The Secret Service is extremely competent when it comes to computer forensics, and when they don't know what to do, they don't guess, the consult with experts.
The FBI is the opposite in every way, mostly because of budget constraints and the subsequent lack of training. I hope that this is a good learning opportunity for them and a chance for them to increase their training budget in this area.
Maybe that's what they wanted him to think. I refuse to believe the alternative...
I guess it depends on whether the hard drives were the target of the raid or just a collateral of "grab anything that may be useful" mindset. They could already have gathered enough evidence without needing to waste time/money on digital forensics. Hard to say without specifics.
The fact that they went out of their way to assure him that his own hard drives were empty reeks of manipulation.
Color me highly skeptical.
you would think that national level stuff would have people take more care, but if you're dealing with state or local police, they will have someone who has taken an 8 hours Encase or FTK class driving a GUI to gather evidence and if the tool doesn't support it, there's effectively no evidence to gather.
Or that they formatted them before returning them?
(And by "unknown" I mean of course "anything that is not FAT* or NTFS"...)
The moral of the story is for individuals, whom should implictly fear government overreach no matter whom is in office, one has to back their shit up and make it SWAT-proof, even if that means running several TahoeLAFS boxes in countries like Switzerland, because running a server (physical or Linode) or just replicating data to a friend's server just doesn't cut it and never did.
I wonder how would they handle full disk encryption.
Thanks for reminding me to set up Amazon glacier for my FreeNas today. Jesus Christ, the world is a messed up place.
Disclaimer: I work on GCP
I had imagined that computer forensics "experts" would make this mistake somewhere at some point, but I did not think I would actually hear that it had happened. Thanks for the affirmation, even if it is just hearsay.
It makes me curious about what goofs were made with the IRS hard drives that had "crashed" according to forensics "experts".
Whereas SS had a number of excellent specialists who understood acquisition, the FBI seemed to be wearing clown-shoes most of the time. I'm not surprised at all that they botched this case so badly.
It's clear as day that Apple is on the right side of this argument. It's not their job to bail out the FBI for yet another colossal screwup. Especially not when it damages their product so severely.
Besides the legal precedents and other associated drama, I think is one of Apple's major concerns, and one of the reasons they implemented the "we don't have the keys" approach to their encryption. If the FBI can always just call on Apple (or Google) to fix whatever mistakes they made, there is little motivation for training / getting better on this front, effectively making Apple the computer forensics arm of the government.
Maybe they were just competent at working around excuses from Apple.
If you think about it, consulting vendors is probably a better use of taxpayer money then RE-ing every stupid crypto system on the market.
They contacted Apple, did their homework and came up with specific and generally sane demands. They even went as far as suggesting to perform the hacking at Apple site to ensure that insecure firmware doesn't leak outside.
BTW, this last part looks very much like a response to concerns voiced by Apple, which means that the official statements from both sides are just a tip of the iceberg.
Closed-source may be a pet-peeve of yours, but it has nothing to do with any of this.
They've put themselves in a weird legal situation because they've made it so that they are the only ones who can actually write and sign the firmware the FBI is demanding. A judge would laugh them out of the courtroom if the FBI was technically capable of writing the firmware and demanded Apple's help because it was too hard.
No, not based on the interpretation of the all writs act that the FBI is attempting to use. As far as the FBI is concerned, they could force my Grandma to write a backdoor if they deemed her the best person to do so. Given that she can't answer the phone most days it'd be a lon wait, but I wouldn't put t past them.
--edit to correct auto-correct
This is an example of a non-free software feature. Why are the keys baked in and can't be disabled. And "write your own firmware" doesn't solve this problem -- they could just pay a developer to do it $X an hour. A better security model should've been used -- where updates have to be confirmed (read: signed) by the user before they are applied.
The only reasonable way for law enforcement to deal with even a single one of those factors is to request help from device vendor.
I think you absolutely nailed it!
For a high-profile investigation like this, Apple would have given the FBI access to the key developers in the security group. The developers are smart guys trying to be helpful. They are not thinking about Apple policy, or constitutional law, or the big picture of world liberty and privacy. They are tasked with finding the solution to a technical problem: How to get access to protected data.
