a free, 1st party cracking solution. That's what they were crying about. Law enforcement went ahead after payment of a non official solution.

Re:FBI feigning incompetence?

[Anonymous Coward]

>are all these calls for backdoors and special access by the FBI simply PR?

Maybe the FBI is just trying to save the taxpayers some money? In 1994, CALEA was passed and mandated that telecommunication devices include technology to allow for lawful interception of network communications. The FBI is now lobbying for a similar law to be passed to mandate that mobile communications device industry create a security framework that allows law enforcement to access locked and encrypted devices. So instead have to purchase costly encryption breaking services from third parties (which may sell to other, even hostile, organizations both public and private), law enforcement could simply do it themselves with requisite legal permission to do so.

Re:FBI feigning incompetence?

[Anonymous Coward]

It was suspected from the beginning that the very public FBI vs apple fight may have been a false flag stunt. Never confirmed though, as far as I'm aware. Of course it's also possible the exploit in TFA is a recent development and they weren't aware of it until now.

That's all beside the point though. The question now is "how long until I can grab the cracked exploit kit from some chinese .onion site, and can it be patched easily?" It's inevitably going to happen.

Re:FBI feigning incompetence?

[plover]

The FBI is mostly whining because they want on-line real-time undetectable wiretapping. Cracking open a locked phone is no different than gaining a warrant and taking the phone in the first place - the suspect is aware that his phone has been taken (or is dead), and it usually happens only after a serious crime has been committed and the suspect has been identified. I have no problem with police using tools to examine evidence after a crime has been committed.

But demanding flawed cryptographic algorithms, on the other hand, permit drift-net trawling of everyone's phones. Did you text someone about the weapon or the assassination plot? These crimes can now be thwarted before the victims are injured -- look, our pre-crime unit saves lives! But the drift-nets don't discriminate, and gather information about misdemeanor or non-criminal activity, too: small drug sales, shoplifting, or in the case of the Cheetohead-in-charge, researching climate change, donating to Hillary, or badmouthing Putin.

If anything, the current administration is so corrupt that the FBI themselves should be putting on the brakes, saying "no, we don't even want the tools to exist since you're just going to use them to ask us to further violate the Constitution for you."

Re:FBI feigning incompetence?

[Anonymous Coward]

The FBI went through the proper procedures when it requested and received a search warrant so they could access the phone of a dead terrorist. The terrorist didn't even own the phone and the owners gave the FBI permission to unlock the phone in question. Apple refused the court order saying that it was an expensive insurmountable technical challenge requiring Apple to use to many resources. Apple's refusal was a marketing campaign aimed at making consumers think their iPhones were secure and that Apple would never aid any law enforcement agency to intrude on the users privacy.

A few days later the FBI proved went with a 3rd party solution and in the process made Apple look like a bunch of opportunistic bullshit artists.

Re:FBI feigning incompetence?

[omnichad]

Except if Apple knew about the backdoor, they probably would have patched it by now. The FBI likely knew of the third party utility all along but just wanted to make security seem unpatriotic.

Re: FBI feigning incompetence?

[Anonymous Coward]

The court order to unlock was based on a lie by the FBI. You can't compel someone to assist if LE can do it on their own.

Re:FBI feigning incompetence?

[Anonymous Coward]

But demanding flawed cryptographic algorithms, on the other hand, permit drift-net trawling of everyone's phones

Cats out of the bag; they've already got a shunt in the tubes.

Re:FBI feigning incompetence?

[Bing Tsher E]

Or it was a marketing stunt by Apple. Their loud and bellicose refusal was definitely used for vigorous marketing.

Re:FBI feigning incompetence?

[Anonymous Coward]

> Cracking open a locked phone is no different than gaining a warrant

Oh you sweet summer child. No cop is going to bother going through the legal means when nobody supervises the use of the tool.

Re:FBI feigning incompetence?

[AHuxley]

Yes they are. The tech exists for different generations down to the city and state funded federal task forces.
The only trick is to keep the tech message out that its all NSA, GCHQ complex for every new generation of big brand product.
The its safe for criminals and police under internal affairs investigations to keep testing their communications and GPS devices.

Re:FBI feigning incompetence?

[plover]

No cop is going to bother going through the legal means when nobody supervises the use of the tool.

The nice thing is that the cops are buying license packages, so there is a supervisor - the company licensing the tool is counting every phone decrypted. Once the cops open 300 phones, they have to pony up for the next batch of phones. This means they're limited by money: they won't open a phone unless there's a reasonable expectation that it'll pay off. That will significantly slow down the "let's snoop on every phone" approach.

