Actually I do have a clue. I worked for a large company that produced signed releases. It was an automated process. Submit a cvs tag to the signing server and it builds and signs and returns a signed build. I also produced highly focused patches for that would go to a very large number of users. Two months is a time period for implementing and testing a focused patch to the general public given the team size Apple specified. Even shorter time frames for emergency patches that were extremely focused and limited, which might be a better comparable to this FBI request in terms of the changes necessary. They are treating it like a general iOS update to pad the numbers submitted to the court. I've worked with corporate attorneys on such estimates and such tricks are often employed to favorably frame things to the company's advantage. My negotiations professor was a federal judge and he also discussed the values of framing arguments and how it is a common legal practice to take things to a nearly misleading extreme. Looking at a public iOS update process for time estimates for this special purpose extremely limited scope and limited use iOS version is exactly the sort of legal maneuvering that would get used.
Agreed. But what I am arguing is what if the court gives the FBI that legal crowbar? In such a scenario Apple must modify the code so that it can be locked to a device. The alternative FBI coded solution lacks any such device lock and could be used anywhere with or without judicial overwatch. At least if Apple does it judicial overwatch is ensured.
And if I recall correctly Apple in a previous statement/filing estimated it would take a month or two to produce a modified iOS that would skip the passcode delay and passcode failure wipe. That is possibly an overestimate as they also mentioned testing and verification as if it were a general iOS update for the pubic. In any case once they have this first one the only thing that needs to change is the UDID of the targeted device. That could be an automated process, much like the signing process is likely to be. An authorized internal developer most likely submits an iOS build to a locked down signing server that returns a signed build. That process likely exists. This FBI build of iOS could remain archived on the signing server so that when an authorized Apple employee submits a UDID in compliance with a court order the signing server patches the UDID and signs and returns this revised build. No team required. Just a designated employee to submit a UDID and forward the binary to the appropriate agency.
As I said, there is a lot of PR/Legal spin going around. And that includes the notion that Apple will need some large court order processing department. And they can probably bill for the time the lawyer needs to review the court order and send a go ahead email to the designated engineer who submits the UDID to the signing server and forwards the binary.
This is at least an order of magnitude harder than a Jailbreak.
Not a problem, do you think the government lacks resources? Either internal or outside contractors?
Look at CPUs. In particular the Motorola PowerPC used in many generations of past Apple Macintosh computers. It was such a cleaner design than Intel x86, much easier to improve for greater performance. And yet it failed performance wise compared to Intel. Not because the PowerPC itself failed to improve, but because no one imaged that the x86 design could ever be competitive due to the complexity of its design and all the other legacy issues. And yet, Intel through the sheer brute force of pouring tons of money and resources at the problem pulled off a miracle and kept pace with and eventually surpassed the PowerPC. Much to everyone's surprise.
An order of magnitude of difficulty is not an issue when there is virtually unlimited resources.
However *** IF *** the court forces Apple to comply then Apple should make the modified iOS. This way they can lock this modified iOS to the one device in question. [emphasis added]
I must have missed the Press Release where Apple stated that that was even possible. I really wish people would stop parroting and perpetuating that canard.
Of course Apple is not going to state this, they are in PR/legal mode, trying to position and frame the debate. Saying that when they are altering the source code to avoid passcode entry delays and such that they could also add code that checks the device's UDID and refuses to run if it is not the device in question, well that's counterproductive to the narrative they are trying to create. The narrative of "global havoc".
So, IOW, you're just guessing.
No. In college my negotiations professor was a federal judge. Framing things just short of misrepresentation is a standard legal practice according to him. I'm also an iOS developer and could lock down software to run on a particular device if I wanted to.
And, so, what about all the industry-leaders and even government intelligence experts that are lining up in public support of Apple like planes at an airport. What exactly do they (esp. the intelligence experts) have to gain supporting a position that is contrary to the DOJ?