What likely happened--exactly as you already suggested--is that the FBI asked the developers to explain how the security system could have been designed so as to permit easy government access in cases like this. The FBI was asking "hypothetically" of course. The developers happily gave a blueprint of how the system could have been designed.
The FBI now demands that blueprint be implemented.
Apple should have talked to the FBI through lawyers only.
You went from "would have" to "should have", turning your hypothesis into a certainty...
They do have the keys. A 4-digit pin is useless if you have Apple's private key.
That's assuming it wasn't all staged to take advantage of this situation to pass some backdoor law or set a precedent here, in which case, I don't expect the FBI to retract anything, because then their goal isn't to unlock this phone, but to set that precedent.
At which job were you working so closely with the FBI and SS that you were able to ascertain their technical abilities?
I can well imagine jedberg has had to deal with them just being a systems admin for such large deployments as reddit and paypal.
I started out teaching "Welcome to the Internet" classes once a week, and then was the first tech support guy at ioNet / Internet Oklahoma.
Worked my way up to assistant sysadmin before I moved to Austin to be a sysadmin for Texas.net. April 95 to September 96.
Talk about a hell of a first day... We pretty much switched into full "get news about the bombing online in some form or fashion, however possible" mode for about 48 hours. This was before CNN had a huge online presence, so we had stuff going like a RealVideo stream of a webcam pointed at local TV news, a couple of people went down to take pictures, etc, etc...
Started it in mid to late '96.
If it happened at ioNET after September '96, I wasn't involved.
All of Texas.Net's systems ran legit copies of Solaris; a large amount of them were brand new and came with OS entitlements. I remember going to the post office one day to pick up our brand new copies of Solaris 2.6.
Are you talking about me running SUNHELP.ORG, which started in '97? That was (and is) a third-party user community and resources, along with mailing lists. It did not provide Solaris downloads.
I happen to have a (personal) archive of Solaris releases, but it's not public access.
The closest thing to "piracy" I could ever be accused of was reposting design documents for an unreleased system that I found on Sun's own publicly-accessible website in 2000.
That whole scenario is explained in detail here: http://www.sunhelp.org/letters/
If anyone at Sun held me in bad regard, it was never mentioned to me by anyone, and I had a lot of contacts at the company.
- I was one of 250 people to be picked as an external pre-release beta tester / community liason for the release of OpenSolaris.
- In 2005, Sun donated a fully loaded T1000 server (8 cores, 8G RAM) for use by me in running the site. I'd think that if I was a huge software pirate the company wouldn't encourage it by giving me expensive hardware for free.
Pictures: https://www.flickr.com/photos/mrbill/sets/72057594124431136/
Thanks.
To be perfectly honest: I vaguely recall source of an older Solaris version being passed around the user/hobbyist community, but I wasn't the originator. I'm sure I downloaded it at one point, but don't remember ever doing anything with it OR putting it up for coworkers to browse.
Like the (released and quickly discontinued) version of Solaris 2.6 for PPC that ran on certain RS/6000s, it was "out there" and easily obtainable by anyone in the hobbyist community if you asked enough people.
No idea what was done at TN after I left; I had issues with how management treated the technical staff and resigned in late '98.
It's been 18 years, my memory is a bit fuzzy.
What's really weird is being called a "peer" by people who I looked up to when learning and just getting started. Massive case of impostor syndrome...
There are a ton of people out there, who are better talented and have contributed more to UNIX / Linux, open source, and the hobbyist/maker community in general that deserve recognition and fame.
I'm just a fat old fart sysadmin who's had a good run and was lucky to be able to enjoy most of it. The best I can hope for is to be thought well of by others.
Reddit is also a cesspool of activity from all sorts of people, so there might be some monitoring involved there.
Really, I teach a course in a local forensics program and have helped a couple local schools over the years. Any teenager with an iPhone could have explained that resetting the AppleID was a bad idea. There are plenty of very intelligent kids out there who need jobs. For the FBI to act in such a manner is inexcusable. Ditch some of these hack cops and hire some proper technology experts.