Re:FBI feigning incompetence?

[Mal-2]

If they go over 300 phones, they have to buy a second batch. If they exceed 600, they'll spring for an unlimited package and the incremental cost of cracking a phone will go away. Or, they'll throw in with their county or nearby cities and operate out of a single unlimited account. $30,000 a year is not a large amount for a police force. That's less than two cars (they pay about $20k a car) and quite a bit less than the cost of one employee for that same year.

The only reason for buying the smaller package is that they don't see a need for more than 300 uses in the next 12 months -- this time.

Thel hell?

[DontBeAMoran]

Documents prove local cops have bought cheap iPhone cracking technology.

That's a totally irresponsible waste of the taxpayers money! I cracked mine THREE TIMES already without even trying! Just drop it on a concrete floor!

Re:Thel hell?

[Anonymous Coward]

That's a totally irresponsible waste of the taxpayers money! I cracked mine THREE TIMES already without even trying! Just drop it on a concrete floor!

That makes buying flimsy Apple gear irresponsible waste of YOUR money then.

Re:Thel hell?

[ELCouz]

I really like your name...in a sarcastic way... like your jokes.

Sue their arse

[mysidia]

GrayShift is an American company which appears to be run by an ex-Apple security engineer and others who have long held contracts with intelligence agencies.

Seriously? That ex-security-engineer must be violating like 20 different agreements that Apple makes their employees that build their products sign, and here's hoping to see Apple press the charges for industrial espionage, get that ex-engineer in jail for 25 years and sue him for every $$ he and his company's worth.

Taking innate knowledge and all the trade secrets you learned about your employer's product AND then using that to go to work creating or working for a company whose purpose is to subvert that product is almost as severe a breach of IP a product engineer can commit....

Re:Sue their arse

[Anonymous Coward]

Unless it's Apple's way of circumventing the public outcry they'd be suffering under if it was found out they don't actually believe in security for their users the way they've been saying. Seriously, my very first thought reading that sentence is, "Ah, Apple found a way to give the government what they wanted without getting blamed for it directly."

Re:Sue their arse

[pnutjam]

We'll see how quick apple is to patch this. It definitely shouldn't be out of their reach.

Re:Sue their arse

[Anonymous Coward]

>Taking innate knowledge

That word doesn't mean what you think it means.

Re:Sue their arse

[ShanghaiBill]

That ex-security-engineer must be violating like 20 different agreements that Apple makes their employees that build their products sign

Many of those agreements are very difficult to enforce under California law.

almost as severe a breach of IP a product engineer can commit....

He is using knowledge that Apple willingly gave him to create a product that does not compete with any Apple product. It is questionable if he is breaking any law, much less one that can be enforced.

Re:Sue their arse

[Anonymous Coward]

And if they DON'T patch it, and they DON'T go after their ex-employee for the damage they did to the security of their systems, then you can just take it to assume that Apply is complicit with their ex-employee and the government at undermining the safety and security of their customer's information.

Re: Sue their arse

[Anonymous Coward]

Yes

Re: Sue their arse

[Anonymous Coward]

With companies the size of Apple a lot would depend on his actual position, not all security experts are the same, and if he didn't have any information that was critical it's likely Apple won't care, seeing they haven't challenged him at this point I would guess the majority of what he brings is more in title.

Access control circumvention should be illegal

[Anonymous Coward]

if the DMCA doesn't outlaw this, it should be revamped to cover this

outrageous

Re:Access control circumvention should be illegal

[Bing Tsher E]

The DMCA does not apply to law enforcement operations.

Re: Access control circumvention should be illegal

[Anonymous Coward]

The ex apple engineers company is not a law enforcement agency. Your move, nacho libre

Re:The Fourth Amendment

[Anonymous Coward]

I own 6 guns that the government knows nothing about. They're going to get a pretty rude shock if they try to break down my door.

Greykey is probably a criminal company

[Anonymous Coward]

If people keep their own copyrighted photos on their phones, then you're definitely circumventing access controls to copyrighted works when you crack a phone. Therefore, DMCA is an extremely relevant law with regard to Greykey.

