Category: Computer Crimes

Apple addressed in a letter to its customers the issues related to the FBI’s request to be provided with Iphone cracking tools.

Here is a detailed analysis of Apple’s statement.

Why is Apple objecting to the government?s order?
First, the government would have us write an entirely new operating system for their use … It would be wrong to intentionally weaken our products with a government-ordered backdoor. If we lose control of our data, we put both our privacy and our safety at risk. …

True, but fact is that by providing unbreakable security measures Apple doesn’t need to care about data protection and privacy laws. As soon as Apple is not able to access users’ data, it is not subjected to the costly burden to comply with an (admittedly) bureaucratic and demanding (European) regulation and reduces its chance to be challenged in Court for privacy infringements.

Second, the order would set a legal precedent that would expand the powers of the government and we simply don?t know where that would lead us. Should the government be allowed to order us to create other capabilities for surveillance purposes, such as recording conversations or location tracking? This would set a very dangerous precedent.

ISPs and carriers are already forced to use devices that eases the (court authorized) wiretappings. Why Apple should be granted an exemption?

Is it technically possible to do what the government has ordered?
Yes, it is certainly possible to create an entirely new operating system to undermine our security features as the government wants. But it?s something we believe is too dangerous to do. The only way to guarantee that such a powerful tool isn?t abused and doesn?t fall into the wrong hands is to never create it.

The easiest pun would be: how about nukes? But (dark) humour apart, a private company has no “jurisdiction” over policy issues and cannot supersede the will of the People. In other words: it is not Apple’s job to decide what is “safe” and what is not.

Could Apple build this operating system just once, for this iPhone, and never use it again?
The digital world is very different from the physical world. In the physical world you can destroy something and it?s gone. But in the digital world, the technique, once created, could be used over and over again, on any number of devices. … Law enforcement agents around the country have already said they have hundreds of iPhones they want Apple to unlock if the FBI wins this case.

So what? A criminal investigation has its needs and can’t be stopped by the business interests of a private company.

Has Apple unlocked iPhones for law enforcement in the past?
No. … We?ve built progressively stronger protections into our products with each new software release, including passcode-based data encryption, because cyberattacks have only become more frequent and more sophisticated. As a result of these stronger protections that require data encryption, we are no longer able to use the data extraction process on an iPhone running iOS 8 or later.

Well, this raises an interesting point. If my memory still works, when, back in the days, Napster got indicted by a New York Court, it has been because the client has been designed without taking into account the involved copyright issues. In other words, the judge punished the fact that Napster was “per se” able to ease the infringement of the law. A sort of “liability by design”. So, enforcing the very same principle to the Apple’s statement, the point is that as a matter of fact IOS is deliberately designed to prevent a forensic investigation. Is this a source of liability?

The government says your objection appears to be based on concern for your business model and marketing strategy. Is that true?
Absolutely not. Nothing could be further from the truth. This is and always has been about our customers. …

I wander what Apple’s CEO would say to its stakeholders should the stocks value fall because of this refusal to comply with the FBI request. A company, and its CEO, have a duty of protection toward the people who invested its money. Sure, Apple has a terrific customer support and is – IP protection apart – a fairly open company. But this doesn’t change the fact that the business impact of a strategy is the main drive to take a decision.

Is there any other way you can help the FBI?
We have done everything that?s both within our power and within the law to help in this case. As we?ve said, we have no sympathy for terrorists. …

I’m sure Apple did. But the point is that, as I said before, that by building an unbreakable IOS version, there is little that Apple could do…

What should happen from here?
Our country has always been strongest when we come together. We feel the best way forward would be for the government to withdraw its demands under the All Writs Act and, as some in Congress have proposed, form a commission or other panel of experts on intelligence, technology, and civil liberties to discuss the implications for law enforcement, national security, privacy, and personal freedoms. Apple would gladly participate in such an effort.

If the FBI’s request has been based upon a valid law there it must be acknowledged. Full stop. If the law is wrong then it will be amended or withdrawn, but until is valid, then dura lex, sed lex.

A final note.

There is an untold assumption in all these issues: that a public prosecutor is not free to investigate a crime and this is clearly not possible.

In Italy, if a prosecutor needs something like the FBI does, he has the power to order it, and the criminal corporate liability regulations punishes as a criminal offense obstructing the investigation.

There is a clear difference between the Apple refusal to comply (grounded on business concerns and not on protecting people’s rights) and the privacy talibans (who just unreasonably put privacy above everything else.)

The actual question is: why people do not trust the State and its law enforcement agencies?

If we could trust the powers-that-be, than we might accept to strike a deal with the devil for the sake of a “greater good”, but truth is that we can’t trust the Leviathan.

So, to put it short, I find both position in bad faith:)

The Iphone vs FBI quarrel about the “need” of Apple’s support to hack into an Iphone switches back the clock to 1991, when Phil Zimmermann gave PGP to the rest of the world, infringing the US veto on encryption export. So, this Apple vs FBI thing is actually nothing new since the position of the supporter for the two arguments is still the same.

But there is a new perspective, though, that worth to be considered and that wasn’t that spread at Zimmermann’s time: the role of non-for-profit, personal encryption.

A company, like Apple, sooner or later will comply with the disclose/hack support order by a court. It is just matter of finding a way to minimize the sales impact of such compliance.

Open-source, NGO, non-for-profit created encryption, on the contrary, has neither an “owner” nor a “CEO” who can be ordered to do something “nasty”. Furthermore, open-source based encryption already gives “the good guys” all the information they need to break the ciphers that endanger their investigation.

The point, though, is another: the FBI didn’t ask for the Iphone security’s blueprints. They just wanted a “tool” to exploit the gimmick, with no actual need to understand how would it works. And to me this is a nightmare scenario. I might trust a forensic expert who does his job in a lab, but I have some “problem” acknowledging the fact that every single law enforcement agent, with no actual competence, might have such a powerful tool to be used without actual supervision.

Again, we go back in time: who will watch the watchers?