Because nearly everyone in the tech industry hates this idea of Apple being forced to "backdoor" even one specific phone, knowing that there will of course be more court orders. I am in this camp. I look forward to Apple moving more protection from firmware/software into hardware where it is unpatchable. However this does not change the simple honest fact that Apple and all these other industry leaders are ALL in PR/Legal mode. Even in the most recent filing that has more technical arguments one can see the spin and framing.
Having read significant chunks of Apple's response: Either Apple is lying to the court about legal precedents or DOJ is lying to the court about those precedents, and it should be a simple matter to determine which one is the liar. And lying to the court should be cause for disbarment and for further sanctions.
FWIW.
They seem to be engaging in a bit of legal/PR spin on the technical side too, trying to frame things in a way that approaches misrepresentation. Which is what one expects from lawyers. Consider:
The government seeks to commandeer Apple to design, create, test, and validate a new operating system that does not exist, and that Apple believes—with overwhelming support from the technology community and security experts—is too dangerous to create.
That wildly overstates things to the point of misrepresentation. The FBI needs an alternate iOS that avoid the passcode entry delays and automatic wiping on failed passcodes. That is a very focused change to existing code. Given this alternate version of iOS' intended role it doesn't need the full review and test process that a public iOS update would. Apple further misrepresents the "global" threat. As they make the passcode related changes they could add code to check the device's UDID and lock this version of iOS to one particular device. The FBI, hackers and criminals could no more tamper with this alternate version of iOS than they could the real iOS. Its all digitally signed by Apple. I don't recall where but I think Apple's own estimate was a month or two of work and that is likely heavily padded with procedures only necessary for a real iOS update.
Now Apple is absolutely correct that this is not a one time event. There will surely be other court orders if this one succeeds.
The problem is that the right to remain silent is only in the context of self incrimination. The government sometimes gives immunity to parties to a crime to remove legal jeopardy so that their testimony can be compelled, to be force to speak.
The court can order police, not ordinary citizens, to go through other people's crap.
The court would only be ordering Apple to produce a key. Which would be so risky for Apple that they would likely voluntarily sign FBI binaries, but better still do the iOS update themselves so it can be locked to a unique device, unlike an FBI created binary.
To order ordinary people to do so would also violate their right to refuse as a conscientious objector.
The government gets to decide what is a "conscientious objector" and many who thought themselves as such went to jail for failing to show up for induction.
Likewise the right to remain silent would not apply either since Apple is under no threat of self incrimination by unlocking the phone.
Now, the key is not itself evidence, so worst case scenario, Apple destroys it. End of problem. Then they offer a rebate on the next, unbreakable, iphone.
No, conspiracy and obstructing a federal investigation is very broadly defined. Its federal prison time for anyone involved in such an act, and the courts will likely lean towards harsh sentencing since the absolute worst crime in the eye of the court is to disobey the court.
Even if they lock it to a specific serial number / UID, the legal precedent is set. Then every district attorney with an iPhone in their evidence locker starts filing paper with their local judge. Apple gets buried under orders to do the same.
Agreed, but what is the alternative? An FBI coded tampering of iOS that has no such check and no court oversight. Assuming Apple loses in court and is forced to comply in the first place.
In order to cope with these orders, Apple internally makes it easier and more streamlined to comply, which implicitly means granting more access to the signing keys. Then it's only a matter of time until those keys are leaked / stolen / compromised. We've been down this road before, and that is exactly what Apple is fighting.
Signing is probably already automated to avoid as much human interaction and human error as possible. It is probably already procedure within Apple that iOS updates are fed into a locked down signing server black box that signs and returns the update. No human actions are involved.
However *** IF *** the court forces Apple to comply then Apple should make the modified iOS. This way they can lock this modified iOS to the one device in question. [emphasis added]
I must have missed the Press Release where Apple stated that that was even possible. I really wish people would stop parroting and perpetuating that canard.