DMCA has exceptions for law enforcement, so if you're a cop then you're allowed to crack the DRM on peoples' photos. Here's that part:

This section does not prohibit any lawfully authorized investigative, protective, information security, or intelligence activity of an officer, agent, or employee of the United States, a State, or a political subdivision of a State, or a person acting pursuant to a contract with the United States, a State, or a political subdivision of a State. For purposes of this subsection, the term âoeinformation securityâ means activities carried out in order to identify and address the vulnerabilities of a government computer, computer system, or computer network.

This means that if Greykey is contracted by the cops, they're also allowed to circumvent the DRM. Ass is covered, similarly to what that Israeli service is rumored to do (where AFAIK they crack the DRM rather than provide a tool for the cops to do it themselves).

The problem, though, is before the cracking: if they have a software product that they sell to cops, were they under contract when they developed it? If they weren't, then they defintely violated the law when they "manufacture[d] a technology, product, service, device, component, or part thereof" for circumvention.

Furthermore, unless the cops contracted them to advertise their services, they might have been violating DMCA when they "import [or] offer to the public" that software product. I find it hard to believe that someone in government contracted them to sell the product to others in government. Maybe the FBI paid them to sell their software to local police, but we might as well make them show that in court, because I think the public would be fascinated to see that contract. Congress would like to see that contract too.

But the manufacturing violation is less iffy. They'll almost certainly get busted by a judge, if you can get 'em to the judge.

Someone (anyone who has an iPhone and has used the camera) should sue them, so that we can get a judge to decide this stuff.

Re:Greykey is probably a criminal company

[Anonymous Coward]

We should arrest their principals and see where it leads. Follow the money, as they say. This is definitely illegal and needs to be shut down.

Re:Greykey is probably a criminal company

[q4Fry]

We should arrest their principals and see where it leads. Follow the money, as they say. This is definitely illegal and needs to be shut down.

Who is this "we?" Do you think the LEOs in Georgia (where Forbes says Greyshift was founded) are going to be all gung-ho to take out the purveyors of their newest trick? You could try a citizen's arrest, but your chances of success are slim. The chances you are then targeted with a civil suit are not.

Re:Greykey is probably a criminal company

[Anonymous Coward]

when the police do it, it ain't illegal!

different set of rules apply for the "good guys"

case in point, a trucker with several million bucks was recently caught due to a broken tail light! eschelon in action. create back story, nab bad guy!

this is only one of the cases under review for illegal spying on muricans! will it amount to anything? No, cuz the good guys did it! laws don't apply to the feds, silly boy!

Re:Greykey is probably a criminal company

[Aighearach]

Mostly good, but your mistake is with the word "for" in the construct, "for circumvention."

Courts don't play word games, they're way stricter in how they use words than that. "For" in that case doesn't stick to any word you put next to it; it sticks to what they actually did. So it doesn't matter if you can describe their conduct as circumvention. You don't just then get to substitute the word circumvention instead of what they did.

If they were manufacturing it to sell to law enforcement, or to use on behalf of law enforcement, then it was manufactured for law enforcement purposes. Courts are strict about how they use words, and word games are also sometimes strict in how they use words, but that doesn't imply that a Court is going to listen to word games.

Also, if the statute says that law enforcement can do it, and you're claiming that somewhere else it says you actually can't help them do it because they used the word "circumvention" without modifiers, that's just not winnable. If you convince the Court that there is a conflict in the phrasing they don't say "you win," they look for a way to read it that is actually consistent and works. And here that is obvious; the exception applies to situations that legitimately involve law enforcement. So if you win the word game, you didn't win anything, the ruling would still be the same. You'd have to find some other reasonable, workable thing that Congress might have meant when they passed it, that if true would change the analysis. But this doesn't even make motions in that direction; it is obvious what Congress intended: Cops can do this, others can only do it if they're helping cops.

The case where the Court would even listen to your argument about the timing of the contracts is if the government arrested you and charged you with making a circumvention tool, and you were saying, "I was only going to sell it to cops, I promise!" And having a contract with cops is only one way you might defend yourself. If you haven't sold it to anybody yet, then just having a spreadsheet showing sales to cops would be enough for you to win, absent other evidence of your intent.

You did link to part of the DMCA, but only to make your post appear as if you had a clue. You didn't actually read it. If you did, you'd have seen that it doesn't just say "no manufacture," it goes on:

(2) No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that—
(A) is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a work protected under this title;
(B) has only limited commercially significant purpose or use other than to circumvent a technological measure that effectively controls access to a work protected under this title; or
(C) is marketed by that person or another acting in concert with that person with that person’s knowledge for use in circumventing a technological measure that effectively controls access to a work protected under this title.

