Apple v. FBI: Apple's Response

Apple has filed its motion to dismiss the court order that would compel Apple to write custom software to allow the FBI to bypass the security mechanisms on an iPhone 5c that possibly contains data from one of the perpetrators of the December 2015 shootings in San Bernadino, California.

This case is very complex and has many aspects to it. I will not try to ascertain every issue surrounding the case, but will try to point out the ones that I think are relevant.

The Facts

Below are the facts, as far as I can ascertain, about the case. If there are some that are relevant that I have omitted, or if some of these are not correct, please let me know.

• The Courts have ordered Apple to comply with an order that compels Apple, under the All Writs Act of 1789, to assist the Federal Bureau of Investigations (FBI) with defeating the security on the iPhone 5c in question in order to obtain the information on the device.
• The assistance being asked includes writing software that has never been written, nor would Apple willingly write.
• The iPhone 5c in question is owned by the San Bernadino County Public Health Department (SBCPHD).
• The iCloud password was changed by the SBCPHD at the request of the FBI.
• Apple suggested to the FBI to bring the iPhone to a known network (as in the SBCPHD wireless or the suspect's home network), to allow the iPhone to perform an iCloud Backup.
• Apple wanted to work with the FBI and asked the FBI to keep the request under seal. The FBI refused and made it public; thereby forcing the issue into the open.

Some of the FBI and Department of Justice (DOJ) Arguments

• This is a one-off case.
• This falls under the All Writs Act of 1789.
• Complying does not require much effort on Apple's part.

Some of Apple's Arguments

• This is not a one-off case.
• Would be an undue burden.
• Violates the First and Fifth Amendments of the Constitution.

The Motion to Vacate the Order

I read through the 65 page motion and a few passages really stuck out to me.

In addition, compelling Apple to create software in this case will set a dangerous precedent for conscripting Apple and other technology companies to develop technology to do the government’s bidding in untold future criminal investigations. If the government can invoke the All Writs Act to compel Apple to create a special operating system that undermines important security measures on the iPhone, it could argue in future cases that the courts should compel Apple to create a version to track the location of suspects, or secretly use the iPhone’s microphone and camera to record sound and video.

Having just finished re-listening to George Orwell's book, and the movie based on the book, 1984, if Apple is compelled to comply, we will very soon be entering into 1984 territory.

"As Apple has explained, the technical assistance sought here requires vastly more than simply pressing a “few buttons."

This is referencing the previous instances where Apple was asked to comply with bypassing the passcode for older iPhones running older versions of iOS. With these versions of iOS, the passcode on these devices could more easily be bypassed without much effort from Apple. What would equate to "pressing a few buttons".

But compelling minimal assistance to surveil or apprehend a criminal (as in most of the cases the government cites), or demanding testimony or production of things that already exist (akin to exercising subpoena power), is vastly different, and significantly less intrusive, than conscripting a private company to create something entirely new and dangerous. There is simply no parallel or precedent for it.

What the FBI is asking for is something that has never been done, nor has any company ever been compelled to do previously.

Under well-settled law, computer code is treated as speech within the meaning of the First Amendment...The Supreme Court has made clear that where, as here, the government seeks to compel speech, such action triggers First Amendment protections.

Apple is arguing, as far as I understand it, that since computer code is considered free speech, Apple cannot be compelled to create computer code, which is their first amendment right not to do.

Lastly, it will have to be signed with Apple’s cryptographic key verifying that it is Apple-authorized software. Absent Apple’s proper cryptographic signature, this device will not load GovtOS...Apple would not agree to sign GovtOS voluntarily because it is not software that Apple wants created, deployed or released.

This is similar to the one above. The only way for iPhones to be able to load software onto an iPhone is with Apple's cryptographic key used to sign software. Without this signature the software will not load onto an iPhone.

The virtual world is not like the physical world. When you destroy something in the physical world, the effort to recreate it is roughly equivalent to the effort required to create it in the first place. When you create something in the virtual world, the process of creating an exact and perfect copy is as easy as a computer key stroke because the underlying code is persistent.

This argument is one of Apple's primary concerns. If this was a "one off" creation, as the FBI states, Apple could destroy the software. Unfortunately, it's not that easy. Apple would likely be required to retain the code, along with all of the accompanying documentation to be able to indicate in a court how it went about creating the software. This would require them to have documentation about this as well, meaning that Apple could not simply "destroy" the software after its use.

The All Writs Act, first enacted in 1789 and on which the government bases its entire case, “does not give the district court a roving commission” to conscript and commandeer Apple in this manner...In fact, no court has ever authorized what the government now seeks, no law supports such unlimited and sweeping use of the judicial process, and the Constitution forbids it.

Apple is arguing that the use of the All Writs Act does not apply in this case because it would give the FBI and other law enforcement agencies the ability to do whatever they want, whenever they want.