Of course Apple is not going to state this, they are in PR/legal mode, trying to position and frame the debate. Saying that when they are altering the source code to avoid passcode entry delays and such that they could also add code that checks the device's UDID and refuses to run if it is not the device in question, well that's counterproductive to the narrative they are trying to create. The narrative of "global havoc".
No problem. I was really tired when I typed and I was completely open to the idea that I left out a word or mangled an edit to screw up what I was trying to say.:-)
> This way they can lock this modified iOS to the one device in question.
That's not what the FBI is asking for, and it's not clear that's even feasible.
The check would be done in code. The code could check the UDID of the device and decline to run if it is not the expect device. It doesn't matter if its not what the FBI is asking for, if is Apple doing the work they can insert the UDID check.
Well they can't modify iOS without the source code and build system unless you want them to modify the binaries directly. In that case, though, they'll need some sort of emulation environment so that they can debug it and find what patch to make to disable the device wiping. This is not an easy task.
Agreed, its not easy. But its in the realm of their capabilities. Just like those who create jailbreaks.
Legally, code is (protected) speech. And the Freedom of Speech means that you are also allowed to keep silent if you don't want to speak.
Untrue. Your right to remain silent is in the context of self incrimination. If you are not under legal jeopardy you can be compelled to speak. For example when parties to a crime are granted immunity from prosecution so that self incrimination no longer applies and they can be forced to speak.
That is PR spin. The FBI, hackers, criminals, etc do NOT need Apple to create the software. All are perfectly capable of tampering with binaries as people have been doing for decades. The ONLY thing that stops such efforts is that the firmware is expecting the software to be digitally signed. The only thing the FBI really needs from Apple is to sign the FBI's tampered iOS binaries. That's it.
No, that's downright the problem itself. Apple gets either forced to make a statement they don't want to make (e.g. creating the new binary), or they are forced to sign a statement someone else makes and thus declare it their own statement. That's simply unconstitutional. And that's why the Fourth Amendment comes into play.
Its an act not a statement. And I believe the courts have compelled acts like "unlock this door".
Yes, the FBI has permission. What they can't do is force a third party to do something for them.
Yes, but its no longer a Constitutional Rights issue. A court could order Apple to provide the key so the FBI could do the work. However this yields to the worst outcome. An FBI version of iOS that works on any device. If Apple loses in court and is going to be forced to provide the key then it is Apple's moral responsibility to also do the work so that it will be locked to a single device. The FBI (and hackers and criminals) can no more alter this alternate version of iOS than they could the original version of iOS, both are protect by the digital signature and that key remains inside Apple if they do the work.
They can ask, but that's about it. And since this is an order to perform something, as opposed to not doing something, the penalty for contempt is civil. Destroy the key and have everyone pull the mafia hit in a restaurant stunt - 100 witnesses, and nobody saw anything.
Doubtful. They key is very tightly held within Apple, access restricted, probably monitored and logged. It is literally their crown jewel. And what you describe is criminal not civil, its not failure to comply, its an overt act so we have conspiracy and obstruction of justice. People would probably go to federal prison. Sentences harsh to make an example of them.
In neither of your examples is the non-government actor violating another's Constitutional Rights.
Uh, that is what I said, and that is what I was trying to demonstrate. "Many of our Constitutional Rights only protect us from the government, not from individuals.":-)
I get the fact that you guys don't want Apple to open up its platform to the government, but this story is downright dishonest.
One particular dishonesty is that Apple creating a modified iOS "would become a weakness that hackers and criminals could use to wreak havoc"
That is PR spin. The FBI, hackers, criminals, etc do NOT need Apple to create the software. All are perfectly capable of tampering with binaries as people have been doing for decades. The ONLY thing that stops such efforts is that the firmware is expecting the software to be digitally signed. The only thing the FBI really needs from Apple is to sign the FBI's tampered iOS binaries. That's it. Having Apple modify iOS is just a convenience, not a requirement.
However *** IF *** the court forces Apple to comply then Apple should make the modified iOS. This way they can lock this modified iOS to the one device in question. The FBI, hackers and criminals could not tamper with this lock down either. This modified iOS is just as tamperproof as original iOS due to the digital signature. With this lock down the FBI would need a new court order for each new device.