So actually, if you're usually selling it to cops but once in awhile you accidentally sell it to a criminal you might still be fine under this section. But clearly if you're manufacturing it with the intent of selling it to the government, you're golden; you don't even need to lean on the law enforcement exception, because the primary purpose of the tech is to access a physical device connected to a criminal investigation, not a copyrighted work. It doesn't matter if the safe might contain a painting, that doesn't make picking the lock into a copyright issue.

If your lawyer tried to raise these arguments, you'd not only lose, your lawyer would risk getting disbarred.

Re:Greykey is probably a criminal company

[Anonymous Coward]

Courts don't play word games, they're way stricter in how they use words than that. "For" in that case doesn't stick to any word you put next to it; it sticks to what they actually did. So it doesn't matter if you can describe their conduct as circumvention. You don't just then get to substitute the word circumvention instead of what they did.

I don't think I need to substitiute. Circumventing the DRM is what the cops did. What the cops did with the software was legal (because it's exempted) but what they did was definitely circumvention according to the the definition in DMCA.

If they were manufacturing it to sell to law enforcement, or to use on behalf of law enforcement, then it was manufactured for law enforcement purposes.

GreyShift better hope they can persuade a judge of that.

But clearly if you're manufacturing it with the intent of selling it to the government, you're golden; you don't even need to lean on the law enforcement exception, because the primary purpose of the tech is to access a physical device connected to a criminal investigation, not a copyrighted work.

(WTF? "The primary purpose of my bullet was to scare him, not blow his brains out.")

The manufacturer knows that almost every single time the tech is used, it's going to circumvent DRM. It has probably never been used without circumventing DRM. The manufacturer knows that the cops intend to circumvent DRM, and usually will circumvent DRM. The cops want to circumvent the DRM because they're hoping the various copyrighted photos and writings will be of use in investigating a crime. That's why we legalized cops circumventing the DRM.

Looking at them in the best light, the manufacturer is hoping that all their users do it legally. But the tech is primarily intended to circumvent DRM; that's what makes it useful. If it didn't circumvent the DRM, the cops wouldn't want it.

GreyShift is making something that will usually be illegal to use. And it's probably illegal for them to make it, unless they have an exemption legalizing them, too.

That said, I'm starting to think you're unfamiliar with DMCA case law, because this one is a doozy:

The case where the Court would even listen to your argument about the timing of the contracts is if the government arrested you and charged you with making a circumvention tool, and you were saying, "I was only going to sell it to cops, I promise!" And having a contract with cops is only one way you might defend yourself. If you haven't sold it to anybody yet, then just having a spreadsheet showing sales to cops would be enough for you to win, absent other evidence of your intent.

All intents are explicitly illegal unless exempted. You later make a comparison to lockpicking, and I think that's a mistake. The analogy sounds fine, but the laws are very different. In most countries/states it's not illegal to manufacture lockpicks. In most places it's not illegal to possess lockpicks either, unless there's criminal intent. DMCA was written differently than lockpicking laws, in that the intent of the user is irrelevant to the manufacturer. This aspect is one of the things that so enraged everyone. It got brought up in the MPAA-vs-2600 case and [I fucking swear; I'm trying to find the transcript] Judge Kaplan literally said "That's what Congress wrote."

I wonder if maybe you are used to less draconian laws. You really have read it, right? And you've also seen that user's intent is always ruled irrelevant when manufacturers are charged, right? There's a reason people hate DMCA while also being quite mellow about lockpicking laws, and B&E laws, etc. DMCA is very special.

Re: Greykey is probably a criminal company

[Anonymous Coward]

I usually only save this for Reddit, but God damn #REKT

And if the tool is so cheap?

[OzPeter]

I have previously heard cracking techniques described as "security vulnerabilities". Given the ludicrously cheap price of this GreyTool and the huge amount of cash in Apple's bank accounts if I was Apple I would be buying a copy (via assorted shell companies) and seeing how they work and then rolling the countermeasures back into their products. Doing so would be a great way to get cheap security research done for you.

Alternatively Apple could show that the product doesn't work as advertised, or provide advice on how to mitigate its functionality by updating their "security best practices" document (that I am sure they have somewhere)

 

Re:And if the tool is so cheap?

[Anonymous Coward]

Why?
Apple already got your money.

And lets not pretend you won't be buying the new iphone.

