They all have a stake in tech, and they all would not like to have their tech backed up by a system, that anyone can get into if one person leaks it out. DMV, the police, all those poorly secured systems that are now basically a new RFC that is for publicly routable address space that everyone treats like private address space, but just insert your special gummy bear finger print copy, and bam, you are in.
Get all those companies behind this, and people will think the FBI are crooks and theives.
https://en.wikipedia.org/wiki/Health_Insurance_Portability_a...
HIPAA privacy protections only apply to data held by HIPAA "covered entities", which are mostly insurers, health care providers, and their business associates, and they restrict disclosures by those covered entities.
As it stands, meeting encryption feels more like spotting Waldo than actually meeting encryption.
(PS: Hi, James!)
Are remote "software updates" to a buyer's phone, under the sole control of the seller of the phone, at any time (even after purchase), for any reason (e.g. the one being proposed here), a good idea?
Why? Why not?
Should Apple customers be given the option to flash the hardware they purchase from Apple with their own choice of software, whereby they might better control the HW and hence secure it from Apple and other third parties?
Or should Apple have the _exclusive_ right to flash the HW they sell, even _after_ purchase, without the customer's consent? As they do now.
Open hardware. Bad? Good? Necessary?
A better question is how to further lock the phone down in future updates so that Apple can't comply even if they were compelled to, something Apple engineers are no doubt looking into right now. The optimal way would be to require a device to be unlocked to update the firmware, which would require the PIN, which Apple would not have.
Open means that the owner of the device can replace the firmware. There's nothing not-open about requiring that the owner authenticate first.
It's only not open if the vendor, rather than the owner, is the only one who the device will permit to replace its firmware.
It means that a small minority of owners of the device can replace the firmware. Most people don't have the resources to do something like that.
Sure, only a small minority of device owners can actually make new firmware, but fortunately only one of them needs to make and distribute some firmware for everyone to be able to install it, if the device is open.
No, even if they personally don't want to touch the engine, they turn to knowledgeable friends/family or pay a professional mechanic to do the work.
This unfortunately-common view that most people should never even have the option to do anything technical is insulting and maybe even monopolistic (it bans 3rd party repairs/parts).
"FBI wants ability to steal dick pics from any iPhone, including children's phones!"
For those who are new, previously on hacker news https://news.ycombinator.com/item?id=7312212
But yeah, remember the scandal about school admins potentially being able to use the laptop's anti-theft programs to spy on children? Imagine that for all children worldwide.
For europe and the rest of the world, the answer was a resounding YES by the american government, their intelligence agencies and the american people at large, and it came years ago. So, this is not about their customers or their rights or any other abstract moral universals (which are valid only within the US). I wouldn't read too much into it, although i think it has to do with an attempt to restore the shattered image of US companies to their international audience.
The first is a possibility, of course. I don't think the second is likely. I personally do not plan to stop shouting about this, and informing my representatives on my position.
That's far too long and complicated for average citizens to parse and grasp implications immediately and intuitively. The second half of your question veers heavily into leading a person toward the conclusion you want them to have. Not ideal. Moreover, I think an average poll responder would get confused by the second half of the question as you've phrased it.
Perhaps try to phrase it like a simple headline or poll question that gets to the heart of the matter:
"Should government be able to force companies to change or disable your passwords?"
Here, I think, you have a much greater chance of grabbing the attention of the casual onlooker. Admittedly, it's a mostly true statement of the core issue here, while leveraging the need to hook a reader at a glance. An article/reporter/anchor can dive deep into the case particulars or not, cover and present its view of what's at stake in asking the question, include discussion of a "right to security" that may or may not be enjoyed by companies and individuals. But you want citizens to immediately grok what you're asking, and be able to, on their own, extrapolate possible implications that matter to them. This is going to be far more powerful in getting people to invest themselves in the issue--they must be able to imagine, see, understand that what's at stake could affect them.
The first half of the battle is this: You've got to get people to fucking care. And you can't get them there if you confuse or lose them at the start.
And phrased like that, everybody will answer yes.
The dire implications of this case are not that easy to explain to someone who doesn't understand the basics of encryption/security. Welcome to give it another try, though...