The only scenario that leads to havoc is if Apple does not do the code and lets the FBI tamper with the binaries, then there will be no lock down to a particular device. Once signed by Apple this FBI version of iOS could run on anything. This is why Apple must do the software, *** IF *** the court is going to force them to comply.
This is a great example of a negative / negative decision.
This software -- which law enforcement has conceded it wants to apply to many iPhones --] would become a weakness that hackers and criminals could use to wreak havoc on the privacy and personal safety of us all.
No. That is PR spin. The FBI, hackers, criminals, etc do NOT need Apple to create the software. All are perfectly capable of tampering with binaries as people have been doing for decades. The ONLY thing that stops such efforts is that the firmware is expecting the software to be digitally signed. The only thing the FBI really needs from Apple is to sign the FBI's tampered iOS binaries. That's it. Having Apple modify iOS is just a convenience, not a requirement.
However IF the court forces Apple to comply then Apple should make the modified iOS. This way they can lock this modified iOS to the one device in question. The FBI, hackers and criminals could not tamper with this lock down either. This modified iOS is just as tamperproof as original iOS due to the digital signature. With this lock down the FBI would need a new court order for each new device.
But if Apple does not do the code and lets the FBI tamper with the binaries then there will be no lock down to a particular device. Once signed by Apple this FBI version of iOS could run on anything. This is why Apple must do the software, *** IF *** the court is going to force them to comply.
I understand you're not from the U.S., but only the Government can "break" (deny you) (your) Constitutional Rights. A Person (including a Corporate "Person") cannot affect another's Constitutional Rights, period.
Actually yes a private person/organization can. Many of our Constitutional Rights only protect us from the government, not from individuals. Slashdot could censor this conversation, government could not. If a private person searches through your stuff and finds something illegal, calls the police, then the police now have probable cause to get a warrant... so long as the person was not originally acting as an agent of the police. Things are far more complicated than you suggest.
Apple isn't morally obliged to break constitutional rights...
There is also no constitutional right in this case because it is the employer's phone and the employer has given the FBI permission to access it's property.
You are forgetting the third option: Just drop it. The shooters are dead.
As you said, that is not one of Apple's options. And if you want to get all technical... the phone was not the shooter's, it is the employers. And the employer gave the FBI authorization to get into the phone.
No, the correct moral stance is for apple to refuse and force the government to take the keys by force.
No, because then the government creates the alternate iOS without any device locking. The government could then use this version without court oversight.
Deciding to go along with it in the hopes of not doing more damage than necessary would be the Werner VaunBraun move (My job is to make the rockets go up, where they come down isn't my department), and going along just to avoid consequences would be the "just following orders" move.
A very poor analogy. Werner did nothing to limit damage. He just went along to purse his scientific curiosity/passion regardless of the consequences. Matter of fact he probably increased damage, if he had not contributed progress would probably have been slower. He made a conscious decision to use the Nazi's as a funding source regardless of consequences. Complete psychopath.
No matter who makes those changes, the problem is the same...
Absolutely not. In the Apple scenario the code is locked to a device and a new court order will be required for every other device.
In the FBI scenario the code will not be locked to any device, will run on any, and the FBI is free to use it on any device they have possibly without a court order.
So the options are require a court order per device or allow any device to be unlocked at law enforcement's discretion.
Apple keeping it around means that there will exist a possibility that it might get misappropriated from Apple...
That is complete non-sense. There is nothing special about the code. The FBI could patch existing binaries, black hats could patch existing binaries. The only thing that prevents modified code is the key for signing. That is the only thing that matters. Apple could publish iOS source code with the unlocking and it makes no difference, the situation is the same as if binaries were patched by outsiders. Nothing runs unless signed with the key.