Doing anything doesn't make apple anymore money. They're not going to do it.

Re: And if the tool is so cheap?

[Anonymous Coward]

Itâ(TM)s probably so cheap because the shelf life is expected to be quite short. If the cost was $1M, they would probably sell two or three copies. At $15k, many police departments will all pay for a copy right away.

Apple fixes the problem and the product is mooted (until the next version, probably), bit nobody is suing for a million bucks. The police depts figure âoehey, we got into 10 phones with this, so it only cost us $1500 per phone. Better than paying Celebrite $1M a pop.â

It will be interesting to see how this plays-out.

Smartphones value:risk ratio doesn't jive

[Seven Spirals]

The risk of being surveilled, robbed, and redirected is too high. You want maps? Learn to fucking read one. You want chat, do that after you park your fucking car. Anyone who cares about freedom or privacy shouldn't own a smartphone. I use a phone that doesn't have have a TCP/IP stack and all it can do is text and call. Even that is too much since the phone company can and does track your position. Fuck a smartphone. I don't care what convenient features it has. I'm glad all these children have smartphones though. It means they will never be any threat to my job. Nobody who grows up addicted to one will learn to code or be any good with real computing. The smartphone fucking ruins their little mind before it ever had a chance. Too bad there isn't a job for Angry Birds or Weechat champions, eh kids?

Re:Smartphones value:risk ratio doesn't jive

[pnutjam]

I prefer a tcp/ip stack. It's too tempting and all but assures any attack vectors will use it.

I understand it much better then whatever communication stack is inside a dumb cell phone. As you said, they can still track your location, log your messages, phone calls, and metadata.

Re:Smartphones value:risk ratio doesn't jive

[Anonymous Coward]

You forgot.

GET OFF MY LAWN

Re:Smartphones value:risk ratio doesn't jive

[Anonymous Coward]

...Says the guy who volunteers for an electronic tether at his own expense.

OK, "Tether-Boi".

Re:Smartphones value:risk ratio doesn't jive

[Aighearach]

Maybe I'm just not as Appy as you, but my mobile device has maps that I downloaded and control.

It is probably because I'm educated enough to read a map that I know the difference between reading a map on an app I control, and reading a map on an app somebody else controls.

If you don't know what freedom is or which decisions it comes from, instead of throwing away your phone maybe just stop pretending you care about freedom?

Re:Smartphones value:risk ratio doesn't jive

[Bing Tsher E]

I'm glad all these children have smartphones though. It means they will never be any threat to my job. Nobody who grows up addicted to one will learn to code or be any good with real computing.

But when you and your generation are old and ready to retire, the world will fall into a shambles.

Re:The Fourth Amendment

[taustin]

They need possession of the phone. Which still requires the same probably cause or warrant it always has. This is no different than calling in a locksmith open a wall safe.

Yawn.

Re:We don't need to weaken encryption

[Anonymous Coward]

IF it is asking for your key, than it is not a valid warrant.

Nazi sympathizers ...

[Anonymous Coward]

So, I don't want to Godwin this entire thread, but quite honestly I view companies which do this as little better than Nazi Sympathizers.

They don't care about the potential harm they do, they don't treat this on a case by case basis -- they're just providing a carte blanche tool to police.

And, like all such people, I'm sure they're fairly indiscriminate about selling to the nastier countries with terrible track records on human rights.

I bet there is little to no judicial oversight in how these tools are being used, because the police don't care for such things.

Sorry, but making and selling tools like this should make you a target. You clearly don't give a damn about the finer details of when this is used and the impact to people's lives .. so why the fuck should we give a fuck about your life?

There is no claim of "how was I to know" or "I was just following orders". This is straight up helping a totalitarian state for profit.

Morally, I don't see the difference between these guys and the people who helped the Nazis.

This is why there can never be backdoors for law enforcement. Fuck 'em all.

Re:Nazi sympathizers ...

[Bing Tsher E]

I'd say that Apple is closer to being 'the nazis' than these folks. Or at least as close.

Not that some stupid godwin reference matters.

And why should people who don't use an iPhone give a fuck about any of the details of your life, since you brought that tone to the discussion?

Then we should sue Apple

[Anonymous Coward]

For telling us it is secure.

Re:Then we should sue Apple

[Anonymous Coward]

What could they have said to prevent litigation-eager ACs from wanting to sue?
"We believe our products to be secure, but don't trust us, do your own research. Actually just don't buy anything from us at all. Please let us suck your collective penises by way of grovelling apology."

