That's a lot of double-speak. They know that removing the timeout so they can try thousands of passwords per second opens up a huge security hole. What he's saying is "we want it both ways". We don't want to take away security for users, we just want to make it easier for someone who's not the owner of the phone to get into it.

The government owned the iPhone in question.

If the government org in question had followed iOS deployment best-practices, they would have already had sanctioned access to this phone.

Which is a bigger flag for mismanagement. If the phone had had device management software as most major companies provision, no hack would have been necessary.

But it didn't own the software, which is still patented and copyrighted by Apple, and merely licensed to end users.

So an EULA just protected people?

"The government" is not one organization.

That doesn't seem relevant unless there's a dispute over ownership, which there isn't.

Well reset it, and start downloading pictures of cats, what's the problem?

In what sense of ownership?

Public funds purchased the phone. I'm not sure what you mean?

"public funds" is not a single shared bucket of loot that everyone puts into. In this case it was a county owned device.

County governments are typically recognized incorporated organizations that have no real line of authority or connection with the federal government.

So no, the FBI or federal doesn't have some ownership claim that makes it ok to break into. As others point out they have basically seized the device from its owner in the course of investigation.

Unless the county was forced to hand it over, this is not relevant.

can you explain the comment on relevance a bit more? You said it twice but I'm not seeing your point.

Regarding the Director's double speak I think it is relevant. The FBI or federal government is still not the owner. Regardless of whether the device was seized or surrendered the property is still owned by the county.

> What he's saying is "we want it both ways". We don't want to take away security for users, we just want to make it easier for someone who's not the owner of the phone to get into it.

If they have permission from the owner, it's wrong to describe it as trying to get into "someone else's phone". There's no expectation of privacy in a government owned phone.

Who decides paying $1M to get access to a government owned device is appropriate use of public money though?

Why didn't they go through proper channels? Why did they reset the iCloud passwords? What steps have they taken to prevent this from happening in the future?

The FBI is doing a lot of hand waving and there is no accountability. Where are all those fiscal conservatives when we need them?

In my personal experience with an iPhone, it will not backup to iCloud without wifi and it will not connect to wifi without having the passcode entered at least once since boot. According to the government, the device was found powered off. If that is true, the iCloud backup would never have worked.

The government ran its own tests of the scenarios and found that to be true: https://www.scribd.com/doc/303759192/Declaration-by-Stacey-P... (paragraphs 37-39)

Apple's engineer's response left that assertion unchallenged (while challenging other stuff wrong with paragraphs 37-39, see his paragraphs 32-33): https://www.scribd.com/doc/304898553/SUPPLEMENTAL-DECLARATIO...

Of course, you can choose not to believe the government that the phone was found powered off (http://www.wired.com/wp-content/uploads/2016/03/Apple-govt-R...), but I think you'd have to pick and choose what you're willing to believe and not believe from what the government have said.

Finally, even though it wouldn't have helped, it's clear Pluhar's team did not consider the iCloud backup possibility when they were making their examination, so they very well could have screwed this up. It's just that they didn't in this case.

It's also possible the phone was actually found powered on and the battery was drained and it turned off by the time Pluhar's team examined it the same day. It wasn't mentioned if anyone checked it and tried to make sure it was kept charged (probably not). I imagine it might be difficult to train the officers on the ground about mobile device forensics best practices, since they change fairly frequently.

Re icloud, see http://www.computerworld.com/article/3044025/apple-ios/terro...

I would not trust their word over Apple's because Apple has a better insight of the situation.

The whole thing was a very poor allocation of resources. Of course, those whose promotions and maybe even jobs are on the line will fight back any claim of incompetence or malice.

Huh? Apple has no idea what's on the phone, how could they have better info than the FBI on this?

The phone is evidence in a police investigation, they didn't buy it, while its owners are dead surely it belongs to their hiers? or does that whole rule of law thing mean nothing

The phone was a work phone issued by the San Bernardino Health Department, so no - the heirs of the killers didn't assume ownership of the phone. It was always the property of the San Bernardino Health Department.

So if someone the FBI is interested in knew they were being targeted and used a strong, complex, long password which would be impossible to 'guess' even without the restrictions then how does

> and without it taking a decade to guess correctly.

even make sense when there isn't a force in the universe that can guess that password in 10 millennia.

If they demand that restrictions like gated attempts and automatic wipes be removed, they're just pushing the industry to move to restrictions that can't be removed.

Hell, if I was feeling really cheeky and worked for Apple, I would give the FBI their backdoor which allowed them access, but they have to provide the phone a proof of work worth at least $10 trillion.

No this probably couldn't be made secure.

The only way to accomplish the goal in the first paragraph is to execute the steps they "don't want to" do from the second paragraph. It's more than double-speak, it's pure bullshit.