Comment by philip1209 | Hacker News Reader

Comment by philip1209 | Hacker News Reader

A thought experiment: Let's say the government makes hardware encryption standards in the style of FedRAMP that sets standards for preventing tampering by foreign governments. Then, imagine that a consumer electronics company voluntarily makes all devices comply with this standard. Could a court attempt to compel the company to defeat the standards which the government set as tamper-proof against governments?

A second: What happens if Apple states that it will take a 50-person team with an average annual labor cost of $200K/person approximately 5 weeks to fix the problem with a 50% chance of success. Can Apple bill the court a million dollars to try to fix the issue?

A third: Apple open-sources their encryption modules and firmware. They no longer have proprietary information for how to unlock the phone. Are they legally required to be the ones who defeat a system to which they hold no proprietary information?

A fourth: The small team that built the system no longer works for Apple. Perhaps their visa was revoked and they left the country, perhaps they were poached by a competitor, or perhaps they retired in the years since this module was published. Who is responsible for complying with the order?

A fifth: The data is actually corrupted. Apple presents this conclusion under penalty of perjury after a thousand hours spent on the project, which it requests are compensated.

A sixth: Apple requests that trading of its stock is frozen for one month while it expends considerable resources on complying with an unexpected court order relevant to national security.

1: Yes.

2: Yes.

3: No, but they will probably be the ones asked anyway, and then yes, they would be legally required.

4: Apple.

5: What's the question? Is the question will they be compensated? Then yes.

6: They can't. They don't own their stock. Bad PR is not a good enough reason.

You are treating the court like a mathematical proof and finding edge cases. I used to as well. But courts don't work that way at all - they don't care in the slightest about your proof. They analyze things on a human level, not a mathematical level.

Specifically regarding question 5 - how does the burden of proof work? How do statues of limitations apply?

There is no burden of proof. Apple says it's corrupted that's about it. I'm sure the other party will ask for details. If they don't believe Apple they'll explain that to the Judge and he'll go from there, but otherwise no one will demand proof of anything.

I don't see how statues of limitations is connected to the question.

re: statue of limitations - if we are talking exponential levels of difficulty to crack vs. exponential increases in computing power (Moore's law) I wonder whether "we won't have the computing power to crack this for X years, so a statute of limitations of (X-1) years to solve this means that we are functionally unable to answer the question within the allotted time" becomes defensible as a reason to call something "impossible", i.e. it's improbable to solve during the statue of limitations

A statute of limitations prevents you from charging someone with a crime once some period of time elapses. It says nothing about how long you have to prove your case in court. That's more likely to run afoul of the right to a speedy trial.

Statue of limitations is only until the court date. Once that starts there is no statue of limitations, even if the case takes years.

The closest I can think of is a right to a speedy trial, but that has so many exceptions (for example if the person is out on bail) that I couldn't say how a judge would rule in this scenario. Especially if it was the defendant causing the delay by refusing to reveal the password and making the prosecutor get it the hard way. (Not applicable in this case, might be applicable in another.)

specifically in this case, the only non-John Doe defendant I am aware of is dead so those provisions do not apply.

The FBI is not doing this for proceedings related evidenciary purposes but instead for investigative purposes. No one has been charged here (from what I know) so the issue of speedy trials is moot while the statue of limitations on the crimes under investigation are likely extremely long if they exist at all.

The fact that courts don't have ways to handle edge cases is a huge problem with our case law style legal system.

You ever get in a fight with someone?

You ever get in a fight where it wasn't 100% clear who was right and who was wrong? You were both a little bit right and a little bit wrong?

Welcome to the problems our legal system has to deal with. The world isn't a mathematical equation. It's fuzzy. So is our legal system.

I think my comment was misinterpreted. Our legal system is a part of our government, which is a representative democracy. Part of the idea behind a representative democracy is that it is designed to protect the minority from majority mob rule. By definition, edge cases are cases that fall outside of the normal majority. Our legal system is fuzzy because it is operated by humans, not silicon.

The design of a case law system however, which the U.S. operates under, is intended to minimize fuzziness by looking at case precedent for guidance on issues moving forward. So in a sense, case law is intended to be the legal equivalent of mathematical proofs in the courtroom. Obviously this analogy isn't 100% correct, but the main reason it can't be is because of the thousands of edge cases that come up in real life...edge cases that are minority cases intended to be protected by representative democracy, but the case law legal system has difficulty actually doing so because of the design of the case law system. See the conflict? Completely lost yet?

