Hacker News Reader

It is not settled law in the U.S. whether being forced to handover a password is "contempt of court" or actually self-incrimination protected by the Fifth Amendment.

Wiretaps ordered into the U.S. phone and internet networks via CALEA and FCC rulings, which basically meant that all network and phone switches internationally would have the back door. (See what happened to Greek politicians thanks to that). But the phone portion of those rules came from a very deliberate act of Congress. (Don't get me started on CALEA and the Internet...)

The All Writs act is vague as hell.

And there are definitely laws that require legal process; your telephone records, for one. That's why the Congress passed a law retroactively immunizing AT&T, Verizon, et. al. for helping the NSA collect communications data on American citizens in plain violation of communication privacy laws.

In this case, NOTHING is straightforward. Apple could win on First Amendment grounds; the assistance asked for could be determined to be too burdensome. The Fourth Amendment may not even be an issue.

I'm not even sure this will go to the Supreme Court. If the feds lose, they may well choose NOT to appeal on purpose so they can continue browbeating companies with All Writs act in other jurisdictions and under seal.

What seems to be settled though is that people can be ordered to unlock their phones with a fingerprint… despite possible self-incrimination: http://www.dailydot.com/politics/virginia-fingerprint-key-di...

That's still not "settled." That's one state court ruling. Other states could rule differently. A federal court in that district could rule differently.

That said, if your threat model involves anyone technically sophisticated or any government actor, I would suggest not relying solely on a fingerprint ID to control access to a device.

The legal question here is really whether the All Writs Act can be used to compel development of new products with specific features law enforcement desires, because that's what it boils down to: they want a custom iOS build with custom security-bypass features that can be loaded onto any phone they want to snoop into.

And when framed like that -- government ordering a private company, without negotiation or contract or even agreed-upon -in-advance compensation, to develop a product -- I don't think there's a chance in hell of it standing up. The question is whether the court that ends up hearing the final appeal will frame it like that.

How is it different than getting a phone company to install a wire tap?

What you describe is not what's being asked for. What the FBI wants is a tool to get into this phone. They will definitely want to get into more phones in the future, but that's not the same as a single tool that gets into any phone. It can be a new one every time. If it wasn't possible to make such a tool, I'd be a lot more outraged. But it is. Tell me why that can't be done.

The difference is that tools and equipment for wiretaps already exist. Tools that bypass the security features of more recent versions of iOS don't. Hence the FBI's desired insecureOS would be a new product, developed under compulsion from the FBI and the courts.

The difference is simply that telecommunications are heavily regulated (see CALEA) where if you want to be a service provider you have to provide wiretap functionality.

Personal computers in general are not covered by any such regulation. It is legal to create and use encryption on your own device without building in a government backdoor. For now.

Ironically, the biggest threat to an unregulated computer future is the massive centralization of device control via platform DRM, in the hands of just a few companies like Apple.

CALEA was extended to ISPs once the industry coalesced into a much smaller number of central players.

> Essentially you will have to argue that compelling a company to create an exploit to satisfy a warrant constitutes an unreasonable search if that exploit can also be used to perform illegal searches.

From the majority opinion in another All Writs case that made it to the Supreme Court[1]:

"[The lower court] was apparently concerned that sustaining the District Court's order would authorize courts to compel third parties to render assistance without limitation regardless of the burden involved and pose a severe threat to the autonomy of third parties who for whatever reason prefer not to render such assistance. Consequently the Court of Appeals concluded that courts should not embark upon such a course without specific legislative authorization. We agree that the power of federal courts to impose duties upon third parties is not without limits; unreasonable burdens may not be imposed."

[1] https://www.law.cornell.edu/supremecourt/text/434/159

Key point: unreasonable burdens may not be imposed

The order also said:

"The order provided that the Company be fully reimbursed at prevailing rates, and compliance with it required minimal effort on the part of the Company and no disruption to its operations"

So the FBI could be expected to reimburse Apple for weakening its product and future earnings.

More details on that specific case as it relates to Apple vs. FBI are available from a post by a computer crime law professor [1]

[1] https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

I don't think the question turns on unreasonable searches. Apple isn't being searched here.

Instead, the question is whether the All Writs Act grants sufficient power to compel a company, third-party to the action, to build a tool for breaking into its product. This is different to your telephone interception example, because that interception is authorised by a specific statute, not using a general writ issued under the All Writs Act.

The argument here is executive overreach - that they should be asking the legislature to pass a law specifically to require this kind of assistance, rather than using the All Writs Act.

The thing is, Apple made a phone with a backdoor. It has a backdoor already. Unlocked by apples software signing keys. If Apple wants to continue to do that, but wants to mostly respect their customers' privacy, they need to create a facility to unlock it selectively upon seeing a warrant. It really isn't that hard to do, since they can make firmware updates that only work on specific devices. It can and probably will be argues that this is exactly like wire tapping, where it is up to the telecom to actually demand a warrant before giving the gov access.

It would be neat if the supreme Court would say this is unconstitutional on some ground, because that would seem to apply to other forms of wiretapping. They aren't fundamentally different. I'm sure the first time the gov asked a company to help them install wire taps, it seemed like a big deal.

I think some people are being intellectually dishonest when they say a backdoor can't be created without sacrificing security for everyone else. It can be done such that your privacy on an iPhone is just as good after a backdoor is created as it was before. Which is to say, not perfect because Apple had the key either way. If you want real security use a good passcode and keep it in your head.

You misunderstand. Apple can't unlock the phone with the signing keys, all they can do is make it easier to brute-force the passcode. If this person had used a long passphrase instead of a 4-digit code, even this software hack wouldn't help.