The normal, non-technologists I know would most certainly find the idea that their passwords could be changed against their will--or, in the absence of their assent after death--pretty unsettling and inherently wrong. It's relatively trivial to provide analogous (though not entirely homologous) situations--e.g., should the government be able to force your mortgage company to change the locks on your house so they can get in to execute a search warrant?--that people would have immediate pause and find it worth considering. I don't know many people who would just thumbs up the suggestion that Facebook could be forced by the government to change/disable their account password. Or their banking passwords, email password, etc. If people became aware of a national conversation focused on the government trying to secure the power/precedent to force Facebook, Google, Apple, etc. to change/disable their passwords via a court order, I think very many more people will refuse to accept such an issue at face-value.
> The dire implications of this case are not that easy to explain to someone who doesn't understand the basics of encryption/security.
HN is a predictably poor place to discuss gaining widespread understanding by the masses on certain things. We too often fall into the trap of thinking that people must understand technical details of some thing X in order to understand implications of related thing Y. I think this is nonsense. People don't need to understand all the math and physics behind rocket science to understand that an unexpected explosion during liftoff has dire implications. We can explain that to people without ever showing them an equation, or talking about scientific laws/principles. There is no reason we cannot have a meaningful and productive conversation on this issue without losing the majority of American citizens as soon as we bring up the technical details.
Technologists haven't gotten much of anywhere getting the average American to understand, much less know why they should care about, encryption. Hell, we still engage in arguments here on HN about why you shouldn't roll your own encryption, even though all the programmers out there should already know that. We simply aren't going to get anywhere saying we first have to educate normal people on encryption. And it's plain wrong to think that an issue like this needs to be framed within a context that requires people to understand the basics of encryption. That's a no-win trajectory for carrying on a public conversation. You simply have to appeal to people using language that isn't overly biased, presents issues in the simplest possible ways (and builds up from there), and actually gets them involved in the conversation. It would, without any doubt, be fantastic if more people understood encryption, digital security, digital privacy, etc. But Average Joes and Janes don't really think about the devices and services they use in that way. I know a great many people who are [what I think are] normal, non-technical citizens, and their eyes just glaze over at talk of encryption--much like how many people's eyes glaze over at seeing mathematical equations, as if they're looking at Japanese.
The reason there is a higher propensity among potential Average American poll respondents to support the FBI on this issue is the way it's being framed. All I'm saying is that it's just as possible, and actually necessary, to frame the issue in a way that helps average Americans understand the dire implications of this case without having any need for understanding the basics of encryption, iOS, the Secure Enclave, trusted/signed code from Apple, and everything else that most HNers are discussing here.
Is that what you got from my post? Because it's not what I meant at all. I don't believe people have to understand the technical details behind it, but they do have to understand that the FBI forcing an unlock sets a very bad precedent which would massively diminish the security of the iphone/next iphone and this would apply to everybody, not just the tewwowist, AND that they're using a super old obscure shady law to back all that. There is a lot of data to understand and you can't easily grasp that from a single, short sentence.
If you had the ability to create information that could help in an investigation, should the government have the power to compel you to create it?
I think getting people involved in understanding this aspect of the case is critically important, as this is the part of the case that would be precedent-setting and [I believe rightly] concerns Apple and others with the requisite technical background. The danger is this precedent could be extended in untold tangential ways outside the realm of preventing device-wiping after n failed password attempts.
The trouble here, to me, is a majority of the average citizen who wonders what the All Writs Act is aren't going to bother finding out. They'll just accept the government's position that it allows them to ask for what they're asking. A smaller minority of those same citizens might go look up the All Writs Act, are probably not going to understand what it means. "What's a writ?" Hmmm. "What's "an alternative writ or rule nisi"?" I don't even understand what this means, much less how it applies. Oh well." Average people aren't going to become armchair legal (or encryption) experts overnight to resolve in their head where they stand on this issue. Thus, they're probably going to choose the path of least mental resistance, which will look something like, "Well, it is a terrorist's phone ... and I'm not a terrorist, so this probably doesn't actually affect me in any way ..."