>The design of a case law system however, which the U.S. operates under, is intended to minimize fuzziness by looking at case precedent for guidance on issues moving forward.

Sorry if this comes out as pedantic but I think it is important. Case law is not intended to minimize fuzziness but to address occurrences of fuzziness.

I disagree, I think precedent reduces fuzziness because it shows how the law has been interpreted in the real world.

No cases are identical, but knowing how a similar situation was handled in the past clarifies, not confuses the situation. It gets us closer to a consistent interpretation of the law, which is, in my opinion, paramount because consistency ideally means predictability and equality.

Indeed the roots of the common law go back to making sure all people are viewed equally under the law, rather than having random interpretations based on who's judging and who's being judged.

From my parent comment:

The design of a case law system however, which the U.S. operates under, is intended to minimize fuzziness by looking at case precedent for guidance on issues moving forward.

Aren't we in agreement?

But then you go on to speak of edge cases that precedent can't deal with, but I would argue that your view of case law as essentially "algorithmic" is flawed. Obviously precedent cannot be exact, but using prior interpretations helps guide thinking.

For example, look at Katz v. US, one of the seminal cases that would inform this case. In Katz, the court starts with existing law, one that prevents illegal searches, and tries to decide whether that law can apply to electronics (such as tapping a phone). At this point the OCCSSA is in effect, but not really tested, so we've got a pretty fuzzy legal area despite the fact that phones are a well established technology. The court rules that even though law enforcement did not search or seize things, that privacy is still implied in electronic communications because of other acts a user takes surrounding the act of making a phone call (closing the door, making the phone call from home, etc.).

In fact, there's a whole legal concept at work here called lawful intrusion that is built upon every time a case is judged. These concepts, and human application of them to the case at hand, help attorneys, judges and juries deal with edge cases.

> You ever get in a fight where it wasn't 100% clear who was right and who was wrong? You were both a little bit right and a little bit wrong?

I'm not really sure what point you're trying to make. Yes, the world is not black and white, but neither is math.

If you have e.g. a car crash where one person was speeding and the other failed to yield the right of way, they're both at fault. Maybe one is more at fault than the other and therefore has to pay a higher percentage of the damages, but how is that not still an algorithm?

The hard part is designing the right algorithm ahead of time. But throwing up your hands and saying that problem is hard and therefore we should give up on having laws and just let judges decide everything on a case by case basis isn't democracy and isn't the rule of law. It's the rule of whatever the judge says it is today.

It's impossible to design an appropriate algorithm ahead of time capable of accepting all of the possible inputs that might occur.

Which isn't to say that we shouldn't do our best. We shouldn't just throw up our hands. But I think it's important to admit that judges will always be necessary to handle inevitable ambiguities.

It's completely possible to design an algorithm that will give a deterministic result in every case. It might not always be the result you want, but a judge might not give the result you want either. And at least with the algorithm the result is predictable (even if not predicted) and, if wrong, can be fixed and then apply consistently in the future without making decisions based on politics or race or personal relationships.

Or to put it another way, we could have an algorithm make the decision but then have a judge whose job it is to find when the algorithm is wrong and then fix it for future but not past/current cases.

Yes. That's why I said "appropriate algorithm" and not just "algorithm."

There is a tradeoff between predictability and correctness. Where you come in on that tradeoff is pretty different from most other people.

> There is a tradeoff between predictability and correctness. Where you come in on that tradeoff is pretty different from most other people.

Because I don't see it as a tradeoff between predictability and correctness, I see it as a tradeoff between correctness for past acts and correctness forever in the future.

If you know a law is ridiculous but you also know that a judge will see the same thing and then not let you do that, you won't do it. Some people like that result. The problem is it causes the ridiculous law to carry on existing and not be fixed, because nobody is willing to challenge it when they know they'll lose and go to jail even though by the letter they shouldn't. So then nobody ever knows what the law actually is because it clearly isn't what it says it is, but if it isn't that then what is it?

They do have ways to handle edge cases: judges.

They are imperfect and I'm sure you can find much wrong with the courts, but attempting to codify every edge case is not only impossible, but dangerous. The more laws you create, the more likely you can find a way you're breaking one. It's not a perfect system, but a cornerstone of American democracy is that you are judge by people, people like you, not by an algorithm.

> ...people, people like you...

We've been reminded again and again by recent events how horribly wrong things can go when the is system is applied to people who are not like the judge/jury/officers/etc. There's got to be a better way than relying on inherently biased people, especially for commonly persecuted groups (minority races/orientations/occupations).

