Hacker News Reader

Comment by msravi | Hacker News Reader

From here (4th para from the end): http://www.nytimes.com/2016/02/19/technology/how-tim-cook-be...

"Apple had asked the F.B.I. to issue its application for the tool under seal. But the government made it public, prompting Mr. Cook to go into bunker mode to draft a response, according to people privy to the discussions, who spoke on condition of anonymity."

If this is true, it sort-of implies that Apple would have done it, but secretly, and they were forced to take their very public stance because of the FBI's posturing.

View on HN

I don't think so. Apple would prefer not to fight this particular battle over this particular case in the public sphere, but the FBI would. The general principle Apple is fighting for here is very important, but the FBI knows this is the weakest point in that principle: the locked phone of a dead terrorist who killed several people. Politically and possibly legally, this is a winner for the FBI. Technically it's a loser if you believe strong encryption is important at all. Apple wants to win the political argument, so it would not want this request to be made public. Anyway, why should it be, when next to no other such requests are made public?

Anyway, in a legal battle, you contest every relevant point. The fact that they contested it doesn't mean they would have behaved differently after, except that they wouldn't have had to make a public statement under less than ideal circumstances.

Are you suggesting the court would take public opinion under consideration as being at all relevant to the law? That's very worrying to me, considering how important it's been in the past for the court to ignore public opinion in favor of justice.

Of course they do. They shouldn't, but the law doesn't work that way. In some cases the court may even decide to enshrine the public's opinion as a valid tool for determining legality (such as what speech counts as obscenity).

There's also a longer term play - no matter what the court rules, if public reaction is strong enough then elected representatives will be under pressure to change the law.

If judges were the type to rule solely on provable facts and rigid logic, they probably would have been better off pursuing a degree other than Juris Doctor.

Judges absolutely factor in public opinion to their rulings, especially where they must periodically undergo public votes to retain or dismiss on election day.

Are any federal judges elected? I was under the impression they are all appointed and can't be removed without impeachment and conviction.

Public opinion is plainly part of the definition of justice. cultural norms are frequently cited in decisions.

Cultural norms are not the same thing as public opinion. Or do you want the FBI to run attack ads against Apple? Your tax dollars at work taking care of that pesky "public opinion".

I didn't mean the courts (although that's an interesting discussion). The political play I mean is that the FBI is trying to get Congress to change the laws surrounding this topic.

Out of curiosity, does anyone know how much Apple would be compensated for their time and effort to help the FBI? I assume they would be compensated somehow. But how much? I worry that this is going to be a way for the government to get free (or greatly cost reduced) resources to do its own work.

The article states that this occurred after Apple turned over all information about the phone that resided in iCloud. Which means that the government already has access to whatever data it wanted in the phone that was iCloud synced, and is mis-representing it's case as Apple stonewalling. (while Apple is downplaying it's willingness to cooperate for PR reasons).

I don't think "downplaying it's [sic] willingness to cooperate" is at all a fair summary.

They run iButt which is an entirely different matter as far as complying with subpoenas goes, especially when the subject of the subpoena is dead and the subject of an investigation.

What are they going to do? Tell the FBI and a judge that they're refusing to grant them access to unencrypted photos taken by the dead subject of a mass shooting investigation? There's no way they can do that.

It's quite another thing to be forced to develop exploits for hardware that's someone else's property just because you're the manufacturer of that hardware.

iButt? Seriously? Do you also still type M$?

I assumed that was a reference to (or maybe caused by? I don't know if the extension affects textareas) Cloud to Butt Plus.

https://chrome.google.com/webstore/detail/cloud-to-butt-plus...

He probably has the Cloud to Butt extension[1], and it changed its text before submitting:

[1]https://github.com/panicsteve/cloud-to-butt

Sorry about that. Like aylons suggested in a side comment I have the "Cloud To Butt Plus" extension installed. This is the first time it gets me into trouble.

FWIW it doesn't change the submitted text directly, but I edited a spelling error in my comment which changed "iCloud" to "iButt".

There's also a an extension that replaces "God" with "Nicolas Cage" that I recommend :)

Haha, that was confusing. I also have the extension and I can't tell who is actually using Butt and who isn't in this thread

That's really most of the fun you get from the extension. You're never sure whether you're reading the landing page for some new data storage gimmick or a novel new sex toy.

That's very very funny - carry on

I'm actually a little surprised that the FBI would go so public with the request? Anyone have any insights here?

Did they think perhaps there would be public outcry the other direction meaning Apple would look like it was harboring terrorist information if they didn't comply to a public request?

They might have, it's certainly been a theme in some comments by supporters of the unlocking. He public move may be more about setting clear legal precedent - if Apple is forced to do this, the government certainly will rely on this decision again in the future. You cannot set clear legal precedent under seal (outside the FISA court anyway)

Establishing a Manichean media narrative framing Apple (and by extension all crypto providers) as enemies of America who hinder the righteous war on terror. Then if their legal case fails, public outrage, Something Must Be Done, legislative action rendering the AWA moot, achievement unlocked : all your phone are belong to US.

