The case involving San Bernardino shooter Syed Rizwan Farook’s iPhone 5c and whether Apple should help unlock it has brought the company’s stance regarding strong encryption to the forefront.
Since this privacy-versus-security debate isn’t going away anytime soon, here’s what you need to know about it so far — and why it’s a much, much bigger issue than just one legal case.
Why all the fuss?
In December 2015, shooters Syed Rizwan Farook and Tashfeen Malik murdered 14 people and injured 22 after opening fire at an office party in San Bernardino, California, in an apparent terrorist attack. After the shooting, the FBI discovered an iPhone 5c belonging to Farook, but the investigators have been unable to unlock it due to Apple’s encryption.
On iOS devices, important files are encrypted in such a way that users must unlock the phone with a manually entered passcode; user data will be wiped if enough incorrect PIN attempts are made. Yesterday, United States magistrate judge Sheri Pym requested that Apple give the FBI a custom firmware file allowing it to unlock the iPhone 5c in question.
Photo: Apple
Exactly what is being asked for?
The FBI wants Apple to build a special version of iOS that works only on the iPhone that has been recovered. This version would differ from regular iOS in three major ways.
Firstly, Apple would bypass or disable the auto-erase function for the device in question.
Secondly, Apple would enable the FBI to submit passcodes to the iPhone via the physical device port, Bluetooth, Wi-Fi or other protocol rather than having to enter each PIN attempt manually.
Finally, Apple would stop the iOS software from purposely introducing delays between passcode attempts. In standard iOS installations, these delays get longer as more wrong PIN codes are entered, with the time between attempts reaching one hour.
The FBI is unable to create its own iOS firmware and sideload it through DFU mode on the iPhone because the agents don’t have access to the keys Apple uses to sign the firmware. The federal court order demands that Apple provide the FBI with a signed iPhone Software file that can only run on the RAM of the terrorist’s iPhone, and then give the bureau remote access to the device.
It is argued that this could be carried on Apple’s campus, without the feds getting their hands in on the tech involved. The problem is that it would result in a master key which could theoretically be used by the FBI and others to hack every iOS device.
Can Apple do this?
A blog entry from Trail of Bits suggests that Apple has the power to do this, despite its strong iOS encryption. Security expert Dan Guido writes:
“Apple has allegedly cooperated with law enforcement in the past by using a custom firmware image that bypassed the passcode lock screen. This simple UI hack was sufficient in earlier versions of iOS since most files were unencrypted. However, since iOS 8, it has become the default for nearly all applications to encrypt their data with a combination of the phone passcode and the hardware key. This change necessitates guessing the passcode and has led directly to this request for technical assistance from the FBI.
I believe it is technically feasible for Apple to comply with all of the FBI’s requests in this case. On the iPhone 5C, the passcode delay and device erasure are implemented in software and Apple can add support for peripheral devices that facilitate PIN code entry. In order to limit the risk of abuse, Apple can lock the customized version of iOS to only work on the specific recovered iPhone and perform all recovery on their own, without sharing the firmware image with the FBI.”
If you’re interested in the specifics, Guido goes into far more detail on his blog about how Apple could overwrite the iPhone’s firmware with a version that conforms to all requested specifications — allowing the FBI to brute-force its entry onto the handset.
So what is the problem?
Photo: Jim Merithew/Cult of Mac
Right from the start, Apple has cast user privacy as a moral issue every bit as much as a technical one. In other words, just because Apple could conceivably hack an iPhone doesn’t mean that it should. In an open letter published today, Tim Cook explained his position:
“When the FBI has requested data that’s in our possession, we have provided it. Apple complies with valid subpoenas and search warrants, as we have in the San Bernardino case. We have also made Apple engineers available to advise the FBI, and we’ve offered our best ideas on a number of investigative options at their disposal.
We have great respect for the professionals at the FBI, and we believe their intentions are good. Up to this point, we have done everything that is both within our power and within the law to help them. But now the U.S. government has asked us for something we simply do not have, and something we consider too dangerous to create. They have asked us to build a backdoor to the iPhone.”
At the end of the letter, Cook suggests that — good intentions aside — the FBI may end up undermining “the very freedoms and liberty our government is meant to protect.”
While there’s no doubt that Apple is no supporter of terrorism, the company is definitely a proponent of strong encryption when it comes to keeping users safe. Those opposing ideological stances is why this issue is so much bigger than the single case in question.
Simple security rule of thumb: don’t build encryption for how the world is today, but how it could be if Donald Trump were President.
— Aaron Levie (@levie) February 18, 2016
What has the response been so far?
Mixed, although the majority of coverage has been in Apple’s favor. Big names including Steve Wozniak, Edward Snowden and others have rushed to support Apple, while the issue has even united Apple rivals like Google and Microsoft who have spoken out to support the company’s pro-encryption stance.
On the other side of the coin? The biggest name so far has been Presidential hopeful Donald Trump. But, hey, as Aaron Levie, CEO of Box, tweeted, “Simple security rule of thumb: don’t build encryption for how the world is today, but how it could be if Donald Trump were President.”
Why is this such a big story?
Because while privacy has been a big issue for the past several years, we’ve never reached an inflection point quite like this before. Apple’s strong stance for end-to-end encryption, and its support from Silicon Valley, represents a real battle for the future of technology as we know it.
Given Tim Cook’s pro-privacy advocacy, this could turn out to be the Apple CEO’s ultimate legacy during his stint as boss.
What happens next?
There are likely to be plenty more twists and turns before this case is settled, but while Apple has so far defied orders to unlock the iPhone 5c for the FBI, it’s been awarded a bit more time to comply by the U.S. magistrate who first handed down the order.
Apple’s response is now due in court on February 26, instead of Tuesday next week. Apple is also reportedly enlisting the assistance of free speech attorneys to help do battle with the government.