Anyway, I think you're definitely on the right track with this part of the order, and the specific law invoked. We just have to get that into simpler terms an average American can understand, minus the expert/legal/technical jargon, and then get them to understand the implications. Your questions and phrasing are pretty good starters, I think. I can imagine, with perhaps a wording change or two for personal taste, I could ask a non-lawyer, non-technologist that question and they'd react with something like, "Why the hell should the government be able to force me to create something that doesn't exist so they can conduct an investigation?"
And that's exactly where we want people to be on this part of the issue at hand.
...or maybe people understand the debate, and they simply disagree with your opinion on the matter.
For example, even as phrased in the second form, my answer is "yes, sometimes", with an additional "there is no such thing as a 'customer's right to security'", added for good measure.
Even if I believed there were an absolute "right" to security, I don't think it's Apple's job to enforce it.
I agree it should be the user's job and not Apple's to enforce security, however I also think that is something that we can focus on later. We can both support Apple now in this fight against government overreach and put pressure on them later to make their phone securable by the user. Those two ideas are not mutually exclusive, despite appearing to be both pro Apple and anti-Apple.
I don't think that's true, but even if I'm wrong, you could say that about any skirmish in the privacy debate. Every legal case sets some precedent that affects the next one.
Also, I don't agree that this is government overreach. This case seems about as clear-cut an example of a "good" investigatory behavior as we're likely to see. If you can't get behind the idea of compromising privacy when there's a valid warrant, in the case of a known mass murderer with probable ties to international terrorist groups, well...you've set an exceptionally high bar. I'm a reasonable person, I see your position, and I disagree with you on the merits of your argument.
> you could say that about any skirmish in the privacy debate. Every legal case sets some precedent that affects the next one.
Yes and no. The role of the judiciary is to interpret and implement the law. They are not supposed to create law. That is the job of Congress.
This case is so unprecedented that there's a chance the precedent here will effectively create a law. It will come down to a matter of interpretation by the justices. If they rule against Apple, the message is, "This is covered by the AWA, and the AWA was intended to compel companies to weaken their products' security". In that case, many of us in the public feel that the justices will have unfairly created a new law.
If they rule for Apple, the message is, "This is an undue burden being forced upon Apple. That is not the intention of the AWA. If you want them to comply, go to Congress and ask for a law"
Obama was a lawyer, he knows this, and in light of the public's disapproval of mass surveillance, he chose the path (the AWA) that is most likely to get him what he wants, which is to grant law enforcement access to all iPhones. The public currently will not re-elect congressmen and women who push through new surveillance laws.
P.S. I like your site vayable.com
This case is actually super with precedent, if you ignore the digital nature of things. Apple has keys to a safe (digital signage key for iOS updates), FBI has warrant to search safe, court orders keys to safe. Fourth amendment doesn't apply because Apple can't incriminate themselves by giving signage keys.
There is the whole "asking Apple to write the OS changes and sign it", instead of just "Asking Apple for the signing keys." I would call this a compromise ruling to avoid having Apple have to give the actual for real skeleton key.
Asking a judge to not force Apple to surrender the digital signage keys requires more subtle arguments about burden. Asking for any ruling on encryption itself is asking a court to legislate from the bench
The big difference between what's being asked and the signing keys is that Apple already have the signing keys. There is certainly plenty of precedent for a court to ask Apple to produce something they already have, but less precedent for a court to ask Apple to make something that doesn't exist yet.
In the analogy, the FBI doesn't have a warrant to "search the safe". What is protected by the signing keys is the ability to distribute iOS updates, but the court wants the data on the phone, which is protected by a different key Apple don't have.
A more correct non-IT analogy is to imagine that the safe has two locks: one pickable, the other unpickable. Apple don't have a matching key for either, but knows how to cut a key for the unpickable one. The FBI has asked Apple to set up a key-cutting facility, definitely only for use on this one occasion, so they can make a key for the unpickable lock.
That is a gigantic "if"
However, the writ in question is to compel Apple to write a new version of the OS (not to hand over keys, not to hand over data in their possession, not to provide technical support to the FBI - all of which are things Apple has done when presented with a valid warrant).
