Welcome to the MacNN Forums.

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

You are here: MacNN Forums > News > Mac News > Editorial: is the encryption battle over? Not by a long shot

Editorial: is the encryption battle over? Not by a long shot
Thread Tools
NewsPoster
MacNN Staff
Join Date: Jul 2012
Status: Offline
Reply With Quote
Mar 30, 2016, 11:55 AM
 
Those who might think the battle between the FBI, US Department of Justice, and Apple over privacy and security is over -- because the FBI withdrew its case on a claim that it found another way into a seized iPhone -- are wrong. Indeed, this battle has only just begun, and the public -- at least those who paid attention to this fiasco and understand the implications of it -- are taking up arms in the form of even-more secure apps, switching over to iOS from other platforms, and generally amping up their personal security as much as possible. Governments are going to hate it, but they only have themselves to blame.


The reason for this is because, until now, users of smartphones in the US have assumed that there are certain limits enforced by the US Constitution that prevent federal agencies other other government entities from going "too far" in efforts to investigate or prevent crimes. The case of the San Bernardino lawsuit against Apple -- in which the US government attempted to use the courts to force innocent third parties to weaken user security on all devices for the convenience of law enforcement -- has shown that we cannot count on the courts to follow the Constitution, and we cannot count on the apolitical entrenched bureaucracy of agencies like the FBI. These organization fail to understand either the complexities of modern technology, or simple appeals to think through their actions and the ramifications of what they want.



We here at MacNN have summarized the case countless times, but in a nutshell: despite warnings from other employees where the San Bernardino gunman worked that there was likely to be nothing of value on the left-behind work-issued iPhone, the FBI demanded penetration anyhow. They wanted to compel Apple to make a tool that could override the built-in security, despite information from the device having been already provided to the FBI by Apple itself, and by the carrier used by the San Bernardino County Health Department -- data that would have been sufficient to show who was called and when, who was texted and when. Even despite the fact that the work iPhone was deliberately not destroyed by the gunmen, unlike their personal devices, which strongly suggesting there was nothing of value there, and despite advice from Apple that if the agency hadn't screwed up its first attempt to obtain a backup of the contents, Apple could have provided them with that data, the FBI made claims in court that just don't add up, and may suggest that the agency was lying about their intentions all along.

Only when he was under oath before a congressional hearing did FBI Director James Comey admit that there might be nothing of value on this iPhone, and acknowledge that Apple would have to build a tool to defeat its own device security that the agency -- and many other agencies -- would use to work on other, much lesser cases. Up until that point, the FBI (like the DOJ before it in another, similar case) took pains to plant the seeds of public hysteria that it "had" to get into this iPhone because something "might" be there -- despite having previously cleared the two gunmen of having any actual connection to any terror groups or gangs, or having any co-conspirators. It was willing to backtrack on its own claims, and hint that broader evil lay hidden inside that seized iPhone, to bolster its case.

The agency re-classified the investigation from that of a workplace massacre carried out by two assassins -- one a US citizen, the other a Pakistani immigrant, both of whom could best be described as "Muslim supremacists" -- to a terror investigation weeks after the events, despite there being no actual connection. To be fair, after the attack the two gunmen posted of their sympathy with terrorist groups; but they represented no further threat, since both of them were killed by police after the attack. The re-classification seems to have been done solely to gain extraordinary powers frightened lawmakers long ago granted law-enforcement agencies only under any circumstances that could be called "terrorism."

Once a case is declared a "terror" investigation, the government can suspend habeas corpus, along with much of the Fourth Amendment of the US Constitution. It also allows the government to utilize that most un-American of concepts -- secret courts with the power to issue "silent" warrants, complete with gag orders on all participants, but with no chance for the accused to defend themselves -- to obtain evidence that would normally be thrown out of court, or gain search powers that would never be granted in typical cases. In this case, however, the FBI hit a wall: it could not force a third-party to do its investigative work for it, and it later claimed it could not do the work itself -- until it reasoned that using the All Writs Act in a new way might allow them to trump civil liberties concerns outright.



To be clear, we are not defending the shooters in this case: had they lived, they would have been prosecuted and punished for their crime in a court of law. Had they somehow escaped, we are sure they would have fled the country to join Islamic State or one of the other jihadist groups murdering non-extremist Muslims and westerners alike in an effort to seize power and oppress or destroy "heretics." What we find even more frightening than wanna-be terrorists in our midst, however, are government agencies that see civil liberties and the rights of US citizens as nothing more than obstacles to easy crime-stopping that need to be worked around.

Both sides in the dispute agreed that what the FBI was asking for was a way to defeat the security built into all models of iPhones, and that doing so would create a precedent that could be used in other cases, and that it could be discovered and misused by others. This put Apple in a difficult position: it must therefore insist on as close to absolute security as it can get, with no exceptions -- or there would be effectively no real security for any technology user anywhere, and the company would be reduced to spending all its time decrypting phones for anything from jaywalking cases on up, "just in case" there was other information that could be used on the devices.

By law, if the US government has a method by which it can reliably break into smartphones, foreign governments have strong legal grounds to demand the same. If other countries understand that the encryption on smartphones is not breakable by anyone, they can't make those demands. That was the state of detente, until the FBI decided its need to conduct a fishing expedition was more important than the security that encryption provides everyone, which led it to essentially call for permanently-weakened security -- for the US government, for the Chinese government, for the Iranian or Russian or North Korean government.