Slashdot Mirror
Actually I do have a clue. I worked for a large company that produced signed releases. It was an automated process. Submit a cvs tag to the signing server and it builds and signs and returns a signed build. I also produced highly focused patches for that would go to a very large number of users. Two months is a time period for implementing and testing a focused patch to the general public given the team size Apple specified. Even shorter time frames for emergency patches that were extremely focused and limited, which might be a better comparable to this FBI request in terms of the changes necessary. They are treating it like a general iOS update to pad the numbers submitted to the court. I've worked with corporate attorneys on such estimates and such tricks are often employed to favorably frame things to the company's advantage. My negotiations professor was a federal judge and he also discussed the values of framing arguments and how it is a common legal practice to take things to a nearly misleading extreme. Looking at a public iOS update process for time estimates for this special purpose extremely limited scope and limited use iOS version is exactly the sort of legal maneuvering that would get used.
Agreed. But what I am arguing is what if the court gives the FBI that legal crowbar? In such a scenario Apple must modify the code so that it can be locked to a device. The alternative FBI coded solution lacks any such device lock and could be used anywhere with or without judicial overwatch. At least if Apple does it judicial overwatch is ensured.
And if I recall correctly Apple in a previous statement/filing estimated it would take a month or two to produce a modified iOS that would skip the passcode delay and passcode failure wipe. That is possibly an overestimate as they also mentioned testing and verification as if it were a general iOS update for the pubic. In any case once they have this first one the only thing that needs to change is the UDID of the targeted device. That could be an automated process, much like the signing process is likely to be. An authorized internal developer most likely submits an iOS build to a locked down signing server that returns a signed build. That process likely exists. This FBI build of iOS could remain archived on the signing server so that when an authorized Apple employee submits a UDID in compliance with a court order the signing server patches the UDID and signs and returns this revised build. No team required. Just a designated employee to submit a UDID and forward the binary to the appropriate agency.
As I said, there is a lot of PR/Legal spin going around. And that includes the notion that Apple will need some large court order processing department. And they can probably bill for the time the lawyer needs to review the court order and send a go ahead email to the designated engineer who submits the UDID to the signing server and forwards the binary.
This is at least an order of magnitude harder than a Jailbreak.
Not a problem, do you think the government lacks resources? Either internal or outside contractors?
Look at CPUs. In particular the Motorola PowerPC used in many generations of past Apple Macintosh computers. It was such a cleaner design than Intel x86, much easier to improve for greater performance. And yet it failed performance wise compared to Intel. Not because the PowerPC itself failed to improve, but because no one imaged that the x86 design could ever be competitive due to the complexity of its design and all the other legacy issues. And yet, Intel through the sheer brute force of pouring tons of money and resources at the problem pulled off a miracle and kept pace with and eventually surpassed the PowerPC. Much to everyone's surprise.
An order of magnitude of difficulty is not an issue when there is virtually unlimited resources.
However *** IF *** the court forces Apple to comply then Apple should make the modified iOS. This way they can lock this modified iOS to the one device in question. [emphasis added]
I must have missed the Press Release where Apple stated that that was even possible. I really wish people would stop parroting and perpetuating that canard.
Of course Apple is not going to state this, they are in PR/legal mode, trying to position and frame the debate. Saying that when they are altering the source code to avoid passcode entry delays and such that they could also add code that checks the device's UDID and refuses to run if it is not the device in question, well that's counterproductive to the narrative they are trying to create. The narrative of "global havoc".
So, IOW, you're just guessing.
No. In college my negotiations professor was a federal judge. Framing things just short of misrepresentation is a standard legal practice according to him. I'm also an iOS developer and could lock down software to run on a particular device if I wanted to.
And, so, what about all the industry-leaders and even government intelligence experts that are lining up in public support of Apple like planes at an airport. What exactly do they (esp. the intelligence experts) have to gain supporting a position that is contrary to the DOJ?