I think when someone says they want an axiomatic or algorithmic legal system, they're saying people are not like them, and they would rather be judged by an algorithm. Also that they would rather know in advance what behaviors will be judged positively or negatively.

I understand this, and if I thought it were possible, I would agree.

However...

The law is essentially trying to codify a moral code, one that changes with time. We've seen how the law struggles with changes to technology, lifestyle and shifting attitudes. But sometimes the very axioms change (see slavery, suffrage, common law). Because the law cannot keep up with changes, we're stuck with messy human interpretation to smooth over some of those rough edges. Something like Brown v. Board of Education, which seems obvious in retrospect, may not have occurred in an axiomatic system (perhaps Plessy v. Ferguson may not have occurred either, though considering the primary axiom that American law is based on once said that blacks were 3/5 of a human, I find that unlikely).

I would argue that we ought to try to introduce algorithms into the enforcement of the law (policing, traffic enforcement, jury selection, public defenders, etc) rather than the interpretation of it. Of course, one could argue mass surveillance is exactly that, so I don't know.

Thanks for answering. And original question was great too. Are you a lawyer, not trying to dismiss your answer because it seems logical, but asking so that I can ask something else

I am not a lawyer. There was a time when I spent a lot of time reading verdicts from Judges. (The higher the level of Judge the better the writing, and they are really surprisingly very readable, not full of legalese as you might expect.)

Anyway, I used to think that law was mathematical, but after reading lots of verdicts I realized it was not.

> but asking so that I can ask something else

Ask. If I don't know, I'll tell you that.

I was going to ask what happens if Apple says no! I don't know what the next step of FBI will be. What do you think? Can Apple be sued over this? Can they say okay give us the device and we will give you the data but not the actual 'modified os'?

(Or we'll just have to find out?)

> what happens if Apple says no.

They would be fined, or executives charged with contempt of court and possible jail time. That would also make the Judge mad at them, and not likely to agree to anything they ask.

The Judge has a LOT of power - he can impose some really high fines, and that's just to start with. Apple will not mess with him.

> I don't know what the next step of FBI will be.

Not FBI. If the Judge says to do it (so far he has not), he will be the one making sure they do it. The FBI will just complain to the Judge if necessary, not actually do anything.

> Can they say okay give us the device and we will give you the data but not the actual 'modified os'?

They can ask the Judge if they can do that. It's up to the Judge to say yes or no. They'll probably have to explain why it's better that way, and that the end result would be the same. The FBI can then argue against it, (or accept it). The Judge will listen to both sides and explain his reasoning in a paper.

You might want to try to read all the stuff the Judge writes in this case. Ignore what the lawyers for Apple or FBI write, read just what the Judge writes (he will summarize what the lawyers wrote, so you won't miss anything).

Thank you for taking the time to reply. That is what I wanted to know.

6. Wrong, Yes they can, a company can suspend public trading of its stock any time it wishes.

https://www.sec.gov/litigation/suspensions.shtml

My understanding is that it's the SEC who suspends trading on a stock, not the company itself.

> The federal securities laws allow the SEC to suspend trading in any stock for up to ten trading days when the SEC determines that a trading suspension is required in the public interest and for the protection of investors.

> allow the SEC to suspend

>They analyze things on a human level

This (and the job prospects) are the reason I choose computer science/software engineering over being a lawyer even though most people who commented on what I should be say I should be a lawyer. The law requires not just thinking like a human, but accepting such thought as valid. To me the logic is exactly the same behind any racist who makes special exceptions for all minority people they know while still holding their view in general. In effect the system is built on a mix of emotion and logic, and in doing such it is insanely unjust to those who fall on the unpopular side. A President who admits to smoking pot leading a government that ruins the lives of people who use pot... it is just as bad as some older men I know who admit to having tried pot but who think anyone currently trying it deserves to be put in prison.

Analyzing something on the human level is always a horrible standard when viewed outside the context of our own emotional fallacies.

This is an amazing meta-point here; the people on the other side of this debate seem to have no need for logical cohesion.

I might extend that a bit to ask 'what is the consequence of such lack of cohesion'? Perhaps first that getting agreement on anything needs to be done at a close to case-by-case basis since there is a weaker adherence to standards. This can introduce favoritism (e.g. some people get hit for pot and others don't). Another consequence might be up-front costs. Not needing to think too deep about edge cases and whatnot is clearly less time-cost to run first-time-seen cases. This in turn means people won't hesitate as much in setting new precedence because they won't notice when they do. Another consequence would be inability to get consistency across and entire system since not everything can be debated by all and there's not clear rules.