Re:Then we should sue Apple

[Aighearach]

For telling us it is secure.

Unfortunately, words stated without modifiers are not presumed by the Courts to be impossible absolutes, but rather to be typical values of the word.

So telling you it is secure, that means secure, as in the state something is in after an effort to secure it.

Compare also, "my money is in a safe" to "my money is safe" and "your money is safe with us!" Safe means a lot of different things, there is no expectation that it always mean, "unblemished until the heat death of the Universe." If steps were taken to make it safe, now it is safe, to some real-world degree. Same for security. Your device has been secured. Sleep better, or not, your choice.

Re:Then we should sue Apple

[Anonymous Coward]

apple lies all the time and gets away with it. Why not now?

Re:Then we should sue Apple

[Anonymous Coward]

Please let us suck your collective penises by way of grovelling apology.

Are collective penises huge massive ones, or waving fields of little ones like corn?

Re:We don't need to weaken encryption

[Anonymous Coward]

You just want to throw out all the Bill of Rights huh? That should work out well for you.

Totally irrelevant

[cancerintheheart]

These stories are just put up to try to fool you into thinking your privacy isn't raped every which way already.
Is slashdot really forgetting about the Snowden files?

EVERYthing EVERYbody does is monitored and recorded and analyzed. All of the big companies are in on it along with the federal government/military. If you know about the content of the Snowden files and still think they aren't mining this data to create propaganda through their media cronies you are MENTALLY RETARDED.

Re:We don't need to weaken encryption

[Anonymous Coward]

I think you are so very wrongheaded on this that its not even funny. Nothing anyone says could convince you otherwise. Are you seriously saying you have never forgotten a password for an old account?

If this is ever put into place I can only hope that you are stung by it yourself.

I'll ask the question that nobody has asked.....

[8127972]

How do we know that any of this stuff actually works? For all anyone knows, these companies are selling smoke and mirrors.

Know where it came from?

[CaptainDork]

The fucking NSA, via ShadowBrokers.

Re:The Fourth Amendment

[Anonymous Coward]

Sigh. They're not going to break down your door. They're going to bomb your house from the air; if they really want you dead. Quit thinking that you can resist today's military with a few rifles if they come knocking. They won't knock. Scared of tyranny? Better get an army base to see things your way.

Re:We don't need to weaken encryption

[pnutjam]

I'd decrypt for a third party pledged to access only what the warrant is seeking. I don't think it's fair to decrypt and give blanket access for fishing expeditions.

wussup coppers

[AndyKron]

LOL! I have a Samsung that doesn't have a single lock on it. I wonder how long and much money it would cost them to crack it?

Re:The Fourth Amendment

[Anonymous Coward]

Yeah, thats why they have chemtrails. You'll be in no position to fire a gun when they come a knockin. smart, not so smart.

Everybody knows you've got to boil vinegar eggs to free the radicals released by the mailman.

Re:We don't need to weaken encryption

[Anonymous Coward]

No, lets be clear here. Their warrant is to look at the encrypted data. It's not our problem if they can't understand what they are looking at, they had their right to look.

The reason this matters is the we are not required to help the police understand what they are seeing. We don't need technology, I could just write gibberish on a piece of paper and put it in a filing cabinet.

If a search warrant turns up my 2 year olds drawings that no one can understand, do I have to explain what that drawing is during a police search warrant? I think not.

I could turn an electronic document into a physical one by laying out pennies in a grid similar to memory, heads is a 0, tails is a 1.
If you execute a search warrant and find stacks of pennies in a grid on my floor, do I also have to explain to them what that means?

A warrant is a right to search *NOT* understand. The understanding part is on them.

Bought Cheap iPhone Cracking Tech

[fahrbot-bot]

Buyer beware. I imagine using cheap 3rd party stuff on the iPhone will void the warranty. But, to be fair, the official "iCrack" software from Apple is *super* expensive - and you have to get a reservation at an Apple store Genius Bar, wait in line, drop the phone off, talk to a guy with a goatee, etc ...

Re:The Fourth Amendment

[Anonymous Coward]

I own 6 guns that the government knows nothing about.

... except for the drone that photoed your license plate at the shooting range.

the real news here ...

