Bwana McCallApple’s encryption battle
Feds break through seized iPhone, stand down in legal battle with Apple
FBI director says fight with Apple about terrorism, not setting precedent
Report: Apple designing its own servers to avoid snooping
Apple gets short-term win, but new mysterious FBI unlocking method looms
FBI says it might be able to break into seized iPhone, judge cancels order to aid decryption [Updated]
View all…The US government isn’t saying whether it will divulge to Apple the method it used to access the locked iPhone seized by one of the San Bernardino shooters.
The iPhone has been at the center of a bitter dispute between Apple and the Federal Bureau of Investigation.
But that legal battle—in which a judge last month had ordered Apple to write code to assist the authorities in unlocking the phone—came to a seemingly abrupt halt late Monday when the government said it “successfully accessed the data” on the phone without Apple’s assistance.
A federal law enforcement official requesting anonymity told reporters in a conference call Monday that the US government would not discuss whether it would reveal the method.
“We cannot comment on the possibility of future disclosures to Apple,” the law enforcement official said in response to a question from Ars. Just a week ago, Apple told reporters in a conference call that it would insist in court of knowing everything about the vulnerability.
Ars reported last week that the Israeli firm Cellebrite was potentially working for the US government to unlock the phone, and many have speculated that the method was a NAND mirroring attack.
White House cybersecurity coordinator Michael Daniel announced in 2014 that the authorities would disclose vulnerabilities—to an extent, and in limited circumstances.
This is known as the Vulnerabilities Equities Process.
But there are legitimate pros and cons to the decision to disclose, and the trade-offs between prompt disclosure and withholding knowledge of some vulnerabilities for a limited time can have significant consequences.
Disclosing a vulnerability can mean that we forego an opportunity to collect crucial intelligence that could thwart a terrorist attack stop the theft of our nation’s intellectual property, or even discover more dangerous vulnerabilities that are being used by hackers or other adversaries to exploit our networks.
Building up a huge stockpile of undisclosed vulnerabilities while leaving the Internet vulnerable and the American people unprotected would not be in our national security interest.
But that is not the same as arguing that we should completely forgo this tool as a way to conduct intelligence collection, and better protect our country in the long-run. Weighing these tradeoffs is not easy, and so we have established principles to guide agency decision-making in this area.
Among others, those principles include “How much is the vulnerable system used in the core internet infrastructure, in other critical infrastructure systems, in the U.S. economy, and/or in national security systems?” Another question Daniel broached was “How much harm could an adversary nation or criminal group do with knowledge of this vulnerability?” Another: “Could we utilize the vulnerability for a short period of time before we disclose it?”
Feds won’t say what method they used to access seized iPhone.
This video highlights one possibility, known as NAND Mirroring.
Moral and ethical considerations aside, does Apple have a legal right to know the method?
“I’m not aware of any legal obligation to reveal that information to Apple,” Ahmed Ghappour, a UC Hastings College of the Law professor, told Ars. Neil Richards, a professor at Washington University Law, agreed when asked if Apple had a legal leg to stand on.
“I can’t think of one,” he told Ars.
Andrew Crocker, a staff attorney with the Electronic Frontier Foundation, said it was “perhaps a long shot” that the government might disclose the method under the Vulnerabilities Equities Process.
“Given the profile of this case, it is an important test for the government’s disclosure policy and whether it is willing to provide more transparency about how it goes about weighing disclosure against intelligence or law enforcement uses of zero days,” Crocker told Ars.
(Ars Technica Senior Business Editor Cyrus Farivar contributed to this report)