From Apple's motion to vacate:
"In the section of CALEA entitled “Design of features and systems configurations,” 47 U.S.C. § 1002(b)(1), the statute says that it “does not authorize any law enforcement agency or officer —
(1) to require any specific design of equipment, facilities, services, features, or system configurations to be adopted by any provider of a wire or electronic communication service, any manufacturer of telecommunications equipment, or any provider of telecommunications support services.
(2) to prohibit the adoption of any equipment, facility, service, or feature by any provider of a wire or electronic communication service, any manufacturer of telecommunications equipment, or any provider of telecommunications support services."
So the writ appears to be in direct contradiction to other law, which would make it an invalid use of the All Writs Act.
What's happening here is that Apple is claiming that it can't comply with the warrant, because encryption. The FBI is invoking the All Writs Act to try to compel Apple to brute force the weak password on the phone.
Nobody expects to get anything from the phone. It's the guy's work phone and they already have all the call logs, etc.
I hear that you're willing to trade liberty for safety, but what safety do you expect to get and are you considering any costs?
Well, do you not believe the First Ammendmant protects against compelled speech?
Because the FBI's argument here boils down to "we have the right to require people to cryptographically sign things against their will"
We can put the case into an even larger context and ask: should the FBI be able to compel [banks, accounting firms, insurance companies] to use their resources against their own and their Customers right to financial privacy? The answer to date, has been "yes." The right of the justice system to "every man's evidence",[1] has so far been thought to trump the interests of the customer relationship.
For decades, government has had the power to compel accounting firms and banks to search through their records (often at significant expense) to deliver information relevant to an investigation. I imagine those companies would love to be able to advertise that they won't cooperate with a government investigation of your taxes or financial transactions.
In my view, there are two different questions:
1) can the government ask Apple to unlock one iPhone; 2) can the government ask Apple to weaken security for all iPhones?[2]
The first question, at issue in this case, is something companies deal with all the time in many different contexts. The second question, on the other hand, may well be sui generis. I understand why Apple taking a stand on this particular hill--in their shoes I'd do it too. Better to "fight them over there so you don't have to fight them over here" so to speak.
I'm a little worried about the potential for blowback, though. The tech community is forced, in a way, to spread FUD to justify their argument as to (1). There are a lot of people who are confused by the reporting and think that this case involves the FBI requesting Apple to put backdoors in all of their phones, rather than leveraging an existing security weakness. That's not necessarily a great place to be in if you're found out.
[1] United States v. Nixon, 418 U.S. 683, 709 (1974).
[2] I don't think it's technically justifiable to say that (2) is implied by (1). Apple apparently already has the capability to subvert anyone's phones by using their signing keys to load weakened software. At a purely technical level, signing an "evil build of iOS" using an existing "backdoor" is different than introducing a backdoor into everyone's phone.
History has shown we cannot restrict this by implementing laws/rules, just look at the news to see how these laws are abused right now, accessing all our private data.
EDIT: ok i get your point now; I imagine the reason this 'technical backdoor' exists in the first place, is because Apple wants to be able to update that part of the OS in case of bugs. If they make it 'not-updateable' the backdoor is closed but then if problems arise, bugs can't be fixed (for example the recent Error 5/home button bug).
Even though this is incredibly unlikely, say for a moment that Apple has only hired developers that feel strongly that privacy is an inalienable right. If Tim Cook concedes to the FBI and gives the order that a hacked version of iOS is to be created, what happens if his developers refuse? Would Tim Cook be put in jail, or would the developers be jailed on contempt of court charges?
I see your code is speech point. I'm skeptical about it, because usually code is just code. It's meant to do something, not to express an idea. But I think there is some merit to the idea that code signing combines doing something (enabling code to be loaded) and communicating an idea (that the signer trusts the code). It's an interesting argument, certainly.
Can the government compel the creation of original tools and IP outside the typical operations of a business? If so should they be required to compensate the business? Does the business then own the IP or the government? What happens when compelling a company to create IP or perform process outside of its typical operations is a net loss regardless of compensation? Should it be required to notify stockholders? Is it legal to make investments based on this PARTICULAR kind of inside government information? What if the entire company's operation may be plausibly undermined by the operation?