[Anonymous Coward]

the real news here ...

is not that they bought it. after all, everyone knows that if you build it, they will come.

the real news is that apple has rolled over on encrypted ios devices as of this latest ios update.

the real news is that apple still hasn't fixed it!

the real news is all you need is a modified rockstar cable, a raspberry pi and you too can brute force the unlock. Bypassing the hardware lock by simply sending the the correct byte code to the device. that, ladies and gentlemen of the jury, is the real news!

Re: the real news here ...

[Anonymous Coward]

So if I know the passcode to the device, I can just get a cable and raspberry pi, and have the pi send the code over the cable to get right into the phone? Amazing, and without inconvenience, I might add.

Re: The Fourth Amendment

[Anonymous Coward]

They know about them now that you blabbed about them.
Posting AC doesn't deter or hide from the government at all.

Re:The Fourth Amendment

[AutodidactLabrat]

No, your widow will get a rude shock when you try to shoot police.
or do you think some unnamed U.N. Black-skinned jackboots will do it?

Re:The Fourth Amendment

[AutodidactLabrat]

No.
It only requires that the Police lie to the judge.

Apple security was always flawed then

[Anonymous Coward]

If losing one security engineer can compromise your product security then your product security was flawed to begin with. It means that the algorithm and procedure are bullshit and that the entire security team was relying on security through obscurity.

Its simple, if your security procedures rely on the secretes staying in house and cannot handle a public or outside release then they just are not that secure to begin with. This also shows how badly apple is really run as this story has been out for a while and there was no immediate legal or PR action on apples behalf, sometimes the silence speaks louder than words.

Re:Apple security was always flawed then

[Anonymous Coward]

If losing one security engineer can compromise your product security then your product security was flawed to begin with. It means that the algorithm and procedure are bullshit and that the entire security team was relying on security through obscurity.

Its simple, if your security procedures rely on the secretes staying in house and cannot handle a public or outside release then they just are not that secure to begin with. This also shows how badly apple is really run as this story has been out for a while and there was no immediate legal or PR action on apples behalf, sometimes the silence speaks louder than words.

no, it means apple rolled over. nothing more and nothing less. want proof? apple gave china the security keys for your icloud (if you are in china)... what else aren't they telling us (about your local icloud keys, perhaps)? how about the latest hogwash where the bluetooth or the wireless button doesn't actually turn off the feature. they descibed it as a beacon.

Re: Apple security was always flawed then

[Anonymous Coward]

So don't backup files to iCloud servers, that has nothing to do with the encryption on the phone. Also I will guess that many of the hacks they use will get fixed by Apple.

However seeing things like this proves there is no way that Apple or probably any company could design a back door which only the "good guys" would have access to. Even without purposely built back doors, it's a constant fight to keep systems secure.

Re:We don't need to weaken encryption

[Train0987]

What happens when they testify that your gibberish note is a terrorist plot written in code? Your smug grin and silence will help you a bunch then.

Re:We don't need to weaken encryption

[mark-t]

If someone forgets their encryption key, that's on them. We keep hearing about how people need to be held strictly responsible for any slight misuse of firearms, so I think that applies in spades also to encryption. If you use it and cannot remember the key to allow the state to execute a valid warrant, sucks to be you unless you can prove that you are not defying the court.

Are you suggesting that it entirely justified to throw people in jail for what they happen to *think*, regardless of what they may actually do, if what they happen to think does not happen to agree with what the law defines as acceptable?

Re: The Fourth Amendment

[Anonymous Coward]

So, business as usual?

Re:We don't need to weaken encryption

[Anonymous Coward]

You have a duty to unlock a device you own if it is named in a valid warrant.

I bet you that's disputed. Where would this duty come from?

A warrant is a thing that causes a normally-illegal act committed by a law enforcement officer, to become legal. You're saying it creates an obligation for someone else, too? I'm skeptical.

But you might be right about that. This, though:

If someone forgets their encryption key, that's on them. .. If you use it and cannot remember the key to allow the state to execute a valid warrant, sucks to be you unless you can prove that you are not defying the court.

You are creating a new thing there. This would be a whole new type of law that America hasn't seen before. (U.K. has it, though.) I think we might want an election or constitutional amendment ratification on this one.

The window of government snooping is closing fast

[roxywuppy]

Paid apps are next shit impossible to break as locked with quantum computers never unlocking ever, you bought what is coming with ignorance. Cops sucking the data from the phones of those they stopped like Chinese Communist caused this in the first place. Is there no part of American government not rock stupid?

Using knowledge that Apple willingly gave him

[bagofbeans]

If he is making use of an Apple trade secret, especially if he has signed contracts to keep such confidential, then he is in violation.