You NEED human emotion not just logic when making laws.

Pure logic is like 100% free markets with zero oversight and government interference, it looks good on paper but not in practice.

Human emotion in laws add things like forgiveness, understanding and compassion, things that mathematics can't help with. I know that it also adds greed, unfairness and discrimination hence the reason it is a constant struggle to find the right balance.

> They analyze things on a human level, not a mathematical level.

Courts analyse things on a political level. It has less to do with what normal humans think is right and more to do with causing the outcome the judge wants to occur.

The result is that the better judges are more consistent (and then get celebrated when the outcome in a specific case is politically popular but pilloried for creating "loopholes" when it isn't), whereas the worse judges find a way to make the politically popular thing happen no matter how tortured the logic it takes to get there is. And the existence of the second class destroys the rule of law, because you get in front of one of them and it doesn't matter what you did, it only matters if the judge likes you.

Ironically, many .gov organizations are rolling out iPhones by the thousand because of the strong security controls available on the platform.

Cite your source(s), please.

I worked in government mobile security for many years, until last November. Many agencies are indeed rolling out iPhones and scaling back on blackberries finally

Blackberry's collapsing business model.

Why is that?

Poor sales, major benefit of blackberry overshadowed by other services (BBM), late to adjust to the times, etc.

I doubt you were suggesting that BB's downfall is rooted in their encryption, however. In the slim case that it did, they didn't speak up about backdoors and letting .gov into their devices until 2015, way after their market share has shrunk.

While I havent seen heavy market in that aspect there appears to be some level of improvisation with Blackberry's messenger http://www.bbm.com/bbm/en.html

BlackBerry failed to keep the positive aspects of it's legacy platform fucntioning when modernizing the platform.

I used to run an environment with something like 25k devices... Provisioning and management was braindead simple with legacy BlackBerry, and it's integration model for mail & calendar was robust and reliable. Most users considered BB more reliable than any other mail access methodology. PIN messaging was device-centric vs. identity centric, which made it attractive or many use cases. That also went away, along with the perceived and real security benefits.

That benefit became a liability -- BlackBerry was very "enterprise telecom" and mail-centric. So the people who were responsible for BlackBerry were very much affected by tunnel vision. That's why BlackBerry was surprised by the market shifts -- their customers were very happy, but were ultimately people with an overly narrow focus who were disconnected from the business.

When BlackBerry switched to the ActiveSync model, they became just another ActiveSync device, with the added "benefit" that the rest of the platform was a mess. They are now trying to leverage their past reputation for good management to become an MDM vendor for some reason.

iPhone slaughtered Blackberry by attacking their strengths... BBM/PIN messaging with iMessage (with the added feature that you cannot intercept the messages if the feature is enabled), the obvious improvements of iOS vs. Blackberry OS and an easy institutional management model.

I'm not at liberty to say. :)

That said, Apple's enterprise business grew 40% in 2015 to $25B. (http://appleinsider.com/articles/15/10/27/apples-enterprise-...). .gov is a big part of that. When you attend Apple enterprise-focused events, the attendance has grown beyond the old media/field service crowd to include finance,police and .gov attendees.

If you need to comply with various federally mandated compliance regimes, (ie. FIPS 140-2, CJIS, IRS Pub 1075, etc) iOS is very clearly the easiest and most straightforward platform to achieve that compliance on. It's not as trivial as it was with legacy BlackBerry, but it's pretty close.

With Android, the carrier and manufacturer variance makes it more difficult to achieve, demonstrate and maintain compliance. That said, Android offers a number of advantages from an application perspective, but when in production, you'll commonly see licensed third party software in place to perform typical mail and other functions.

While I only have anecdotes, when I've encountered governments rolling out Apple devices it is far more about being able to have an Apple device than any technical ability it provides. This comes from talking with those in charge of the roll out who admit such. Granted, this is only 3 very much non-random anecdotes.

A seventh: What if there's influence from super-secret organizations to make those FEDRAMP-style standards less "tamper-proof"? Then a court wouldn't even need to be involved: https://www.eff.org/deeplinks/2014/11/eff-joins-call-nist-we...

Courts already have ways to balance requests for information (by the government or another litigant), with the burden on third parties who might have to undertake expenses to get that information.

Courts already have ways to balance requests for information (by the government or another litigant), with the burden on third parties who might have to undertake expenses to get that information. Generally, third parties are required to take reasonable measures to help.

Reply on news.ycombinator.com