Apple vs FBI: The Going Dark Dispute Moves from Congress to the Courtroom

As just about everyone knows by now, the FBI has worked hard over the past year or so to draw attention to the "going dark" trend (i.e., the idea that the FBI is losing the practical capacity to execute search warrants involving digital communications thanks to a variety of technological changes, including but not limited to proliferation of end-to-end encryption which the provider cannot decrypt unilaterally; see here for a panel on the subject at our recent event at UT). That effort has generated a lot of debate regarding the wisdom of crafting some form of legislative mandate obliging companies to alter (or not create in the first place) products that present this problem, with visceral and seemingly quite-effective opposition from industry, from privacy advocates, and others. Indeed, it seems at present that there is little chance Congress and the President will come together in support of such legislation.

But that does not end the discussion, for in addition to seeking a systematic fix via legislation, FBI and DOJ can instead pursue fixes on an ad hoc basis through litigation. More specifically: They can move under the All Writs Act for orders compelling companies to provide "technical assistance" designed to overcome such obstacles where a proper warrant has been issued. And if they have enough success in obtaining such orders in a variety of circumstances, the net effect might be something close (albeit much more cumbersome) to what they had hoped to get via legislation.

Or so it all seems when observing the drama unfolding in relation to the ongoing investigation of the terrorist attack in San Bernadino. Here is the situation: the FBI has possession of an iPhone 5C used by Syed Rizwan Farook, as well as a warrant authorizing it to access that device. So far so good. But the phone is passcode protected, and the FBI cannot risk a brute-force solution (i.e., running combinations until the right one comes up) because it is possible that the phone's auto-delete feature (i.e., the phone will delete all locally-stored data after 10 unsuccessful attempts) is active. This led DOJ to apply under the All Writs Act for an order compelling Apple to provide "technical assistance" to the warrant-execution effort. Specifically, DOJ asked the judge to order Apple to create a custom software solution that could be installed in the RAM of this particular phone despite its locked status, with the aim of (i) shutting down the auto-delete feature noted above and (ii) enabling the brute-force solution to be implemented electronically (and thus at high speed) rather than manually.

Yesterday, the magistrate judge agreed, in this short order (3 pages). The order mentions that Apple may apply for relief from this obligation on "unreasonable burden" grounds by next Tuesday, though, and it is already quite clear that this is precisely what Apple will do. In a letter to customers released soon after the order dropped, CEO Tim Cook frames the situation as a backdoor (pardon the pun) attempt to obtain a solution to the going-dark challenge that FBI/DOJ might not be able to obtain via legislation:

The government suggests this tool could only be used once, on one phone. But that’s simply not true. Once created, the technique could be used over and over again, on any number of devices. In the physical world, it would be the equivalent of a master key, capable of opening hundreds of millions of locks — from restaurants and banks to stores and homes. No reasonable person would find that acceptable.

The government is asking Apple to hack our own users and undermine decades of security advancements that protect our customers — including tens of millions of American citizens — from sophisticated hackers and cybercriminals. The same engineers who built strong encryption into the iPhone to protect our users would, ironically, be ordered to weaken those protections and make our users less safe.

This statement could be taken in either of two ways (or both).

(i) No Master Key for the Government, period: One possibility is that Cook is warning that the government would henceforth be in a position to adapt the software solution for use at its own discretion in relation to any other situations like this that might later arise. As to that argument: it raises the question whether it is necessary for the government to actually have access to the mandated solution, or if instead it could remain closely held by Apple, with only the end result conveyed to the government. I'm in no position to judge whether this is a realistic option, though it seems a point worth probing. Of course, even if it were clear enough that Apple and only Apple would have access to this tool, the government might end up with the practical equivalent of possession insofar as the precedent were adopted by other courts also presented with All Writs Act applications of this kind; that's the point of describing this particular bit of litigation as a near-duplicate of the legislative solution FBI/DOJ had desired.

(ii) Too Much Risk the Master Key Will be Released Into the Wild: Another possibility is that Cook is warning more simply that there is too much risk that the solution, once created, will slip out of the exclusive control of Apple and into the hands not only of the U.S. government but also other actors such as governments of other states (including authoritarian regimes), criminals, etc. This would certainly be a huge problem if it were to materialize, and hence also a significant problem if there was real reason to believe simply that it might occur. What I'm less clear about is: how likely is this risk to materialize? The answer to that question perhaps depends on just how release into the wild might be thought to occur. One pathway would be a rogue actor, someone privy to the particulars--whether an Apple employee or a government employee--who might at some point succumb to temptation and either sell or outright release the knowledge. Another possibility is that the government might inadvertently release the knowledge into the wild simply by having used it in a context that others can observe (e.g., in somewhat the same manner that some of the moves involved in Stuxnet eventually became known and thus capable of being adopted and adapted by others). As to both of these possibilities, I'm not at all sure how to assess the level of risk.

Stay tuned, this is bound to get very interesting.