Or is that too tinfoil hat ?

> Did they think perhaps there would be public outcry the other direction meaning Apple would look like it was harboring terrorist information if they didn't comply to a public request?

This is exactly what is happening. It's a political hail mary to get the easiest-to-see use case of forcing privacy violations on american corporations and users legally protected in court precedent. Of course, under this interpretation, there's the disturbing implication they had to wait this long (after the revelation about PRISM) to find a case that so well matched their political agenda.

It's also a little worrying that they are going public, because normally that's not necessary for court verdicts. Perhaps they're preparing for legislative action if the case fails?

Any insight into which presidential candidates have the most privacy-friendly views here?

I don't know why you're being down-voted. The US is in the midst of an election cycle that may very well pertain to the "legislative action" of the parent comment (in so far as the executive has an effect on the legislature). From a recent article [0], it states (summarizing):

Pro-Privacy: Cruz (R), Paul (R), Sanders (D)

Pro-Surveillance: Trump (R), Rubio (R), Bush (R)

Moderate: Carson (R), Clinton (D)

[0] https://nakedsecurity.sophos.com/2016/02/02/where-do-us-pres...

The evidence cited for cruz is a little weird; he's come out against NSA surveillance, but he's also for forcing Apple to comply with the court order to backdoor the phone. He is a bit of a constitutional nerd, though, so I suspect he's more similar to Obama in this respect than you might think considering how different they are in most respects. I'd put him on the moderate side, or at least as a wild card.

Also, I would put Clinton in the rabidly anti-privacy camp if just for this stance she took after San Bernadino: http://www.nbcnews.com/tech/security/could-hillary-clinton-s.... She clearly has no desire for privacy from governments except through legal constraints. Furthermore, her understanding of technology as demonstrated by stances on her email servers, on encryption, and on video games, is outweighed by her desire to either (ab)use technology regardless, or attempt to intervene in it. Not great for an executive, which you would hope would be conservative (slow to move) OR knowledgeable OR defer to a strong cabinet.

> I don't know why you're being down-voted.

Off topic, but I am going to make a Hacker News bot that looks for this phrase, waits 1 hour and sees if the comment is still downvoted.

Or, I'm going to write a copy and paste paragraph explaining to people why it appears that a comment has been downvoted. This would include all the mechanics, how karma works in HN, voting algorithms, mod flagging, time passed etc, involved as well as human psychology at play. So, the above phrase either is honest or dishonest.

For example, in this case I would posit that yes, you actually do know why they were being downvoted, but that by writing that you were actually saying "I disagree with the others who downvoted you". There is a difference.

It could be similiar to when people say "I don't know why anyone voted for Bush". They are not expressing ignorance about the reasons, they are saying that they disagree with peoples choices. In this case, it would be dishonest. Unless the person was actually ignorant of others (it is possible), in which case it is honest.

Off-topic, as mentioned.

Edits - I do know why I am being downvoted.

I don't know why this always works - at least on a large enough demographic - this strategy of being literal, candid and self-aware to leave the audience with an impression of total honesty and transparency, in contrast to the rest of the surrounding dishonest, double-speaking world.

Oh wait...

On topic reply to an off topic comment. :) Could it also be because people use "don't know" and "don't understand" to mean the same thing in many contexts? With "don't understand" being longer to type and speak and also being more "formal" in communication than "don't know", perhaps "don't know" is used as a substitute?

In the Bush example, someone saying "I don't know why anyone voted for Bush" probably means "I don't really understand why (and with what thought process) anyone voted for Bush after everything we know about the matter."

You're leaving out Gary Johnson, the libertarian candidate. He's already come out in full support of Apple and privacy.

In the recent GOP town hall, Cruz did not come across as supporting privacy or Apple at all. Rubio took the most measured stance and seemed at least to understand the issue the best. He did not support Apple, but said he understood that breaking into the phone would make it available to all and the government needs to work more closes with SV for a solution. Of course that could just mean PRISM V2.

That are left?

Bernie has probably the strongest record, being both for net neutrality and against mass surveillance and the patriot act. I'd recommend taking a look through his policies as they are so well thought out in the cases he addresses. He doesn't address everything. On the other side of the fence, Rand Paul was the last sane voice (in terms of privacy), explicitly coming out in favor of net neutrality and strong, backdoor-less encryption.

This is in stark contrast to Clinton—well, just google "clinton privacy" and see the massive number of problems she's had to deal with that demonstrate her technological eagerness seems to outweigh her understanding. She's certainly been an eager advocate of EXACTLY the type of action we're seeing here, arguing that we need backdoors for law enforcement. Marco Rubio has explicitly advocated protecting the existing mass surveillance techniques.

I would be highly surprised if Trump or Cruz were for privacy—the former advocated for special ids, the latter doesn't seem to have a great grasp on technology, much less how to avoid using it to bludgeon people[1].

