In Terror Case, Apple and FBI Square Off on Privacy Issues

SMITH BRAIN TRUST — In the most inflammatory chapter yet in the war between the government and tech companies over encryption, a federal magistrate judge has ordered Apple to create software that would help the government defeat the security mechanisms on an iPhone 5c owned by Syed Rizwan Farook, who with his wife killed 14 people in San Bernardino, in December. Apple is fighting the order, arguing, as CEO Tim Cook put it, in a "Customer Letter" posted on Apple's website: "In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession."

"Customers expect Apple and other technology companies to do everything in our power to protect their personal information," Cook wrote, "and at Apple we are deeply committed to safeguarding their data." But at the cost of not helping to investigate an apparent terrorist attack? A Pew Research Center survey found that 51 percent of Americans sided with the FBI in this case, 38 percent with Apple, with 11 percent undecided.

The government has access to some of the information on the phone, by way of an iCloud backup, but it appears Farook stopped backing up his phone some time before the shooting. Crucial information could exist on the phone revealing whom he communicated with, and about what. The government could deploy software to guess the password on the phone, but newer versions of Apple's mobile operating system (including the one on the phone in question) wipe the phone clean of data after 10 failed password attempts. The government wants Apple to create software to override this protective feature — and override, too, a separate security provision that forces lengthy delays between password tries. (New reports say, meanwhile, that Apple is working on technology that would soon make it impossible to do what the FBI is asking it to do in the Farook case.)

The Smith School professor William Rand, a computer scientist and director of the Center for Complexity and Business, has argued that creating "back doors" to encrypted devices for law-enforcement end up backfiring by making everyone's phone more hackable — including by bad actors. The government has denied that its request amounts to a universal back door; it says it wants help cracking one phone.  But Rand, echoing Apple, doesn't think that argument flies.

The special operating system Apple is being asked to make "is not particular to that one device," Rand says. "It could be installed on any device at all. And if it were ever to leak it would multiply. As soon as there were a couple of copies, it would be as if everybody in the world owned it."

The director of the CIA, John Brennan, has compared the FBI's request to asking a bank to provide a key to a safe-deposit box in a criminal investigation — a request granted routinely — but Rand says software is different. "It's a lot easier to keep a safe-deposit key protected," he says. "You can lock it up, and even surround it with armed guards, if you want. But as soon as software exists in one place it can be attacked from a number of directions."

"From a technical standpoint, I think it is better not to build these kinds of things than to build them and try to prevent them from getting out." (Of course, Apple may believe that Chinese laws do not need to be followed to the same extent, but China may not find that argument persuasive.)

The government has accused Apple of taking its position for marketing reasons, positioning itself as a champion of privacy while slighting public safety. Given the survey numbers so far, it's not clear that Apple's position has helped it with consumers. But Rand says that Apple may be playing a long game with respect to public opinion.  "If Apple accedes in this case," he says, "then it weakens their ability at any future time. Even if consumers are supporting the government in this instance, I think Apple is foreseeing a situation where consumers won't be supporting the government" — a case, for instance, where it looks as though the U.S. is snooping on Americans. "Apple is trying to avoid a situation in which it must say 'yes' to the government in such a case."

The clash raises interesting issues for businesses that issue iPhones to employees, because those companies may not want their phones to be locked down so securely, preventing investigations of wrongdoing. (Farook's phone is owned by the San Bernardino County Department of Public Health, and his terms of employment permitted a search of the phone at any time. The department has approved a search.) It would certainly be possible for Apple to build phones that do not have the security features that now exist in iOS, Rand says, but they might be of interest only to certain corporate consumers.

Rand also suggests that Apple may not be averse to hashing out rules for assisting the government in criminal cases, objecting, rather, to the assertion of open-ended authority by the government (rooted in a 227-year old law known as the All Writs Act). It has asked that an expert commission be convened to discuss the implications of episodes like this for privacy and national security. But some observers think Apple's position is quite absolute. "Apple has obstructed legislative efforts [to lay out such guidelines] at every turn, both here and in the U.K," write two commentators at the blog Lawfare.