Hacker News Reader

1) Merely creating the software/firmware in the first place is extremely dangerous, allowing for a failure point of any engineer or custodian of the firmware to leak it, destroying everything.

2) The strong precedent will be set that governments can get whatever they want from our devices by whatever means necessary, and it will only get worse.

"The cynic in me thinks that this letter is more about brand image."

The cynic in me agrees. My cynic also notes the sudden indifference to corporate power publicly defying a federal judge. I cynically believe that if the shooters had been fundy white supremacists Apple would have quietly dumped the phone long ago.

Cook is no dummy and picks his battles with care. That's why he makes the big bucks.

If Apple doesn't fight this, a precedent will be set, allowing for the government to compel companies to release user information or ways of circumventing encryption in the future.

2) the government doesn't need to have access to the firmware for it to become dangerous, the sheer fact that this can be created is dangerous. What's to stop a determined, hacker from doing the same thing in the confines of his/her bedroom once it's confirmed that this is possible?

The problem is that once created, it would be easier for future warrants to ask Apple to simply re-perform the same trick it's done in the past. Apple's core argument is that allow this once opens the door to doing it repeatedly because right now Apple doesn't have the toolchain to do this. Once the toolchain exists, its deployment is trivial.

> The problem is that once created, it would be easier for future warrants to ask Apple to simply re-perform the same trick it's done in the past.

That's not a problem at all. The issue is how the existence of the tool affects warrantless access.

Where did we get the idea that it's bad in itself for law enforcement agencies to be able to break crypto when they have a warrant?

Because breakable crypto isn't crypto?

Outside the all writs act, parties generally can't be compelled to perform activities by the court that they don't already perform in the course of business. So this is significant (warrant or otherwise) because it's the court asking apple to create a process de novo that didn't exist before.

So? At least in American jurisdiction, the 4th Amendment doesn't guarantee the right to unbreakable crypto. It says:

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

Upon probable cause, the government may issue warrants. The US government, backed by the people of the United States, have a right to compel a private corporation to comply with reasonable searches and seizures on probable cause with a warrant.

The government is not asking Apple to deploy nuclear weapons, nor ship all iPhones with a hack. They are specifically asking for help with one vulnerable phone, an iPhone 5C. They may be asked to do this multiple times, but they can keep whatever engineers and tools they use internally private.

I mean, let's get real for a second. The toolchain already exists. Apple has the source code, hardware simulators, debugging harnesses, and the original engineers. There's no magic. As long as those things exist, the danger of a hack getting public is real, especially if the source for iOS is ever stolen, or one of the core engineers goes rogue. If Apple's own internal security can't keep a more polished tool under wraps, they won't be able to keep the subcomponents of it under wraps.

There's a reasonable middle ground between "government has a backdoor and can scan and read everything" and "it's impossible for the government to even obtain legal warrants on probable cause for a very targeted piece of information" What's being discussed in this case is not Snowden-level drag-net snooping. We're not even talking about a wire-tap. We're literally talking about the government finding a Safe/Vault inside the house of a murderer, and talking to the manufacturer of the Safe/Vault to get them to pick the lock without destroying the evidence inside. The Vault-maker in this scenario doesn't even have to give over the blueprints of the proprietary lock mechanism, they just need to open this one vault.

>I mean, let's get real for a second. The toolchain already exists. Apple has the source code, hardware simulators, debugging harnesses, and the original engineers. There's no magic. As long as those things exist, the danger of a hack getting public is real, especially if the source for iOS is ever stolen, or one of the core engineers goes rogue. If Apple's own internal security can't keep a more polished tool under wraps, they won't be able to keep the subcomponents of it under wraps.

>As long as those things exist This is false. Apple could hand you all the things you mentioned and you still wouldn't be able to break an iPhone 5C. You would still need Apple's master private encryption key.

As you are framing the question, is, the government should force Apple to hand over their private encryption keys. If thats so, should citizens in other countries be wary of the fact that their data stored in Apple servers are privy to the US govt? Or should Americans be worried that China can coerce Apple to hand over encryption keys?

In terms of global politics, The vault maker in this scenario has to worry about other strong men asking for such a master key when they need to hunt down gay men or something as trivial, once they realize this is possible.

No, I'm saying Apple shouldn't hand over their encryption keys. I'm saying the FBI should hand over the iPhone, and Apple hands back the files, but doesn't give them any hacked phone.

In a paperless world, and unbreakable encryption, what is the point of warrants or regulations at all?

If a company that say, committed crimes, financial or criminal, has a warrant served on them, what if the response is, "Hey, we'd love to give you our emails, but all employees use end to end encryption, and every desktop has unbreakable filesystem crypto, and our IT department can't unlock anything, so you must compel the users to hand over keys?"

Can that be a defense against all warrants and crimes? If politicians are suspected of accepting bribes with strong probable cause, do we simply accept that their phones and email communications with lobbyists and corrupt bribers can't be accessed?

What does society resort to then, rubber hose cryptanalysis? Imprisonment on lack of evidence until they turn over the keys?

Transparent democracy is on a crash course with cryptoanarchy. The same people who are chanting for absolute unbreakable cryptography are some of the same people supporting Bernie Sanders and would rail against offshore Cayman or swiss financial obfuscation by the mega rich.

If we want non-corrupt government and industry, we need a way to investigate serious crimes. In the past, this meant seizing papers, letters, and records under warrant. Nowadays, it may be possible for the entire digital crime trail to be unbreakable with no recourse except catching people in the act. However, when the FBI entraps people with sting operations "in the act", civil libertarians decry that too.

So how do we police the bad? If you look at many third world countries with trouble advancing, a lot of is due to corruption. Is the danger of the government subpoenaing your email worse than the danger of tens of thousands of corrupt businesses spreading financial risk all over the economy and political system?

>If a company that say, committed crimes, financial or criminal, has a warrant served on them, what if the response is, "Hey, we'd love to give you our emails, but all employees use end to end encryption, and every desktop has unbreakable filesystem crypto, and our IT department can't unlock anything, so you must compel the users to hand over keys?"

Are you an American or Foreign? In the American constitution, the 5th amendment, legally protects a party from being forced to incriminate one self. So if you are still alive, and slapped with a warrant, your rights protect you from giving up your private key.

I'm aware of the 5th amendment, but prosecutors have worked around it and journalists have gone to jail to protect sources. http://www.rcfp.org/jailed-journalists

Consider the various ways to police crime:

1: Before the fact, preemptively. Active surveillance and-or entrapment. Widely criticized.

2. After the fact, forensic analysis. Previously, physical evidence collected, warrants for documents. In digital realm, foiled by cryptography. Attempts by government to restore status quo to pre-digital capabilities widely criticized.

3. Compulsion. Prosecutors lean hard on individuals with digital evidence to turn over materials. Runs afoul of 5th amendment and civil libertarians.

At least for many types of crime, especially white collar crime, this leaves the authorities almost no recourse. Your politicians can communicate securely with their paymasters, and receive untraceable payments over bitcoin. Although you may find HUMINT witnesses who can give you probable cause, there may be no way to obtain real evidence.

The Silk Road founder was only caught because of active surveillance, literally caught him with his computer unlocked. This would be like waiting for the San Bernardino killers to unlock their iPhone, and them seizing it before the auto-timer relocked the screen. Not exactly possible for all types of crimes.

Is active physical surveillance of suspects by the state any less creepy than digital warrants?