I think a more relevant example here would be whether the government could compel a bank or financial company to create or alter its financial reporting tools to falsify data or misreport to the subject of an investigation.
That's essentially what I view to be the case here. In theory the procedure may be perfectly "lawful" but in practice is clearly overreach. We need case law around this. I believe this is as clear a case of overreach as Apple could wish for. Finally, I believe it should be legal precedent set in public for once.
I was only responding to the gp, in that it would be billable, but the real "cost" may be incalculable... not to mention the damage to near term and long term security, and future incursions into privacy built upon yielding here.
* I can't reply below this threshold but I'm enjoying the back and forth. People buy iphones because they believe that there are no ways to "trivially" access their personal information. Even for Apple to do so would be a breach of that trust. See: "Uber God Mode"
If the only reason they can't get at your data is because they haven't compiled some code yet that's ALMOST NO PROTECTION AT ALL! Anyone making a buying decision based on Apple's failure to compile a simple piece of code is nuts!
Like, if you gave me a private document while I had my eyes closed and I said "Trust me, I can't see your data, I have my eyes closed. And I'm not going to open them." that would be crazy right? Building GovOS is the equivalent of opening my eyes.
And even if that's true (which I really don't think it is) it's not a good enough reason.
Say I started a bank and marketed my bank as an especially secure one. "Even the FBI will never be able to see your bank records. I won't let them!" I bet some customers might be interested in that. Just because I had marketed my bank that way doesn't mean my bank would gain some special legal protection against warrants.
If the government wants to pass a law requiring phone makers like Apple to include a back door, then that's what they should do.
For me, this boils down to whether or not people are allowed to have strong encryption.
Its easy to see why DOD originally classified it as a munition. Video games have become a powerful tool for storytelling, education, performance art, and immersive experiences for a long time but they started out as artillery simulators and a means to practice war games. That mentality pervades and we still see Jump, Shoot, and Run as the primary dynamic by which we function in these amazing experiences. You're fighting against human instinct and hundreds of thousands of years of evolution. Against Dunbar's number, the core mechanic of trust and social engagement for millenia. I hope you're right, but I don't think it will be the sea-change you're expecting. Look at the adoption of bitcoin and remember that law enforcement is a retro-grade function of society. Underfunded and always behind the zeitgeist.
We don't ask the secret service to build the president's merchandising website, and we shouldn't expect the FBI to be able to articulate or comprehend the, "triviality" of undermining strong encryption.
I think it's great that you name specific parts of the government because not all parts of the government think strong encryption is a problem.
4PM in Chicago. I'm out of here.
That's an absurd point of view because the phone in question doesn't have strong encryption(1). If it did, there would be no way for Apple to trivially bypass it.
(1) Well it kind of does but by encouraging the use of an incredibly weak password it defeats the purpose of having any encryption at all really. If the San Bernardino shooters had used a real password we wouldn't be having this discussion.
The chance of there being anything valuable on that phone is pretty slim. Especially when you consider how much the government is willing to spend on it. I was just watching CNN and Apple has apparently detailed what it would take before they would consider writing the compromised version of the OS. The reporter claims it would cost about $50 million and the government has apparently said "no problem, we can pay that". Ugh.
Well, for Apple to develop this software, they would insist on it being developed in a locked down facility that doesn't currently exist (what Apple has is in use). I think they have said it's only about $100,000 of developer time (so maybe 2-3 months of work), but the infrastructure that would be necessary for the work to be done in a way that doesn't risk any leaks is expensive.
Apple has made the claim that code-is-speech. From that article:
> Wayne Giampietro, a Chicago-based lawyer and longtime member of the First Amendment Lawyer's Association, said that Apple is absolutely on solid ground with its argument.
Nobody is saying the government can't attempt to unlock the phone - or even compel Apple to provide technical information. But that's not what the FBI wants. They want to force Apple to take all the risk.
Turn the tables for a second:
What would the US do if a foreign government had access to their citizens' information?