In addressing the twin needs of law enforcement and privacy, Congress, through the Communications Assistance for Law Enforcement Act (CALEA), specified when a company has an obligation to assist the government with decryption of communications, and made clear that a company has no obligation to do so where, as here, the company does not retain a copy of the decryption key. 47 U.S.C. § 1002(b)(3). Congress, keenly aware of and focusing on the specific area of dispute here, thus opted not to provide authority to compel companies like Apple to assist law enforcement with respect to data stored on a smartphone they designed and manufactured.

Since Apple does not retain the decryption key, it is not able to meet the requirements. The decryption key is derived from a Unique Identifier (UID) that is created during the fabrication process, and the user's passcode. Apple never knows the UID, and without this, it is nearly impossible to break the encryption without the passcode.

The last one, is just a funny one.

Indeed, as the Supreme Court has recognized, “[t]he term ‘cell phone’ is itself misleading shorthand;...these devices are in fact minicomputers” that “could just as easily be called cameras, video players, rolodexes, calendars, tape recorders, libraries, diaries, albums, televisions, maps, or newspapers.” Riley v. California, 134 S. Ct. 2473, 2488–89 (2014) (observing that equating the “data stored on a cell phone” to “physical items” “is like saying a ride on horseback is materially indistinguishable from a flight to the moon”).

It is a good analogy. A "Cell Phone" these days are being used as a phone less and less. The functions are well beyond this these days. The comparison is quite accurate.

My Thoughts

Before I read Apple's arguments, I decided that I was on the side of privacy and security. After reading Apple's arguments I stand by this opinion even more. I think Apple makes a compelling case against having to follow this order. What the FBI is asking Apple to do, Apple does not want to do. It goes against their core principles of privacy and security for their customers. Furthermore, it goes against what the Supreme Court has already ruled is permissible under the All Writs Act of 1789.

As Apple has argued, it is not up to the federal government agencies to be given carte blanche to use any method that they want to gain access. Congress has already written the laws to restrict what law enforcement agencies are able to do.

This fight is long from over and will not be settled anytime soon. It is entirely possible that it will make its way to the Supreme Court. We shall see. It is likely that there will be future posts regarding this case in the future.

Update February 29th, 2016

I wrote a majority of this story last week when Apple responded, but had not been able to post it until now. Today has brought an interesting change. In a similar case to the one in San Bernadino, there has been a ruling by Magistrate Judge James Orenstein. The case involved the government used the argument of the All Writs Act of 1789 to compel Apple to bypass the passcode on an Apple iPhone. This one was for a case involving drugs.

Judge Ornstein has denied the government's motion. His introduction states:

The government seeks an order requiring Apple, Inc. ("Apple") to bypass the passcode security on an Apple device. It asserts that such an order will assist in the execution of a search warrant previously issued by this court, and that the All Writs Act, 28 U.S.C. § 1651(a) (the "AWA"), empowers the court to grant such relief. Docket Entry ("DE") 1 (Application). For the reasons set forth below, I conclude that under the circumstances of this case, the government has failed to establish either that the AWA permits the relief it seeks or that, even if such an order is authorized, the discretionary factors I must consider weigh in favor of granting the motion. More specifically, the established rules for interpreting a statute's text constrain me to reject the government's interpretation that the AWA empowers a court to grant any relief not outright prohibited by law. Under a more appropriate understanding of the AWA's function as a source of residual authority to issue orders that are "agreeable to the usages and principles of law," 28 U.S.C. § 1651(a), the relief the government seeks is unavailable because Congress has considered legislation that would achieve the same result but has not adopted it. In addition, applicable case law requires me to consider three factors in deciding whether to issue an order under the AWA: the closeness of Apple's relationship to the underlying criminal conduct and government investigation; the burden the requested order would impose on Apple; and the necessity of imposing such a burden on Apple. As explained below, after reviewing the facts in the record and the parties' arguments, I conclude that none of those factors justifies imposing on Apple the obligation to assist the government's investigation against its will. I therefore deny the motion.

This ruling likely means that the case will be appealed, Even so, this ruling will likely bolster Apple's case in San Bernadino.

There is also this footnote from the Judge:

In considering the burden the requested relief would impose on Apple, it is entirely appropriate to take into account the extent to which the compromise of privacy and data security that Apple promises its customers affects not only its financial bottom line, but also its decisions about the kind of corporation it aspires to be. The fact that the government or a judge might disapprove Apple’s preference to safeguard data security and customer privacy over the stated needs of a law enforcement agency is of no moment: in the absence of any other legal constraint, that choice is Apple’s to make, and I must take into account the fact that an order compelling Apple to abandon that choice would impose a cognizable burden on the corporation that is wholly distinct from any direct or indirect financial cost of compliance.

The judge is absolutely correct in this. This is the type of Judge that we need not just on the lower courts, but also on the Supreme Court.

To read the full ruling, you can go here. It is a full 50 pages for the response.