1: https://twitter.com/sentedcruz/status/531834493922189313

H. Clinton has a very good record on defending her own privacy. Thus, I find it hard to believe that her record in terms of the privacy of the public stems from ignorance or misunderstanding. She ran her own secured, private e-mail server while serving as a major public official, after all, whether the technical details were delegated to underlings or not.

I very much doubt that any establishment-backed candidates in either of the establishment parties would be willing to make any public statements directly applicable to privacy. They are far more likely to come in soft from the other side, and chat up "tools to combat terrorism and other forms of extremism," while eliding over the implication that organized domestic protest groups like Black Lives Matter, Occupy Wherever, or "Y'All-Qaeda" militiamen would also be targeted, in addition to overseas groups.

I'd rather not elaborate further on anyone specific, as I don't want to shove my political biases down any throats on HN.

They do. Such is the case with the "patriot" act which was prepared and in waiting for a convenient event to justify the power grab. http://www.globalissues.org/article/342/the-usa-patriot-act-...

>a case that so well matched their political agenda.

It's almost perfect isn't it ? It's prima facie reasonable, there's no immediate privacy violation, Apple - by the looks of it - could comply fairly trivially and failure is sure to lead to attempts to legislate. Don't like the motivation but you have give them points for planning and execution.

The same sort of play was made after the Oklahoma City bombing:

https://www.philzimmermann.com/EN/essays/WhyIWrotePGP.html

>I'm actually a little surprised that the FBI would go so public with the request? Anyone have any insights here?

The simplest explanation is that the FBI wants a legal precedent more than they want the information on the phone. If they get precedent they can request a "hack" into a phone whenever they feel the need, legally. The worry in this case is the troubling precedent it would set.

https://lawfareblog.com/not-slippery-slope-jump-cliff

Quotation from, Not a Slippery Slope, but a Jump off the Cliff By Nicholas Weaver.

The request to Apple is accurately paraphrased as "Create malcode designed to subvert security protections, with additional forensic protections, customized for a particular target's phone, cryptographically sign that malcode so the target's phone accepts it as legitimate, and run that customized version through the update mechanism". (I speak of malcode in the technical sense of "code designed to subvert a security protection or compromise the device", not in intent.)

The same logic behind what the FBI seeks could just as easily apply to a mandate forcing Microsoft, Google, Apple, and others to push malicious code to a device through automatic updates when the device isn't yet in law enforcement's hand. So the precedent the FBI seeks doesn't represent just "create and install malcode for this device in Law Enforcement possession" but rather "create and install malcode for this device".

Let us assume that the FBI wins in court and gains this precedent. This does indeed solve the "going dark" problem as now the FBI can go to Apple, Cisco, Microsoft, or Google with a warrant and say "push out an update to this target". Once the target's device starts running the FBI's update then encryption no longer matters, even the much stronger security present in the latest Apple devices. So as long as the FBI identifies the target's devices before arrest there is no problem with any encryption. But at what cost?

Even if we ignore the privacy cost, there's an economic cost - no one wants pre-owned software :)

Unless you go full RMS, you are using pre-owned software. The fact that it is only legal precedent preventing this from happening already shows the software is already pre-owned.

It's a political move. The FBI wants this capability for all iPhones. But this particular case is very difficult politically to argue with to the general public. The FBI realized they had a strong political force available to them, and they seized it. They are attempting to either force Apple's hand, make them give into public pressure, or--best of all for the FBI--to convince lawmakers to pass a law requiring companies to provide backdoors.

The FBI will gladly keep sealed its requests that Apple unlock phones in more ambiguous cases, because it would be easy for Apple to publicly refute. But this case is just too good for the people at the FBI who want keys to everyone's data.

They think they can win it and/or they think it will cost Apple a significant enough hit to the stock price to make it painful not to bend over.The FBI people who pushed it this far are arrogant assholes and I hope they end up being well-known assholes.

I took it to imply exactly that, but then I realised that I'm missing some important information about the US court system. Had the FBI 'issued its application under seal' would Apple have been able to appeal under the same reporting restrictions thus initiating the same chain of legal process but without the messy publicly?

Either way it looks horribly like the feds just took away the neutral ground in crypto war 2.0

Yes, a document or entire case being under seal doesn't affect the legal process itself, only what the public gets to see.

Except that this still relates to an older version of the technology.. in the Dune series, Leto bred the Duncan Idaho ghola over many generations because although some persons were invisible from prescience, he could still see their footprints.. but the footprints of the ghola faded from sight. Apple has been working towards making it impossible to extract the keys, and I'm sure that in crypto war 3.1 they will work further towards this, since it appears that the Secure Enclave may still have some weaknesses (that a firmware update doesn't wipe the keys)

Whether the regulatory mechanism allows them to create something proof against the regulators, now thats going to be an interesting battle. They are still a US company after all.

Are you suggesting that Apple would've done this particular hack provided it wouldn't set any precedent? If so that sounds quite sensible to my ears.

And that's why transparency is important.

Reply on news.ycombinator.com