On Preventing the Widespread Use of a Law-Enforcement-Friendly iOS Patch

Apple has asserted that a one-time use of any software that would enable the FBI to bypass security features in the iPhone is impossible—that it would inevitably be used multiple times. In a previous post, I’ve argued that the software could be written, used once, and then thrown away permanently. The technique (i.e., algorithms involved) would still be known, but the software artifact could be destroyed forever.

Friends of mine have criticized this point of view. I still think I’m right about it, but here’s another way to prevent it from being used excessively. It would take legislation to accomplish this task, but consider the idea of imposing a charge of $X against the FBI’s annual budget every time it requested a warrant to force Apple to upload the bypass patch to an individual phone – for this piece, call the warrant a bypass warrant.

Today, X is zero. In FY 2015, the appropriation for the FBI was about $8 B. If X is set to 8 billion, then the FBI won’t request such bypass warrant even once. Somewhere between X = 0 and X = 8 billion, a value for X can be found that would force the FBI to ascertain just how important the bypass warrant would be in any given case. The FBI has approximately 35,000 employees of all kinds (agents, intelligence analysts, support staff, and so on), for an average cost per employee of around $230 K. If agents and analysts cost around $500 K, one might set X = 500 K if the value of such a bypass warrant were comparable to the services of one agent or analyst for the entire year. The specific value for X is not important – what is important is that by adjusting its value, it is possible to force the FBI to make tradeoffs and judgments about what is and is not worth a bypass warrant.

What does “charging” $X for a bypass warrant mean? It should mean that $X would no longer be available for FBI use; in effect, X dollars would be returned to the U.S. Treasury. If it were desirable to make the tradeoffs more stark, one could establish an overall budget for bypass warrants for the FBI, and allow the FBI to keep for its own unrestricted purposes any money left over by underspending against that account. That would give the FBI an incentive to reduce the use of bypass warrants, especially in a budget-constrained environment.

What about the needs of state and local law enforcement authorities who wanted access to bypass warrants? There’s no reason that the FBI could not request warrants on their behalf… and yes, it would mean that the FBI would have to make tradeoffs between its own needs and the needs of nonfederal law enforcement authorities. That's not a bad tradeoff to have to make in defense of privacy rights.

I expect that the FBI and other law enforcement authorities to dislike this approach quite a bit. But basic economics says that free goods and services are overused. It’s true that law enforcement authorities spend resources on preparing applications to obtain warrants, but those resources are only indirectly monetary resources—and thus, decision makers don’t confront those costs directly.

There’s another appealing aspect of this approach from my point of view. If X is set low (so that the budgetary impact of obtaining a bypass warrant is small), it’s equivalent to saying that the bypass warrant isn’t worth very much—in which case, why do it? On the other hand, if X is set high (which would be a statement that the value of the bypass warrant was high in any particular case), the budget impact would be such that the agencies would seek such a warrant only rarely. That outcome would be at least partly aligned with the FBI’s stated position that its request of Apple’s assistance in this case is not about setting a precedent.