While we admire the optimistic albeit wishful thinking of leaders such as Director Comey that "there must be a way" to both have a backdoor into smartphones and yet still keep them secure, this simply reveals their tech illiteracy and lack of understanding -- not of technology, but of the raison d'etre of encryption at all. As others have put it, however, "either everyone has security, or nobody does." We are all for compromise where possible, but when it comes to security, as Apple says, there isn't any middle ground to be had.

Americans have traditionally understood that for every right and freedom they enjoy, there is a price and/or responsibility to be paid, a limit that stops absolute abuse so that the freedom can be sustained. The "price" of our right to bear arms is that many innocent people are shot and killed each year, including schoolchildren. The limit of our right to free expression is that you are not allowed to use that right to deliberately incite hate or start a riot. Likewise, the cost of our right to, in the words of the Bill of Rights, "be secure in our person and papers from unreasonable search and seizure" is that some people will, as with guns, abuse this right. Generally, however, it is considered a small price to pay for the larger benefit of liberty, privacy, and security.

Thus, the FBI -- despite their claims, and frequent omissions of relevant information, in their case before the judge -- knew very well what it was asking for. It seems clear to most outside observers now that the agency made a cynical decision to use the murder of 14 Americans to test the limits of the court system in bypassing Apple's rights under the First Amendment and other laws; the specific limitations spelled out in the Fourth Amendment, and the rights of all US citizens, criminal or innocent, under the Fifth Amendment. The only other option is to believe that the agency is naive and foolish, and we reject that notion.

The ruling from the judge in Brooklyn in a similar case, involving the DOJ trying to use the All Writs Act to force Apple to reveal the contents of a drug dealer's iPhone -- the dealer himself, who plead guilty, claims he can't remember the passcode -- was a clear signal that the FBI was unlikely to get far in its quest for extra-constitutional powers. If the agency had gotten its way, it would have gained the unassailable power to force companies like Apple, Google, Microsoft, and many others to compel their programmers to write code against their will -- a direct violation of the First Amendment -- for whatever the government decided they wanted, and most likely to do so under "secret court" gag orders going forward under the guise of the so-called "Patriot" Act. Is that a law enforcement community -- or an America -- you recognize or approve of?



In our view, there is little groups like IS could do that would be more damaging to the values of the United States, and cause more havoc worldwide, than to weaken the fundamentals of our governing documents and our personal security -- as the FBI and DOJ want to do. While we have faith that the courts would have eventually stopped them, our trust in all of these institutions is shattered by the notion that if a "stronger" case or more immediate threat came along, the courts and Congress might have been persuaded to give the judicial branch of government authoritarian and draconian powers far outside the self-imposed boundaries the Founding Fathers intended as a check against tyranny or a police state.

If reports about the company and methods the FBI eventually turned to for its "breakthrough" are accurate, we are even more dismayed; in part because this firm and technique of "NAND mirroring" has been known for years, but the agency appears to be more than decade behind in its technical knowledge, and secondly because it is entirely possible that they haven't cracked the iPhone at all, and have deliberately misled the court and the public in an effort to save face and exit an unwinnable situation until a better "test case" comes along.

There's a simple check to see if the FBI has been truthful in its claim that it found another way to "crack" the iPhone 5c at the center of the lawsuit: it can tell the public what it found, even if it was nothing at all. It can share with Apple how it "cracked" the iPhone. Neither of these things seem likely.

But assuming it was successful, it might now offer to take on those hundreds of other iPhones that New York Attorney General Cyrus Vance and others have said they "need" to crack into for various criminal cases. By Vance's own confession, none of them involve any imminent threat or danger, but will simplify criminal investigations. The Department of Justice said earlier this week that they were going to use the (now unchallenged) precedent they set in San Bernardino to try to compel Apple and other smartphone vendors to do their bidding, so given that, it seems that the court filing made to retract demands of help from Apple was a tactical move, rather than adherence to the principles of the law and Constitution.

We certainly understand that crime prevention and blocking potential acts of terror are what these agencies want to do more than anything, and we can't fault them for this. It would make their jobs much easier if any smartphone or computer, anywhere, at any time, for any reason, could be searched for potentially incriminating evidence. Proponents imagine a world where terrorism, molestation, premeditated murder, and mass violence are almost impossible; but the problem with this idea is that it is fundamentally un-democratic, and creating that world involves giving away our hard-won rights.

Like it or not, law enforcement has always been bound by the core principles of our Constitution and the laws protecting our rights of privacy. These tenets and rules, these checks and balances, do not make their jobs easy; they make them harder. It is the price we all must pay -- and the risk we must all accept -- for the greater good of a free society. This is not about one iPhone; it is about everything we say, create, store, or look at. If we are not "secure in our person and papers," we are a country adrift and divorced from the principles we formerly held dear.



It is a strange world we find ourselves in, where -- to paraphrase Edward Snowden -- we rely on large multinational corporations like Microsoft, which has previously fought governmental overreaches regarding email; ISPs, who have gone to court to block the release of user information for legal "fishing expeditions;" and now Apple, which has set the bar on user privacy we hope the entire industry will adopt, to protect us from abuses of our civil liberties perpetrated by our governments, instead of the other way around.
     
Flying Meat
Senior User
Join Date: Jan 2007
Location: SF
Status: Offline
Reply With Quote
Mar 30, 2016, 01:25 PM
 
Very well done.
Thank you.
     
   
Thread Tools
 
Forum Links
Forum Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Top
Privacy Policy
All times are GMT -4. The time now is 01:08 PM.
All contents of these forums © 1995-2017 MacNN. All rights reserved.
Branding + Design: www.gesamtbild.com
vBulletin v.3.8.8 © 2000-2017, Jelsoft Enterprises Ltd.,