Because nearly everyone in the tech industry hates this idea of Apple being forced to "backdoor" even one specific phone, knowing that there will of course be more court orders. I am in this camp. I look forward to Apple moving more protection from firmware/software into hardware where it is unpatchable. However this does not change the simple honest fact that Apple and all these other industry leaders are ALL in PR/Legal mode. Even in the most recent filing that has more technical arguments one can see the spin and framing.
Having read significant chunks of Apple's response: Either Apple is lying to the court about legal precedents or DOJ is lying to the court about those precedents, and it should be a simple matter to determine which one is the liar. And lying to the court should be cause for disbarment and for further sanctions.
FWIW.
They seem to be engaging in a bit of legal/PR spin on the technical side too, trying to frame things in a way that approaches misrepresentation. Which is what one expects from lawyers. Consider:
That wildly overstates things to the point of misrepresentation. The FBI needs an alternate iOS that avoid the passcode entry delays and automatic wiping on failed passcodes. That is a very focused change to existing code. Given this alternate version of iOS' intended role it doesn't need the full review and test process that a public iOS update would. Apple further misrepresents the "global" threat. As they make the passcode related changes they could add code to check the device's UDID and lock this version of iOS to one particular device. The FBI, hackers and criminals could no more tamper with this alternate version of iOS than they could the real iOS. Its all digitally signed by Apple. I don't recall where but I think Apple's own estimate was a month or two of work and that is likely heavily padded with procedures only necessary for a real iOS update.
Now Apple is absolutely correct that this is not a one time event. There will surely be other court orders if this one succeeds.
The problem is that the right to remain silent is only in the context of self incrimination. The government sometimes gives immunity to parties to a crime to remove legal jeopardy so that their testimony can be compelled, to be force to speak.
The court can order police, not ordinary citizens, to go through other people's crap.
The court would only be ordering Apple to produce a key. Which would be so risky for Apple that they would likely voluntarily sign FBI binaries, but better still do the iOS update themselves so it can be locked to a unique device, unlike an FBI created binary.
To order ordinary people to do so would also violate their right to refuse as a conscientious objector.
The government gets to decide what is a "conscientious objector" and many who thought themselves as such went to jail for failing to show up for induction.
Likewise the right to remain silent would not apply either since Apple is under no threat of self incrimination by unlocking the phone.
Now, the key is not itself evidence, so worst case scenario, Apple destroys it. End of problem. Then they offer a rebate on the next, unbreakable, iphone.
No, conspiracy and obstructing a federal investigation is very broadly defined. Its federal prison time for anyone involved in such an act, and the courts will likely lean towards harsh sentencing since the absolute worst crime in the eye of the court is to disobey the court.
Even if they lock it to a specific serial number / UID, the legal precedent is set. Then every district attorney with an iPhone in their evidence locker starts filing paper with their local judge. Apple gets buried under orders to do the same.
Agreed, but what is the alternative? An FBI coded tampering of iOS that has no such check and no court oversight. Assuming Apple loses in court and is forced to comply in the first place.
In order to cope with these orders, Apple internally makes it easier and more streamlined to comply, which implicitly means granting more access to the signing keys. Then it's only a matter of time until those keys are leaked / stolen / compromised. We've been down this road before, and that is exactly what Apple is fighting.
Signing is probably already automated to avoid as much human interaction and human error as possible. It is probably already procedure within Apple that iOS updates are fed into a locked down signing server black box that signs and returns the update. No human actions are involved.
However *** IF *** the court forces Apple to comply then Apple should make the modified iOS. This way they can lock this modified iOS to the one device in question. [emphasis added]
I must have missed the Press Release where Apple stated that that was even possible. I really wish people would stop parroting and perpetuating that canard.
Of course Apple is not going to state this, they are in PR/legal mode, trying to position and frame the debate. Saying that when they are altering the source code to avoid passcode entry delays and such that they could also add code that checks the device's UDID and refuses to run if it is not the device in question, well that's counterproductive to the narrative they are trying to create. The narrative of "global havoc".