This is not a issue of having the right to continue the same work under different employment.

Re:We don't need to weaken encryption

[Anonymous Coward]

I don't have the key.

It originally was set, by deadman switch, to randomize and message itself to someone, along with instructions to not contact me until the "unexpected duress" has passed.

You're chasing something you don't have access to, no matter how hard your tantrum legislates. You were too thick to understand that, so now I don't either.

Eventually you'll try to desperately criminalize the tool I used, but the underlying realities remain and some other canary fix will replace it. Raw compulsion is ultimately a voluntary act, and "because I said so" is the desperate cry of someone who has nothing else.

Re:I'll ask the question that nobody has asked....

[Aighearach]

One of the most generic examples that Courts bandy about in false advertising cases, and some types of fraud cases, is: "What if you sell a bunch of guns to the government, and they don't shoot?" That's the default example of selling something that doesn't do what it says it does.

So the answer is, we know it works because they didn't get in trouble after selling it to the government!

If you sell it to a private party, there is a lot more gray area about arguing what the device was for, and what the appropriate expectations were. But when you sell it to the Government, you're operating under the most cliched examples; the facts of your case will end up exactly matching the hypotheticals already considered in other cases. ;) Nobody is going to believe that you thought the Government wanted to buy it as a fancy paperweight; it is very easy to presume that you knew the Government was buying it to actually use it.

Re:We don't need to weaken encryption

[Anonymous Coward]

Aren't you a good little Eichmann.

Will Apple buy this?

[neurocutie]

So will Apple (or a suitable proxy/agent/front) for $30,000, buy this Greykey so it can plug the hole(s)?

Low tech

[DaMattster]

I think it's just better to go low tech nowadays. I'd rather go back to a basic flip phone.

Re: Low tech

[Anonymous Coward]

What's the difference between having a dumb phone or a smart phone which you don't use for illegal activities? If you are concerned about information on your phone, then don't use it for those activities.

That said for most people any information they have on an iPhone is probably more secure than any other system that they are using. Don't kid yourself thinking your windows or Linux box is secure, if they get physical access to it they are as good as in. While hackers might have figured out to get into an iPhone, what's the last device that you heard about that the FBI made a stink about getting into. They haven't had to because everything is super easy for them to crack.

Re:The Fourth Amendment

[Anonymous Coward]

Soon quantum will make the data safe unopenable and no force on earth will be able to do shit about it.
Everyone will be able to remain silent and enforce it. Yawn.

Mesh not TCPIP will rule.

Re:We don't need to weaken encryption

[Bing Tsher E]

No, he's a good little Entemanns.

It's better than being a Little Debian Snack Cake.

Re: We don't need to weaken encryption

[Anonymous Coward]

He's incorrect, you can be forced to unlock a biometric as it is something you have. But you can't be forced to confess a code, which is something you know.

Re:I'll ask the question that nobody has asked....

[AHuxley]

NSA ANT catalog https://en.wikipedia.org/wiki/...
Greek wiretapping case 2004–05 https://en.wikipedia.org/wiki/...–05
SISMI-Telecom scandal https://en.wikipedia.org/wiki/... SISMI-Telecom scandal
Operation Socialist https://en.wikipedia.org/wiki/... Operation Socialist
The past is full of security services getting the trapdoors and backdoors and keys into nations telco systems.
Can US city and state police with federal task forces and that extra funding afford the same in 2018?
The telcos and big bands cannot secure their internal networks.
The price for a city police force to play is the only question. Voice prints too :)

Re: We don't need to weaken encryption

[Anonymous Coward]

Sarcasm? The silence and smugness would mean no conviction and freedom.

hebdo them

[Anonymous Coward]

just do a charlie hebdo style visit to these ex apple employees, and exterminate them and their families and everything and everyone they hold dear
they will suddently stop making these tools if you make it scary enough

Re: We don't need to weaken encryption

[Anonymous Coward]

Shhhh OP here doesn't understand the meaning of circumstantial evidence

Re: The Fourth Amendment

[Anonymous Coward]

Exactly. What can rifles and guerrilla tactics do against a modern military? Just like those Russians crushed those stupid Afghan rebels within weeks with their tanks, helicopters and rockets...

Re: The Fourth Amendment

[AutodidactLabrat]

And the Black Panthers won so WELL didn't they?
Oh, wait, your "Second Amendment Army" will crumble in minutes