When a young married couple killed 14 people at a holiday party in San Bernardino, California, the legal implications of encryption and Apple’s business model must have been the furthest thing from the minds of anyone involved.
But since the death of Syed Farook and his wife Tashfeen Malik in a hail of bullets last December, Farook’s iPhone has become the battleground for one of the most important fights in tech policy, and, for its manufacturer, potentially one of the most costly.
Technology may hold the key to this horrific case, the feds believe. In the request to the court to force Apple’s assistance, attorneys for the government write: “[T]he FBI has discovered, for example, that on December 2, 2015, at approximately 11:14 a.m. [15 minutes after opening fire], a post on a Facebook page associated with Malik stated, ‘We pledge allegiance to khalifa bu bkr al bhaghdadi al quraishi,’ referring to Abu Bakr Al Baghdadi, the leader of Islamic State of Iraq and the Levant.”
What more might Malik have known, and is it locked in her husband’s phone?
The Department of Justice says that Apple is the only entity that can help them, and so it wants the tech company to intentionally and thoroughly undermine their own security – “something that would have an impact on this one device”, as the White House press secretary, Josh Earnest, put it on Wednesday.
But for Apple, this is a battle that extends well past one iPhone. Apple sells a lot of things – 74.7m iPhones in the last quarter, for example – but its biggest selling point these days is privacy.
As it goes to war with the Department of Justice over whether it should be compelled to build software that will allow it to break into its own devices, the company is having to defend a core philosophy of the most successful business model on Earth: that no one, not even Apple, should be able to look inside your phone.
In part, the quest to build devices that can be sold on the promise of greater security is a point of differentiation between Apple and its competitors. Apple’s CEO, Tim Cook, has heaped scorn on Google, which proudly scrapes user activity from Gmail and other services and sells advertising against it: “A few years ago, users of internet services began to realize that when an online service is free, you’re not the customer,” he writes in the introduction to Apple’s privacy page. “You’re the product.”
Cook was even harsher in his criticism of the FBI’s demands. “The United States government has demanded that Apple take an unprecedented step which threatens the security of our customers,” he wrote in a letter to customers on Tuesday. “We oppose this order, which has implications far beyond the legal case at hand.”
The FBI finds the centrality of privacy to Apple’s business model contemptible. “Based on Apple’s recent public statement and other statements by Apple, Apple’s current refusal to comply with the Court’s order, despite the technical feasibility of doing so, instead appears to be based on its concern for its business model and public brand marketing strategy,” wrote the bureau’s lawyers.
The invective came in a second motion similar to the first, in which FBI counsel admitted that the brief was “not legally necessary”. They explained their reasoning thus: “[T]he government files this noticed motion to provide Apple with the due process and adversarial testing it seeks,” they wrote.
Cook has made clear the fight for privacy is in some ways a personal one. He has spoken out on the importance of civil rights on numerous occasions and is fundamentally committed to protecting his customers’ right to privacy. It’s a stand that extends to customers he, and most everyone, would rather not have.
“People have entrusted us with their most personal information,” Cook said moments before Barack Obama spoke at a government-organized cybersecurity summit last year. “We owe them nothing less than the best protections that we can possibly provide by harnessing the technology at our disposal. We must get this right. History has shown us that sacrificing our right to privacy can have dire consequences.”
Apple’s position is winning support from some likely, and unlikely, quarters. That the planet’s largest company by market cap would plant the flag on privacy has galvanized activists throughout the tech world, including those who don’t typically align themselves with major corporate interests.
Cindy Cohn, executive director of the Electronic Frontier Foundation, said that the Justice Department’s order, which requires Apple to digitally sign software that will subvert its central privacy systems, is anathema to anyone who values technical security. “This is a pretty huge thing they’re asking Apple to do, which is not just write the code but write the code and then lie about it.”
Fight for the Future, an internet rights activist group, said it would hold rallies outside Apple stores next Tuesday in solidarity with the tech company. “Governments have been frothing at the mouth hoping for an opportunity to pressure companies like Apple into building backdoors into their products to enable more sweeping surveillance,” wrote Evan Greer, the group’s campaign director.
No less an advocate for domestic spying than Michael Hayden, the former head of the National Security Agency and the Central Intelligence Agency, said he couldn’t side with the FBI on the topic. “I think [FBI director] Jim Comey’s wrong,” he said.
“The overall health of the American computing industry is a far more strategic advantage to the security mission of NSA than any specific tactical operational transient advantage we would have if our computer was bigger than their computer,” Hayden said in a video interview published on Wednesday.
Of course, Apple’s position on encryption has hardened since it was revealed by the Guardian that the company was among the tech firms compromised by the NSA itself. After the Guardian first revealed the extent of the tech industry’s collusion with the NSA’s spying program, Apple changed tack. Once the company could access all its devices remotely. Now it was introducing ever tougher encryption with the aim of ultimately making it impossible for even Apple to crack your iPhone.
“Really, the government is asking Apple to revert back to the model it had before,” said Darren Hayes, director of cybersecurity at Pace University’s Seidenberg School of computer science and information systems.
Parts of Apple’s architecture are still open to search warrants. Indeed, in this specific case, FBI agents appear to have reviewed the iCloud account associated with Farook’s phone.
But the firm has closed several other doors, notably by developing hardware and software that don’t work with the lockscreen bypassing program that used to be available to police. “For all devices running iOS 8.0 and later versions, Apple will not perform iOS data extractions as data extraction tools are no longer effective,” the company wrote in a guideline document for US law enforcement issued on 29 September last year (iOS 8 began rolling out the previous year).
Apple hasn’t explicitly said that this change is the reason for this lawsuit, but it has said the government’s assurance that it wants Apple’s house keys just this once are lies. An Apple executive told the Guardian that the very specific software outlined in the DoJ’s appeal would allow easier access to any of its iOS systems, even its most recent phones. In essence, it’s being told to build a new version of the break-in program it purposely made obsolete.
Apple is trying to make a rock so big it can’t lift it. But in the case of Farook’s iPhone, the DoJ has developed such a technically sophisticated workaround to Apple’s impressive security that it could undermine even features on newer models than Farook’s, like Secure Enclave, a computer-within-the-phone that is isolated from the main system and holds one of two entangled keys required to unlock the device.
A person with knowledge of the matter said that it is at least theoretically possible that the changes requested in the order could be implemented on any phone. As sophisticated as iPhones are, the source said, the only way to make a device invulnerable to a malicious software update by the manufacturer would be to hardwire it: The alterations could potentially be implemented in hardware, but then users couldn’t configure them to their own security purposes.
That, like the iPhone, is not a box Apple wants to open. The company’s legacy is in many ways bound up in its ability to make good on its promise of privacy without giving special treatment to any one government, especially as it tries to pry open China while the western smartphone market matures. If it cracks in this case, who can trust that any update will come from Apple and not the local government?
guardian.co.uk © Guardian News & Media Limited 2010