No problem. I was really tired when I typed and I was completely open to the idea that I left out a word or mangled an edit to screw up what I was trying to say. :-)
> This way they can lock this modified iOS to the one device in question.
That's not what the FBI is asking for, and it's not clear that's even feasible.
The check would be done in code. The code could check the UDID of the device and decline to run if it is not the expect device. It doesn't matter if its not what the FBI is asking for, if is Apple doing the work they can insert the UDID check.
Well they can't modify iOS without the source code and build system unless you want them to modify the binaries directly. In that case, though, they'll need some sort of emulation environment so that they can debug it and find what patch to make to disable the device wiping. This is not an easy task.
Agreed, its not easy. But its in the realm of their capabilities. Just like those who create jailbreaks.
Legally, code is (protected) speech. And the Freedom of Speech means that you are also allowed to keep silent if you don't want to speak.
Untrue. Your right to remain silent is in the context of self incrimination. If you are not under legal jeopardy you can be compelled to speak. For example when parties to a crime are granted immunity from prosecution so that self incrimination no longer applies and they can be forced to speak.
That is PR spin. The FBI, hackers, criminals, etc do NOT need Apple to create the software. All are perfectly capable of tampering with binaries as people have been doing for decades. The ONLY thing that stops such efforts is that the firmware is expecting the software to be digitally signed. The only thing the FBI really needs from Apple is to sign the FBI's tampered iOS binaries. That's it.
No, that's downright the problem itself. Apple gets either forced to make a statement they don't want to make (e.g. creating the new binary), or they are forced to sign a statement someone else makes and thus declare it their own statement. That's simply unconstitutional. And that's why the Fourth Amendment comes into play.
Its an act not a statement. And I believe the courts have compelled acts like "unlock this door".
Yes, the FBI has permission. What they can't do is force a third party to do something for them.
Yes, but its no longer a Constitutional Rights issue. A court could order Apple to provide the key so the FBI could do the work. However this yields to the worst outcome. An FBI version of iOS that works on any device. If Apple loses in court and is going to be forced to provide the key then it is Apple's moral responsibility to also do the work so that it will be locked to a single device. The FBI (and hackers and criminals) can no more alter this alternate version of iOS than they could the original version of iOS, both are protect by the digital signature and that key remains inside Apple if they do the work.
They can ask, but that's about it. And since this is an order to perform something, as opposed to not doing something, the penalty for contempt is civil. Destroy the key and have everyone pull the mafia hit in a restaurant stunt - 100 witnesses, and nobody saw anything.
Doubtful. They key is very tightly held within Apple, access restricted, probably monitored and logged. It is literally their crown jewel. And what you describe is criminal not civil, its not failure to comply, its an overt act so we have conspiracy and obstruction of justice. People would probably go to federal prison. Sentences harsh to make an example of them.
I'm pretty tired but I'm having a hard time figuring out how I typed "favor" rather than "havoc". I'm going to blame autocorrection or something. :-)
...
Apologies for the confusion
In neither of your examples is the non-government actor violating another's Constitutional Rights.
Uh, that is what I said, and that is what I was trying to demonstrate. "Many of our Constitutional Rights only protect us from the government, not from individuals." :-)
I get the fact that you guys don't want Apple to open up its platform to the government, but this story is downright dishonest.
One particular dishonesty is that Apple creating a modified iOS "would become a weakness that hackers and criminals could use to wreak havoc"
That is PR spin. The FBI, hackers, criminals, etc do NOT need Apple to create the software. All are perfectly capable of tampering with binaries as people have been doing for decades. The ONLY thing that stops such efforts is that the firmware is expecting the software to be digitally signed. The only thing the FBI really needs from Apple is to sign the FBI's tampered iOS binaries. That's it. Having Apple modify iOS is just a convenience, not a requirement.
However *** IF *** the court forces Apple to comply then Apple should make the modified iOS. This way they can lock this modified iOS to the one device in question. The FBI, hackers and criminals could not tamper with this lock down either. This modified iOS is just as tamperproof as original iOS due to the digital signature. With this lock down the FBI would need a new court order for each new device.
