A Possible Tool to Unlock the iPhone Means Something…or Nothing

To read the news over the last 24 hours, you’d think the FBI had given up the ghost with its announcement that maybe, just maybe, it had a way into the San Bernardino killer’s iPhone without Apple’s help. What should we make of the FBI’s motion to postpone the court hearing that was scheduled for today while it determines whether a new method for unlocking the iPhone exists? Maybe a lot, in the short term, but maybe very little.

And in the long term—and the long term may not be that long—it changes nothing at all.

Let’s consider the short term first.

The Department of Justice reports that:

On Sunday, March 20, 2016, an outside party demonstrated to the FBI a possible method for unlocking Farook’s iPhone. Testing is required to determine whether it is a viable method that will not compromise data on Farook’s iPhone. If the method is viable, it should eliminate the need for the assistance from Apple Inc. (“Apple”) set forth in the All Writs Act Order in this case.

Note that the FBI has had this information for less than 48 hours. It is requesting a delay in order to conduct testing. There is some possibility that the method will not work at all on the phone in question or that it will not work with sufficient certainty as to the protection of the data to permit the FBI to move forward with it. In that case, the significance of this episode is limited to confirmation that the FBI is continuing to pursue methods to unlock the phone. We can expect the case then to proceed.

Conversely, if the method is viable, the government may withdraw its motion to compel assistance under the All Writs act on grounds that the assistance is no longer necessary. In that case, the episode has a number of short-term ramifications:

• There is some degree of embarrassment to the FBI, which announced that it could not do this without Apple’s help, only to find that someone else could.
• There is some degree of embarrassment to NSA, which FBI Director James Comey strongly (somewhat elliptically, to be sure) suggested lacked the technical capability to help the FBI unlock the phone.
• There is some degree of embarrassment to Apple, whose phone turns out to be unlockable after all.
• The current litigation is likely to go away and everyone lives to fight another day.

Probably.

Readers may recall that in the iPhone case in the Eastern District of New York, the government sought a judicial opinion even after the defendant pled guilty. There the Department of Justice argued that its application for assistance in unlocking an iPhone running iOS7 was not mooted by a guilty plea. The government argued that it still had an interest in obtaining the evidence on the phone to determine customers and sources of drugs, as authorized by the scope of the warrant. That case will continue and is unaffected by the development of a new tool. A federal district judge is currently reviewing the decision of Magistrate Judge James Orenstein, denying the government’s motion. In CDCA, it is possible that the new tool could work but that the matter—for one reason or another—would still not be moot, for example if the government obtained some data but not all.

Failing that, however, we may have to wait for another case to resolve the big questions—assuming of course, Congress does not decide to resolve the matter first. If things go in this latter direction, and the issues are left for other facts and another day, the short-term outcome would highlight at least two very interesting points:

First, we do not know, and perhaps will not know, who developed this iPhone cracking tool, how specific the tool in question is to a given iPhone and operating system, and thus how powerful a weapon it is both in the hands of the FBI and in the hands of the FBI’s new partner (whoever that may be). A new tool to extract data from an iPhone 5C running iOS9 is useful to the case at hand, but represents a small subset of “Going Dark” cases, now and in the future. Conversely, if the tool does appear to have broader uses, this could be a big deal. Will the FBI hand it over to Apple so that Apple can patch? Don’t bet on it. There is no legal obligation for the FBI to do so. And given that Apple will not help the FBI hack its devices, there’s no good reason for the FBI to help Apple plug vulnerabilities the FBI needs to effectuate warrants with which Apple won’t help.

Second, the episode would demonstrate the possibilities of the kind of “lawful hacking” advocated by some members of the information security community as an alternative to the assistance sought by the FBI. The Justice Department’s motion comes shortly after an announcement out of John Hopkin’s university regarding flaws—which have now been patched—in Apple’s encryption of some videos and images. Vulnerabilities do exist. And maybe, since we can’t agree on what a cooperative posture between law enforcement and the tech companies would look like, the episode highlights the possibilities of an adversarial posture between the two.

In the longer term, however, the episode changes nothing. It merely defers the important questions which we’re eventually going to have to resolve, either in the courts or in Congress or both.

• Does the All Writs Act apply to compel this type of assistance from an information service provider like Apple, or is such an order precluded by CALEA?
• If the All Writs Act does properly apply, what constitutes an undue burden under the controlling test in New York Telephone Company?
• Is there an obligation for the government to seek assistance from other federal agencies and the commercial sector before demonstrating that non-party assistance is required as a matter of necessity under the All Writs Act?
• More generally, what obligations do we want companies like Apple to have to cooperate with and assist law enforcement in the investigation and prosecution of their users?

Eventually, we’re still going to have to answer these questions, even if the current case wilts on the vine.