Many people know my interests are at the intersection of the law and technology, and as a result, have asked my opinion on the merits of the FBI-Apple dispute. In large part because there was a lot of misinformation about the basic factual circumstances of the case, I wrote a short case summary here, but tried to remain neutral. Even as I wrote it, I really had no sense of which side had the better argument. I'll also add the obvious here, because sometimes it is not as obvious to others as it is to me: this is only my personal opinion and not work-related. It's worth what you've paid for it. I'll happily (ok, perhaps not happily) acknowledge I am wrong if the results come out contrary to my opinion.
On the other hand, most people in the tech and infosec communities chose sides in the FBI-Apple dispute pretty quickly. I was initially surprised that people's views were split as much as they were, even if it appeared (and still appears) that the split leans in favor of Apple (which is admittedly anecdotal evidence on my part). Upon further review, I am not surprised that views are as split as they are.
I took a lot longer to decide precisely because I am acutely aware of the nuances that often get lost in 140-character tweets or Facebook updates. In the end, from both my personal perspective and also what I think will actually happen, I think the FBI has the stronger argument. Apple is likely to draw out the process, but I think they will ultimately lose (although, speculating ahead, their best chance of winning may be at the Ninth Circuit if the case gets that far).
My decision is based upon the specific text of the Magistrate Judge's order, especially because it overcomes some of the more potent claims about what Apple is being asked to do. In an article entitled, "Why Lawyers Need to Stand By Apple" (which I cite because it was written by a lawyer addressed to other lawyers), we can see an example of what is being said about the case:
[Apple] is being ordered to create a master key to hack any iPhone on the planet.
Such an order is well beyond the scope of reason, and what the court is demanding Apple to do will ultimately undermine any hope of any of us ever having any privacy in the digital age.
This is not an exaggeration.
[Once Apple] creates the tool to break the encryption of any iPhone, that tool will be used again and again.
Emphases are mine. This is the core argument of the article. And it is disappointingly inaccurate.
According to the court order,
The court is requiring Apple to "provid[e] the FBI with a signed...Software Image File ("SIF") that can be loaded onto the SUBJECT DEVICE.... The SIF will be coded by Apple with a unique identifier of the phone so that the SIF would only load and execute on the SUBJECT DEVICE.
The court also gives Apple the option to do all of this at an Apple facility; meaning they could assist the FBI with this particular phone and then destroy the SIF without it ever being in the hands of the FBI or without ever leaving Apple's facility.
Could the FBI steal the SIF? Yes, but it wouldn't work on another phone without modification that it appears the FBI is not capable of doing. And if anyone ever found out that the FBI stole it, it is my belief no one would ever cooperate with the FBI again under similar circumstances, court order or not.
Neither would the SIF "break the encryption of any iPhone," or even this particular iPhone. This case doesn't really even have anything to do with encryption. The SIF would bypass or degrade software measures in place to prevent the auto-erase function from working, and from introducing delays after incorrect passcode attempts. It is true that even if and when Apple destroys the SIF, it will then still have actual knowledge of how to bypass these features--but do you really believe Apple doesn't already know? As others have pointed out, what they are being asked to do is already technically possible. They're not being asked here to do the impossible.
Using phrases like "this is not an exaggeration" does not grant your claims immunity from being exaggerated. In this case, it's worse than that: they're just not accurate. Moreover, words like "backdoor" are designed to elicit a certain response. The word has very negative connotations that , quite honestly, poisons the debate. Most infosec folks who hear the word "backdoor" will oppose it on its face.
I also recognize that this article doesn't represent everyone's views who is siding with Apple. I chose it partly because of it's outlandish claims and partly because I believe it captures a general perspective of how many people feel (even if not agreeing on the specific details).
You might also notice that I didn't discuss the Fourth Amendment in this blog post. There's a very specific reason why: the key issue in this case has nothing to do with the Fourth Amendment. The day after the shooting, the FBI sought and received a search warrant for a black Lexus. Pursuant to this search warrant, the FBI recovered an Apple iPhone 5C that was assigned to Farook but owned by his employer. The employer gave consent to the FBI to search the phone. So the FBI already has the consent of the phone's owner to search it. Likewise, Apple has no privacy interest in the phone. Anyone discussing this case as a Fourth Amendment issue should go back to law school or stop talking about it.
Let me last address the argument about "creating a dangerous precedent." That may, or may not, be true. Generally speaking, decisions at the District Court level don't hold a lot of weight as legal precedent (and this is just a Magistrate Judge's decision--not even an Article III federal judge). Yes, if this case were to make it up to the Ninth Circuit (or even the Supreme Court), it would have precedential value. But that argument is circular. Any case that is not squarely on point with another previous case will quite possibly have some value one way or another. That may be a policy argument, but it's not a legal one.
What remains clear from a legal perspective is that Apple has complied (at least) 70 times with court orders for technical assistance (presumably under the All Writs Act, but not necessarily clear from this transcript). The red meat in this case is whether Apple's technical assistance under specific facts of this case are an unreasonable burden to Apple. In those 70 cases, Apple already had the technical ability to extract information from older iPhones even while they remained locked. In this case, the iPhone 5c has additional security measures that would prevent Apple from cooperating in the same way. In one sense, the additional hurdles to cooperation are self-generated on Apple's part (which is good for Apple's customers, of course--no one would argue otherwise). The difference between those 70 cases and this one is an existent technical capability to extract information from a locked phone (which no one has seriously argued against) versus the unrealized, but technically possible capability to reduce the security measures on this particular iPhone so that the FBI can brute force the passcode. It's clear to me that the burden on Apple is greater now than it was for any of those previous 70 cases. But is it unreasonably burdensome? I believe, given the situation I described above, that a court will find it to not be such a burden. As a result, from my personal perspective and also what I think will actually happen, I think the Government has the stronger argument. Apple will be forced to cooperate.
Whether you agree or disagree--and I know many of you will feel strongly one way or another--feel free to comment or tweet. If you have a question that you're curious about that I haven't addressed--ask it. Free and open debate in a wide-ranging marketplace of ideas makes us a better place--regardless of which side you come down on.