The only scenario that leads to havoc is if Apple does not do the code and lets the FBI tamper with the binaries, then there will be no lock down to a particular device. Once signed by Apple this FBI version of iOS could run on anything. This is why Apple must do the software, *** IF *** the court is going to force them to comply.
This is a great example of a negative / negative decision.
This software -- which law enforcement has conceded it wants to apply to many iPhones --] would become a weakness that hackers and criminals could use to wreak havoc on the privacy and personal safety of us all.
No. That is PR spin. The FBI, hackers, criminals, etc do NOT need Apple to create the software. All are perfectly capable of tampering with binaries as people have been doing for decades. The ONLY thing that stops such efforts is that the firmware is expecting the software to be digitally signed. The only thing the FBI really needs from Apple is to sign the FBI's tampered iOS binaries. That's it. Having Apple modify iOS is just a convenience, not a requirement.
However IF the court forces Apple to comply then Apple should make the modified iOS. This way they can lock this modified iOS to the one device in question. The FBI, hackers and criminals could not tamper with this lock down either. This modified iOS is just as tamperproof as original iOS due to the digital signature. With this lock down the FBI would need a new court order for each new device.
But if Apple does not do the code and lets the FBI tamper with the binaries then there will be no lock down to a particular device. Once signed by Apple this FBI version of iOS could run on anything. This is why Apple must do the software, *** IF *** the court is going to force them to comply.
I understand you're not from the U.S., but only the Government can "break" (deny you) (your) Constitutional Rights. A Person (including a Corporate "Person") cannot affect another's Constitutional Rights, period.
Actually yes a private person/organization can. Many of our Constitutional Rights only protect us from the government, not from individuals. Slashdot could censor this conversation, government could not. If a private person searches through your stuff and finds something illegal, calls the police, then the police now have probable cause to get a warrant ... so long as the person was not originally acting as an agent of the police. Things are far more complicated than you suggest.
Apple isn't morally obliged to break constitutional rights ...
There is also no constitutional right in this case because it is the employer's phone and the employer has given the FBI permission to access it's property.
So the options are
You are forgetting the third option: Just drop it. The shooters are dead.
As you said, that is not one of Apple's options. And if you want to get all technical ... the phone was not the shooter's, it is the employers. And the employer gave the FBI authorization to get into the phone.
One word. Jailbreak.
A silly word given that the owner must intentionally install the jailbreak. A 3rd party can not "jailbreak" someone else's phone.
No, the correct moral stance is for apple to refuse and force the government to take the keys by force.
No, because then the government creates the alternate iOS without any device locking. The government could then use this version without court oversight.
Deciding to go along with it in the hopes of not doing more damage than necessary would be the Werner VaunBraun move (My job is to make the rockets go up, where they come down isn't my department), and going along just to avoid consequences would be the "just following orders" move.
A very poor analogy. Werner did nothing to limit damage. He just went along to purse his scientific curiosity/passion regardless of the consequences. Matter of fact he probably increased damage, if he had not contributed progress would probably have been slower. He made a conscious decision to use the Nazi's as a funding source regardless of consequences. Complete psychopath.
No matter who makes those changes, the problem is the same...
Absolutely not. In the Apple scenario the code is locked to a device and a new court order will be required for every other device.
In the FBI scenario the code will not be locked to any device, will run on any, and the FBI is free to use it on any device they have possibly without a court order.
So the options are require a court order per device or allow any device to be unlocked at law enforcement's discretion.
Apple keeping it around means that there will exist a possibility that it might get misappropriated from Apple ...
That is complete non-sense. There is nothing special about the code. The FBI could patch existing binaries, black hats could patch existing binaries. The only thing that prevents modified code is the key for signing. That is the only thing that matters. Apple could publish iOS source code with the unlocking and it makes no difference, the situation is the same as if binaries were patched by outsiders. Nothing runs unless signed with the key.