 |
| 2 users recommended this comment. What they said: |
|
zepto Feb 17, 2016 | on: A Message to Our Customers | context
Because the hole doesn't actually exist unless Apple engineers custom code for the FBI. If the FBI can force Apple to engineer code to create security holes for them, that establishes a precedent. Explained better by someone else here: https://news.ycombinator.com/item?id=11120036 |
|
mikeash Feb 19, 2016 | on: Why Apple Is Right to Challenge an Order to Help the F.B.I | context
I understand the idea of setting a precedent, I just don't see how the precent set here could translate into preventing Apple from building secure devices. The current request is for Apple to build a special version of their OS which can be loaded onto the suspect's phone. It seems to me that the precent this would create would be for similar actions: providing custom software. The gulf between that and altering the public builds of iOS is vast, and I don't see how the former precent could possibly lead to the latter. In fact, the order in question explicitly states that the software provided by Apple must be tied to the specific iPhone the FBI wants to crack. The precent of providing custom software for a specific device could very well be dangerous in and of itself. This comment does a good job of discussing the possibilities there: https://news.ycombinator.com/item?id=11120036 In short, the precent set here could very well lead to requiring Apple to turn on suspects' microphones remotely, or loading software that scrapes data as the user uses it. That could certainly be bad. But it's a huge leap from that to somehow preventing Apple from ever building and selling secure systems. Edit: thinking about this a bit more, here's what I see as the really simple version of it all. The FBI's order is compelling Apple to build something, and the worry is that it sets a precedent for building more. But forcing Apple to build insecure devices in the future is not the same; that would be preventing Apple from building secure software and hardware, not compelling them to build something insecure. |
Crucially, this is software which doesn't currently exist in the world and which Apple has no intention of voluntarily writing. There is no specific law or regulation (like CALEA) which requires Apple to provide this functionality.
What the FBI is attempting is to use 'All Writs Act' from 1789 which authorizes Federal courts to issue "all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law." Are there limits to what a judge can order a person, or a company, to provide?
A warrant describes "the place to be searched, and the persons or things to be seized." I would not expect a judge can draft a warrant for something which doesn't actually exist, and then force someone to create it.
This is not about providing physical access, or about producing documents which are in your possession. This is whether the government can usurp your workforce to make you create something that only you are capable of creating, against your will, not because there's actually a law which says you have to provide that capability, but simply because some investigator has probable cause that given such a tool they could use it to find evidence of a crime!
If 'All Writs' somehow does give the government the ability to enslave software developers to creating this particular backdoor, what is there to legally differentiate this request from, for example, one that would function over WiFi or LTE remotely?
There's been a lot of discussion about the 'secure enclave' and how this particular attack isn't possible on the iPhone 6. I think that's missing the point.... If 'All Writs' can force Apple to open a black-hat lab responsible for developing backdoor firmware for the 5C, then it can do the same for the 6. For example, why not force Apple to provide remote access to a suspect's device over LTE while the device is unlocked / in use? While we're at it, the iPhone has perfectly good cameras and microphones, let's force Apple to provide real-time feeds.
Think about the sheer quantity of networked devices which exist (or will exist) in an average home which could be used in the course of an investigation. If they can force Apple to create a 5C backdoor, I can't see any reason they can't apply the same logic to WiFi cameras, Xbox Kinects, or even your cars OnStar. Heck, even TV remotes come with microphones and bluetooth now... And don't get me started on Amazon Echo!
Fundamentally, the question is can you force a device manufacturer to implement backdoors into their products to be used against their own customers? Notably, service providers have already lost that battle, they are required to architect their systems to be able to spy on their users and provide that data to law enforcement, often through specially design real-time dashboards. At least in that case it is based on duly enacted legislation with that specific intent.
But this is something really quite shocking -- can investigators, simply through obtaining a warrant, force companies to re-design the personal devices that we own and keep with us almost every moment of the day to spy on us? I truly hope not.