Would it become an issue of nationalism to use your own country's homegrown smart phone, browser, social network, etc?
"Apple had asked the FBI to issue application for iPhone passcode cracking tool under seal, but government made it public, prompting Tim Cook's public remarks"[1]
so no, apple doesn't really have the security of user in mind, it's just turning this on its head and putting up a show
[1]http://www.nytimes.com/2016/02/19/technology/how-tim-cook-be...
Amazon, Google, MS and Apple are the real players, but Facebook is closing in as well. Google is the main linchpin, within 1-2 degrees everything clears through it: CA, DNS, Search, mx, analytic beacons, OS, hosting, etc.
They believe data should be used to solve problems and it should. But the consolidation risk is too high now, they own the whole stack and all the connections hopefully they have integrity here.,
- Should companies reveal what type of information they have on their consumers.
- Should and can companies protect their data on their consumers as their own property.
"We agree that the power of federal courts to impose duties upon third parties is not without limits; unreasonable burdens may not be imposed"
"The order provided that the Company be fully reimbursed at prevailing rates, and compliance with it required minimal effort on the part of the Company and no disruption to its operations." [1]
We already know law enforcement can get a warrant for access to information, and that people cannot reasonably expect privacy of information given to a 3rd party, including information on computers. Those decisions, unfortunately, have already been made and that's not what's at stake here.
[1] https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...
This case is not about weakening encryption in any way, something that I think is not well understood outside a technical audience.
It is what it is. You guys focuses more on how to limit FBI to abuse the terrorist card to violate privacy. But in case of a true terrorist, the answer should not be not that hard.
Out of all the 13 pending cases the FBI have with Apple using the All Writs Act (they've also said they have another 175 iPhones to unlock), this has the least chance of holding anything meaningful given it's his consent-to-monitor work phone, not his personal phone (which he destroyed), wasn't used at the scene of the crime, of which the FBI already have 6 week old iCloud backups of and would've had all the phones iCloud backups if they hadn't disabled them by instructing for the phones password to be reset.
Yet of all the pending cases under seal this is the one they've chosen to break character and go public on, exploiting this tragic event and using the fear around terror and emotions of victims for maximum PR and political effect to further their agenda of violating the security of millions of customers - which is both deceitful and clever, as apparently it's working.
I've always watched in bewilderment at the US Govt's response to terror, they're prepared to spend trillions fighting wars, billions changing Airport security, aren't prepared to do anything to change the easy access to the semi-automatic weapons that were actually used to kill all the victims, but are prepared to compromise the security and privacy of millions of peoples lives, violating 1st and 5th amendment constitutional rights for the theater of accessing useless data on a dead terrorist's work phone - for something which US citizens have less chance to die from than their own furniture? ...and the US public majority approves.
That's only the means, not the goal, because...
> bewilderment
Spending massive amounts of money on wars makes a lot more sense once you realize that it's intended to channel money into their friends (and their jobs post-public service) in the military-industrial complex. Eisenhower warned[1] us, but the public didn't listen.
[1] his farewell address was amazingly prescient: https://www.youtube.com/watch?v=CWiIYW_fBfY
In the cases of true terrorists, having access to phone records and even having the father of a terrorist report on his own son hasn't been enough to stop attacks.
So, you should be asking whether or not you should be giving up your right to privacy and awarding the government broad powers that, based on historical data, won't reliably help prevent terrorist attacks, but that will be used far outside the original scope for which they were granted.
You should also not just be asking about the current government, but all future governments, and be able to trust that they will only act in the best interest of their citizens.
Thats really not even remotely a legitimate question in this instance. If Apple "had" the data Im sure they would give it up readily (and probably have already in this and other instances). But they physically or digitally do not have the data to give.
"Should Apple be forced to give the Terrorist's phone data to the FBI"
When what it's really about:
"Should the FBI be able to compel technology companies to use their resources against their own and their Customers right to Security."
In order for the public to be properly informed about what's really at stake this case needs to be about the "Technology Industry vs FBI", not what the US Govt is trying to set the narrative to: "Apple protecting Terrorism". With this announcement this brings us to:
Big technology companies with large user bases that's notably missing: