Hacker News Reader

Comment by mythz | Hacker News Reader

From recent polls most people think this debate is about:

"Should Apple be forced to give the Terrorist's phone data to the FBI"

When what it's really about:

"Should the FBI be able to compel technology companies to use their resources against their own and their Customers right to Security."

In order for the public to be properly informed about what's really at stake this case needs to be about the "Technology Industry vs FBI", not what the US Govt is trying to set the narrative to: "Apple protecting Terrorism". With this announcement this brings us to:

  - Apple
  - Twitter
  - Yahoo
  - Facebook / WhatsApp
  - Microsoft
  - Google (Sundar lukewarm)

Big technology companies with large user bases that's notably missing:

  - Amazon
  - Linked In

View on HN

What about other large semi tech companies. Starting with Tesla, but GE, paypal, Asus, Linksys, Cisco, Sun, Bay Networks, Coca-Cola, IBM, FedEx, Starbucks, Procter and Gamble and all medical HIPAA institutions, schools and Universities, McDonalds, Disney, Pixar, Amex, Visa, MasterCard, Costco, Caterpillar, Target, Nike, UPS, USPS, Exxon, Pepsi, Samsung, AT&T, t_mobile, Verizon, Sprint, Oracle, General Mills, Wells Fargo, Investment banking companies, etc.

They all have a stake in tech, and they all would not like to have their tech backed up by a system, that anyone can get into if one person leaks it out. DMV, the police, all those poorly secured systems that are now basically a new RFC that is for publicly routable address space that everyone treats like private address space, but just insert your special gummy bear finger print copy, and bam, you are in.

Get all those companies behind this, and people will think the FBI are crooks and theives.

I wonder if they could make a case that it violates the HIPAA, since your heartbeat/activity tracker info is on the device? Kind of a weak argument, but HIPAA is a pretty contentious subject.

I might be wrong, but my understanding is that HIPAA privacy rules only apply to healthcare providers like hospitals and their employees.

https://en.wikipedia.org/wiki/Health_Insurance_Portability_a...

This is correct. We ran a website for diabetics where users volunteered health data and HIPAA didn't apply to us. If it coordinated data exchange with doctors directly then it would be different.

What about doctors using an iPhone to check a patient's files? Would apple have to make a secure HIPAA compliant version for hospital use? What about government use? I bet all those FBI agents are talking to each other with iphones...

> I wonder if they could make a case that it violates the HIPAA, since your heartbeat/activity tracker info is on the device?

HIPAA privacy protections only apply to data held by HIPAA "covered entities", which are mostly insurers, health care providers, and their business associates, and they restrict disclosures by those covered entities.

AT&T is basically a full voluntary partner in the surveillance state.

your right

Yahoo should be in the upper list: http://www.usatoday.com/story/tech/news/2016/02/19/yahoo-sid...

updated, thx!

Mozilla should as well: https://blog.mozilla.org/blog/2016/02/24/continuing-the-conv...

I think the video on that page would be incredibly more effective and helpful if it didn't use "encryption" so many times, and tried to explain to people what encryption is. As it stands, it just repetitively uses the term to tell people when, where, or how they use it without realizing. I think the former point is more critical, and the latter less so.

As it stands, meeting encryption feels more like spotting Waldo than actually meeting encryption.

(PS: Hi, James!)

When what it's really about:

Are remote "software updates" to a buyer's phone, under the sole control of the seller of the phone, at any time (even after purchase), for any reason (e.g. the one being proposed here), a good idea?

Why? Why not?

Should Apple customers be given the option to flash the hardware they purchase from Apple with their own choice of software, whereby they might better control the HW and hence secure it from Apple and other third parties?

Or should Apple have the _exclusive_ right to flash the HW they sell, even _after_ purchase, without the customer's consent? As they do now.

Open hardware. Bad? Good? Necessary?

Heh. Open firmware would not solve this issue. If the firmware were open, the FBI would have already broken into the device. Apple's signing key (or, for the paranoid, the government's unwillingness to admit that they have obtained it through espionage) is primarily what is keeping the FBi's fingers out of the cookie jar.

A better question is how to further lock the phone down in future updates so that Apple can't comply even if they were compelled to, something Apple engineers are no doubt looking into right now. The optimal way would be to require a device to be unlocked to update the firmware, which would require the PIN, which Apple would not have.

Open doesn't mean it's an unlocked door.

Open means that the owner of the device can replace the firmware. There's nothing not-open about requiring that the owner authenticate first.

It's only not open if the vendor, rather than the owner, is the only one who the device will permit to replace its firmware.

Okay, so how do you verify that only the owner can do that, on the OS level, if the firmware is not first totally locked down? The security of iOS devices comes from the fact that Apple has engineered the devices to behave a certain way when using Apple firmware and that that firmware can't be modified or replaced without the signing key of Apple. And Apple is making it clear that they are on the side of the consumer, not the three letter agencies.

You use the exact same design as iOS, but with unique keys in the hands of each device owner (in other words, a PIN or password) rather than one key in the hands of the vendor.

> means that the owner of the device can replace the firmware

It means that a small minority of owners of the device can replace the firmware. Most people don't have the resources to do something like that.

The resources required to replace the firmware on a non-crippled Android device is access to the Internet from that device. This is not a big ask. Most people who own an iPhone have a data plan and/or access to WiFi.

Sure, only a small minority of device owners can actually make new firmware, but fortunately only one of them needs to make and distribute some firmware for everyone to be able to install it, if the device is open.

Are you saying this as someone who has helped non-hobbyists install new firmware onto their phones? I haven't, but helped many people install desktop linux around 2008-2009 and was often surprised by the problems they ran into.

Most people don't have the resources, knowledge, or desire to replace their car's engine parts. Does that mean it's ok to sell a car with a locked hood, that requires a manufacturer-controlled key before the engine can be serviced?

No, even if they personally don't want to touch the engine, they turn to knowledgeable friends/family or pay a professional mechanic to do the work.

This unfortunately-common view that most people should never even have the option to do anything technical is insulting and maybe even monopolistic (it bans 3rd party repairs/parts).

This strikes me as a great opportunity to use the "think of the children" argument against the government. Headlines should read like this:

"FBI wants ability to steal dick pics from any iPhone, including children's phones!"

Sure, but that goes both ways. It could easily be said that the FBI needs to be able to look through the phones of predators in order to convict.

I think they're talking something similar to GCHQ's intercept.

For those who are new, previously on hacker news https://news.ycombinator.com/item?id=7312212

I think you may want to rethink your soundbite. Heh.

But yeah, remember the scandal about school admins potentially being able to use the laptop's anti-theft programs to spy on children? Imagine that for all children worldwide.

> "Should the FBI be able to compel technology companies to use their resources against their own and their Customers right to Security."

For europe and the rest of the world, the answer was a resounding YES by the american government, their intelligence agencies and the american people at large, and it came years ago. So, this is not about their customers or their rights or any other abstract moral universals (which are valid only within the US). I wouldn't read too much into it, although i think it has to do with an attempt to restore the shattered image of US companies to their international audience.

So you are assuming the court will find against Apple? And that America will watch this and say they are cool with that?

The first is a possibility, of course. I don't think the second is likely. I personally do not plan to stop shouting about this, and informing my representatives on my position.

> "Should the FBI be able to compel technology companies to use their resources against their own and their Customers right to Security."

That's far too long and complicated for average citizens to parse and grasp implications immediately and intuitively. The second half of your question veers heavily into leading a person toward the conclusion you want them to have. Not ideal. Moreover, I think an average poll responder would get confused by the second half of the question as you've phrased it.

Perhaps try to phrase it like a simple headline or poll question that gets to the heart of the matter:

"Should government be able to force companies to change or disable your passwords?"

Here, I think, you have a much greater chance of grabbing the attention of the casual onlooker. Admittedly, it's a mostly true statement of the core issue here, while leveraging the need to hook a reader at a glance. An article/reporter/anchor can dive deep into the case particulars or not, cover and present its view of what's at stake in asking the question, include discussion of a "right to security" that may or may not be enjoyed by companies and individuals. But you want citizens to immediately grok what you're asking, and be able to, on their own, extrapolate possible implications that matter to them. This is going to be far more powerful in getting people to invest themselves in the issue--they must be able to imagine, see, understand that what's at stake could affect them.

The first half of the battle is this: You've got to get people to fucking care. And you can't get them there if you confuse or lose them at the start.

> "Should government be able to force companies to change or disable your passwords?"

And phrased like that, everybody will answer yes.

The dire implications of this case are not that easy to explain to someone who doesn't understand the basics of encryption/security. Welcome to give it another try, though...

> And phrased like that, everybody will answer yes.

The normal, non-technologists I know would most certainly find the idea that their passwords could be changed against their will--or, in the absence of their assent after death--pretty unsettling and inherently wrong. It's relatively trivial to provide analogous (though not entirely homologous) situations--e.g., should the government be able to force your mortgage company to change the locks on your house so they can get in to execute a search warrant?--that people would have immediate pause and find it worth considering. I don't know many people who would just thumbs up the suggestion that Facebook could be forced by the government to change/disable their account password. Or their banking passwords, email password, etc. If people became aware of a national conversation focused on the government trying to secure the power/precedent to force Facebook, Google, Apple, etc. to change/disable their passwords via a court order, I think very many more people will refuse to accept such an issue at face-value.

> The dire implications of this case are not that easy to explain to someone who doesn't understand the basics of encryption/security.

HN is a predictably poor place to discuss gaining widespread understanding by the masses on certain things. We too often fall into the trap of thinking that people must understand technical details of some thing X in order to understand implications of related thing Y. I think this is nonsense. People don't need to understand all the math and physics behind rocket science to understand that an unexpected explosion during liftoff has dire implications. We can explain that to people without ever showing them an equation, or talking about scientific laws/principles. There is no reason we cannot have a meaningful and productive conversation on this issue without losing the majority of American citizens as soon as we bring up the technical details.

Technologists haven't gotten much of anywhere getting the average American to understand, much less know why they should care about, encryption. Hell, we still engage in arguments here on HN about why you shouldn't roll your own encryption, even though all the programmers out there should already know that. We simply aren't going to get anywhere saying we first have to educate normal people on encryption. And it's plain wrong to think that an issue like this needs to be framed within a context that requires people to understand the basics of encryption. That's a no-win trajectory for carrying on a public conversation. You simply have to appeal to people using language that isn't overly biased, presents issues in the simplest possible ways (and builds up from there), and actually gets them involved in the conversation. It would, without any doubt, be fantastic if more people understood encryption, digital security, digital privacy, etc. But Average Joes and Janes don't really think about the devices and services they use in that way. I know a great many people who are [what I think are] normal, non-technical citizens, and their eyes just glaze over at talk of encryption--much like how many people's eyes glaze over at seeing mathematical equations, as if they're looking at Japanese.

The reason there is a higher propensity among potential Average American poll respondents to support the FBI on this issue is the way it's being framed. All I'm saying is that it's just as possible, and actually necessary, to frame the issue in a way that helps average Americans understand the dire implications of this case without having any need for understanding the basics of encryption, iOS, the Secure Enclave, trusted/signed code from Apple, and everything else that most HNers are discussing here.

> We too often fall into the trap of thinking that people must understand technical details of some thing X in order to understand implications of related thing Y.

Is that what you got from my post? Because it's not what I meant at all. I don't believe people have to understand the technical details behind it, but they do have to understand that the FBI forcing an unlock sets a very bad precedent which would massively diminish the security of the iphone/next iphone and this would apply to everybody, not just the tewwowist, AND that they're using a super old obscure shady law to back all that. There is a lot of data to understand and you can't easily grasp that from a single, short sentence.

Ah, my apologies then. This explanation sounds very different from your original suggestion that people need a basic understanding of encryption/security. I think we are quite close in agreement here.

I can see how my comment was misleading. My point was that those with a ground knowledge of encryption/security would most likely easily deduce this - but that doesn't mean you need such knowledge to understand what's going on.

I think Tim Cook's letter put it well. We should be focusing on the specific law invoked here. The All Writs Act says that people need to hand over all information pertinent to a crime investigation. Traditionally, this has been interpreted to mean all documents that already exist. Should we expand our interpretation to include information that doesn't exist but could be created?

If you had the ability to create information that could help in an investigation, should the government have the power to compel you to create it?

Oh, I absolutely agree. This is somewhat closer to what I'm trying to invoke here, but it's slightly different, and requires a different approach to engage the average American citizen in the conversation.

I think getting people involved in understanding this aspect of the case is critically important, as this is the part of the case that would be precedent-setting and [I believe rightly] concerns Apple and others with the requisite technical background. The danger is this precedent could be extended in untold tangential ways outside the realm of preventing device-wiping after n failed password attempts.

The trouble here, to me, is a majority of the average citizen who wonders what the All Writs Act is aren't going to bother finding out. They'll just accept the government's position that it allows them to ask for what they're asking. A smaller minority of those same citizens might go look up the All Writs Act, are probably not going to understand what it means. "What's a writ?" Hmmm. "What's "an alternative writ or rule nisi"?" I don't even understand what this means, much less how it applies. Oh well." Average people aren't going to become armchair legal (or encryption) experts overnight to resolve in their head where they stand on this issue. Thus, they're probably going to choose the path of least mental resistance, which will look something like, "Well, it is a terrorist's phone ... and I'm not a terrorist, so this probably doesn't actually affect me in any way ..."

Anyway, I think you're definitely on the right track with this part of the order, and the specific law invoked. We just have to get that into simpler terms an average American can understand, minus the expert/legal/technical jargon, and then get them to understand the implications. Your questions and phrasing are pretty good starters, I think. I can imagine, with perhaps a wording change or two for personal taste, I could ask a non-lawyer, non-technologist that question and they'd react with something like, "Why the hell should the government be able to force me to create something that doesn't exist so they can conduct an investigation?"

And that's exactly where we want people to be on this part of the issue at hand.

It's an interesting case because the people who are most worried about terrorists tend to be the people who are also most concerned with the government expanding power, especially by reinterpreting old laws. It needs to be clear that this is about expanding government powers to force people to work for them because so far the War on Terror has been a way to get past the opposition to expanding powers in most cases. But there has to be a line at some point where people think that it's been taken too far, no matter how scared of terrorists people might be. This idea of forced work might be that line.

"From recent polls most people think this debate is about..."

...or maybe people understand the debate, and they simply disagree with your opinion on the matter.

For example, even as phrased in the second form, my answer is "yes, sometimes", with an additional "there is no such thing as a 'customer's right to security'", added for good measure.

Even if I believed there were an absolute "right" to security, I don't think it's Apple's job to enforce it.

The thing is, if privacy advocates lose this fight, we have a greater chance of losing the next one.

I agree it should be the user's job and not Apple's to enforce security, however I also think that is something that we can focus on later. We can both support Apple now in this fight against government overreach and put pressure on them later to make their phone securable by the user. Those two ideas are not mutually exclusive, despite appearing to be both pro Apple and anti-Apple.

"The thing is, if privacy advocates lose this fight, we have a greater chance of losing the next one."

I don't think that's true, but even if I'm wrong, you could say that about any skirmish in the privacy debate. Every legal case sets some precedent that affects the next one.

Also, I don't agree that this is government overreach. This case seems about as clear-cut an example of a "good" investigatory behavior as we're likely to see. If you can't get behind the idea of compromising privacy when there's a valid warrant, in the case of a known mass murderer with probable ties to international terrorist groups, well...you've set an exceptionally high bar. I'm a reasonable person, I see your position, and I disagree with you on the merits of your argument.

>> "The thing is, if privacy advocates lose this fight, we have a greater chance of losing the next one."

> you could say that about any skirmish in the privacy debate. Every legal case sets some precedent that affects the next one.

Yes and no. The role of the judiciary is to interpret and implement the law. They are not supposed to create law. That is the job of Congress.

This case is so unprecedented that there's a chance the precedent here will effectively create a law. It will come down to a matter of interpretation by the justices. If they rule against Apple, the message is, "This is covered by the AWA, and the AWA was intended to compel companies to weaken their products' security". In that case, many of us in the public feel that the justices will have unfairly created a new law.

If they rule for Apple, the message is, "This is an undue burden being forced upon Apple. That is not the intention of the AWA. If you want them to comply, go to Congress and ask for a law"

Obama was a lawyer, he knows this, and in light of the public's disapproval of mass surveillance, he chose the path (the AWA) that is most likely to get him what he wants, which is to grant law enforcement access to all iPhones. The public currently will not re-elect congressmen and women who push through new surveillance laws.

P.S. I like your site vayable.com

>This case is so unprecedented that there's a chance the precedent here will effectively create a law.

This case is actually super with precedent, if you ignore the digital nature of things. Apple has keys to a safe (digital signage key for iOS updates), FBI has warrant to search safe, court orders keys to safe. Fourth amendment doesn't apply because Apple can't incriminate themselves by giving signage keys.

There is the whole "asking Apple to write the OS changes and sign it", instead of just "Asking Apple for the signing keys." I would call this a compromise ruling to avoid having Apple have to give the actual for real skeleton key.

Asking a judge to not force Apple to surrender the digital signage keys requires more subtle arguments about burden. Asking for any ruling on encryption itself is asking a court to legislate from the bench

The precedent you reference doesn't really apply because, as you say, the FBI isn't actually asking for the signing keys.

The big difference between what's being asked and the signing keys is that Apple already have the signing keys. There is certainly plenty of precedent for a court to ask Apple to produce something they already have, but less precedent for a court to ask Apple to make something that doesn't exist yet.

In the analogy, the FBI doesn't have a warrant to "search the safe". What is protected by the signing keys is the ability to distribute iOS updates, but the court wants the data on the phone, which is protected by a different key Apple don't have.

A more correct non-IT analogy is to imagine that the safe has two locks: one pickable, the other unpickable. Apple don't have a matching key for either, but knows how to cut a key for the unpickable one. The FBI has asked Apple to set up a key-cutting facility, definitely only for use on this one occasion, so they can make a key for the unpickable lock.

> if you ignore the digital nature of things

That is a gigantic "if"

There isn't a valid warrant in this case though: instead there's a writ (aka an order by the government) under the All Writs Act. This act allows the government to compel a person/company to do something when there isn't any specific law on the books for that particular situation.

However, the writ in question is to compel Apple to write a new version of the OS (not to hand over keys, not to hand over data in their possession, not to provide technical support to the FBI - all of which are things Apple has done when presented with a valid warrant).

From Apple's motion to vacate:

"In the section of CALEA entitled “Design of features and systems configurations,” 47 U.S.C. § 1002(b)(1), the statute says that it “does not authorize any law enforcement agency or officer —

(1) to require any specific design of equipment, facilities, services, features, or system configurations to be adopted by any provider of a wire or electronic communication service, any manufacturer of telecommunications equipment, or any provider of telecommunications support services.

(2) to prohibit the adoption of any equipment, facility, service, or feature by any provider of a wire or electronic communication service, any manufacturer of telecommunications equipment, or any provider of telecommunications support services."

So the writ appears to be in direct contradiction to other law, which would make it an invalid use of the All Writs Act.

No, you're completely wrong. There's a valid warrant. The owner of the phone also consents to the search. Apple's refusal has nothing to do with any of that.

What's happening here is that Apple is claiming that it can't comply with the warrant, because encryption. The FBI is invoking the All Writs Act to try to compel Apple to brute force the weak password on the phone.

http://fortune.com/2016/02/18/fbi-iphone/

But that's just an outrage line. Not a necessity line. There's no ticking time-bomb.

Nobody expects to get anything from the phone. It's the guy's work phone and they already have all the call logs, etc.

I hear that you're willing to trade liberty for safety, but what safety do you expect to get and are you considering any costs?

> Even if I believed there were an absolute "right" to security, I don't think it's Apple's job to enforce it.

Well, do you not believe the First Ammendmant protects against compelled speech?

Because the FBI's argument here boils down to "we have the right to require people to cryptographically sign things against their will"

Justice Scalia, 1987; “There is nothing new in the realization that the Constitution sometimes insulates the criminality of a few in order to protect the privacy of us all.”

I don't see anyone anywhere suggesting it is Apple's job to enforce security. Perhaps I misunderstand what you mean by that phrasing.

A good point. This is about where public and private ends on the internet, and that debate is still very fluid.

> "Should the FBI be able to compel technology companies to use their resources against their own and their Customers right to Security."

We can put the case into an even larger context and ask: should the FBI be able to compel [banks, accounting firms, insurance companies] to use their resources against their own and their Customers right to financial privacy? The answer to date, has been "yes." The right of the justice system to "every man's evidence",[1] has so far been thought to trump the interests of the customer relationship.

For decades, government has had the power to compel accounting firms and banks to search through their records (often at significant expense) to deliver information relevant to an investigation. I imagine those companies would love to be able to advertise that they won't cooperate with a government investigation of your taxes or financial transactions.

In my view, there are two different questions:

1) can the government ask Apple to unlock one iPhone; 2) can the government ask Apple to weaken security for all iPhones?[2]

The first question, at issue in this case, is something companies deal with all the time in many different contexts. The second question, on the other hand, may well be sui generis. I understand why Apple taking a stand on this particular hill--in their shoes I'd do it too. Better to "fight them over there so you don't have to fight them over here" so to speak.

I'm a little worried about the potential for blowback, though. The tech community is forced, in a way, to spread FUD to justify their argument as to (1). There are a lot of people who are confused by the reporting and think that this case involves the FBI requesting Apple to put backdoors in all of their phones, rather than leveraging an existing security weakness. That's not necessarily a great place to be in if you're found out.

[1] United States v. Nixon, 418 U.S. 683, 709 (1974).

[2] I don't think it's technically justifiable to say that (2) is implied by (1). Apple apparently already has the capability to subvert anyone's phones by using their signing keys to load weakened software. At a purely technical level, signing an "evil build of iOS" using an existing "backdoor" is different than introducing a backdoor into everyone's phone.

(2) is implied by (1) because once Apple has created the tool to do it once (1), the government has access to it and can (and will) use that tool endlessly (2). This is why Apple refuses to create this tool to unlock 1 iPhone.

History has shown we cannot restrict this by implementing laws/rules, just look at the news to see how these laws are abused right now, accessing all our private data.

EDIT: ok i get your point now; I imagine the reason this 'technical backdoor' exists in the first place, is because Apple wants to be able to update that part of the OS in case of bugs. If they make it 'not-updateable' the backdoor is closed but then if problems arise, bugs can't be fixed (for example the recent Error 5/home button bug).

You are right about the government being able to compel some action. Where it gets tricky with Apple is around the argument that code is speech. The government can compel an entity to do something, but they typically can't compel them to say something.

Even though this is incredibly unlikely, say for a moment that Apple has only hired developers that feel strongly that privacy is an inalienable right. If Tim Cook concedes to the FBI and gives the order that a hacked version of iOS is to be created, what happens if his developers refuse? Would Tim Cook be put in jail, or would the developers be jailed on contempt of court charges?

What about bank employees who feel strongly that financial privacy is an inalienable right? Do they get to avoid complying with government investigations into tax evasion or money laundering?

I see your code is speech point. I'm skeptical about it, because usually code is just code. It's meant to do something, not to express an idea. But I think there is some merit to the idea that code signing combines doing something (enabling code to be loaded) and communicating an idea (that the signer trusts the code). It's an interesting argument, certainly.

There are many issues here which have thus far been conducted in a legal or nebulous grey area of the law or flown under the notice of the general public for far too long:

Can the government compel the creation of original tools and IP outside the typical operations of a business? If so should they be required to compensate the business? Does the business then own the IP or the government? What happens when compelling a company to create IP or perform process outside of its typical operations is a net loss regardless of compensation? Should it be required to notify stockholders? Is it legal to make investments based on this PARTICULAR kind of inside government information? What if the entire company's operation may be plausibly undermined by the operation?

I think a more relevant example here would be whether the government could compel a bank or financial company to create or alter its financial reporting tools to falsify data or misreport to the subject of an investigation.

My understanding is the government is generally supposed to pay for the cost of external requests to private entities, should they choose to bill for it.... Unfortunately, the cost of compliance for Apple is lost future revenue, not just the technical costs of the gimped iOS version.

The specifics are important. If I said, "If a police officer gives you a lawful order do you have to comply?" you would immediately say, "yes". Now what if I said, "If a police officer demands that an entire neighborhood be subject to lengthy interrogation and be held for 24 hours in custody in order to solve a murder that took place there." You'd probably say that's ridiculous.

That's essentially what I view to be the case here. In theory the procedure may be perfectly "lawful" but in practice is clearly overreach. We need case law around this. I believe this is as clear a case of overreach as Apple could wish for. Finally, I believe it should be legal precedent set in public for once.

I'm not saying it isn't overreach, I agree that it is... the 4th and 5th amendments indicate this, as well as other reasonable interpretations of the law.

I was only responding to the gp, in that it would be billable, but the real "cost" may be incalculable... not to mention the damage to near term and long term security, and future incursions into privacy built upon yielding here.

Requesting a trivial modification to a piece of software is overreach?

It becomes non-trivial due to the marketing of their devices as secure systems. Just as with the burden of proof in defamation actions is higher in the case of a public figures, the "triviality" of the modification in this case is held to a higher standard due to the purpose of the product.

* I can't reply below this threshold but I'm enjoying the back and forth. People buy iphones because they believe that there are no ways to "trivially" access their personal information. Even for Apple to do so would be a breach of that trust. See: "Uber God Mode"

Apple can't access your personal information unless they are in physical possession of the phone. And, whether they have built the GovOS piece of software already or not, is essentially irrelevant to how easy it is.

If the only reason they can't get at your data is because they haven't compiled some code yet that's ALMOST NO PROTECTION AT ALL! Anyone making a buying decision based on Apple's failure to compile a simple piece of code is nuts!

Like, if you gave me a private document while I had my eyes closed and I said "Trust me, I can't see your data, I have my eyes closed. And I'm not going to open them." that would be crazy right? Building GovOS is the equivalent of opening my eyes.

I think you underestimate the value of trust in business and government. Its a common failing in the hacker ethos. Just because you CAN mess with the programming of an elevator the president uses every day doesn't mean you SHOULD.

People buy iPhones because they think that the FBI can't ever compel Apple to extract data from them?

And even if that's true (which I really don't think it is) it's not a good enough reason.

Say I started a bank and marketed my bank as an especially secure one. "Even the FBI will never be able to see your bank records. I won't let them!" I bet some customers might be interested in that. Just because I had marketed my bank that way doesn't mean my bank would gain some special legal protection against warrants.

The big difference between the two is that the banks have the information and are already subject to lots of record keeping regulations and so it is not an undue burden for them to comply with a subpoena demanding information. Apple does not currently have what the FBI is asking for and to comply would mean creating that software.

If the government wants to pass a law requiring phone makers like Apple to include a back door, then that's what they should do.

For me, this boils down to whether or not people are allowed to have strong encryption.

> For me, this boils down to whether or not people are allowed to have strong encryption.

Its easy to see why DOD originally classified it as a munition. Video games have become a powerful tool for storytelling, education, performance art, and immersive experiences for a long time but they started out as artillery simulators and a means to practice war games. That mentality pervades and we still see Jump, Shoot, and Run as the primary dynamic by which we function in these amazing experiences. You're fighting against human instinct and hundreds of thousands of years of evolution. Against Dunbar's number, the core mechanic of trust and social engagement for millenia. I hope you're right, but I don't think it will be the sea-change you're expecting. Look at the adoption of bitcoin and remember that law enforcement is a retro-grade function of society. Underfunded and always behind the zeitgeist.

We don't ask the secret service to build the president's merchandising website, and we shouldn't expect the FBI to be able to articulate or comprehend the, "triviality" of undermining strong encryption.

I think it was classified as a munition for practical reasons - they wanted export controls.

I think it's great that you name specific parts of the government because not all parts of the government think strong encryption is a problem.

All I'm concerned about is a bottle. Take a little walk to the edge of town across the track. Where the viaduct looms as it shifts and cracks. Where the border lies. Across the stack. On a gathering storm comes a handsome man with a red right hand.

4PM in Chicago. I'm out of here.

https://www.youtube.com/watch?v=EdhoX1Xu6ZI

> For me, this boils down to whether or not people are allowed to have strong encryption.

That's an absurd point of view because the phone in question doesn't have strong encryption(1). If it did, there would be no way for Apple to trivially bypass it.

(1) Well it kind of does but by encouraging the use of an incredibly weak password it defeats the purpose of having any encryption at all really. If the San Bernardino shooters had used a real password we wouldn't be having this discussion.

We have no idea what kind of password is set on that phone. If the shooter used a good password (he probably didn't), then no matter what Apple does, the FBI is still going to be locked out.

The chance of there being anything valuable on that phone is pretty slim. Especially when you consider how much the government is willing to spend on it. I was just watching CNN and Apple has apparently detailed what it would take before they would consider writing the compromised version of the OS. The reporter claims it would cost about $50 million and the government has apparently said "no problem, we can pay that". Ugh.

I won't cost 50 million dollars to comment out a few lines of code and recompile the OS. That reporter has no idea what they're talking about.

To be fair, neither do you.

Sure I do. I've been a professional programmer for almost 20 years. I have a pretty good idea about what sorts of things are hard to do and what sorts of things are easy to do. The FBI's requests are very easy. 50M is ~200 man years of work. That number is insane.

Have you ever worked some place that requires a security clearance?

Well, for Apple to develop this software, they would insist on it being developed in a locked down facility that doesn't currently exist (what Apple has is in use). I think they have said it's only about $100,000 of developer time (so maybe 2-3 months of work), but the infrastructure that would be necessary for the work to be done in a way that doesn't risk any leaks is expensive.

Can you make up some more facts about Apple's real estate situation and software methodology?

http://money.cnn.com/2016/02/26/technology/apple-iphone-fbi-...

https://www.washingtonpost.com/news/the-switch/wp/2016/02/26...

Apple has made the claim that code-is-speech. From that article:

> Wayne Giampietro, a Chicago-based lawyer and longtime member of the First Amendment Lawyer's Association, said that Apple is absolutely on solid ground with its argument.

Isn't the difference that the banks already have access to and collect this data and Apple does not currently have access to this data and it would not normally collected in the course of business activity?

You keep using Banks as an analogy. It fails because Banks are used to drilling out locks on flimsy safe-deposit boxes, Apple is not used to hacking old phones via firmware updates.

Nobody is saying the government can't attempt to unlock the phone - or even compel Apple to provide technical information. But that's not what the FBI wants. They want to force Apple to take all the risk.

Like it says in the video, it's mostly a business decision. All the companies in the top list are customer/user facing, while Amazon's AWS is not customer facing at all. It's about the customer's impression of the platform they are interacting with on a daily basis (presumably not Linkedin). Standing up with Apple on this issue shows their users they are (also) serious about their privacy.

Turn the tables for a second:

What would the US do if a foreign government had access to their citizens' information?

Would it become an issue of nationalism to use your own country's homegrown smart phone, browser, social network, etc?

it's is mostly a business and pr decision

"Apple had asked the FBI to issue application for iPhone passcode cracking tool under seal, but government made it public, prompting Tim Cook's public remarks"[1]

so no, apple doesn't really have the security of user in mind, it's just turning this on its head and putting up a show

[1]http://www.nytimes.com/2016/02/19/technology/how-tim-cook-be...

Twitter, Yahoo and LinkedIn aren't imperatives as their beacon data is likely the most important piece and the rest already cover that, and twitter is the only one that will be a company in a year.

Amazon, Google, MS and Apple are the real players, but Facebook is closing in as well. Google is the main linchpin, within 1-2 degrees everything clears through it: CA, DNS, Search, mx, analytic beacons, OS, hosting, etc.

They believe data should be used to solve problems and it should. But the consolidation risk is too high now, they own the whole stack and all the connections hopefully they have integrity here.,

No, it's not just that. It is also:

- Should companies reveal what type of information they have on their consumers.

- Should and can companies protect their data on their consumers as their own property.

Unfortunately those have already been decided and are unlikely to be reversed by this case. This case is currently about the AWA. A previous decision using the AWA, USA vs. New York Telephone, notes it can compel companies to act, given some constraints,

"We agree that the power of federal courts to impose duties upon third parties is not without limits; unreasonable burdens may not be imposed"

"The order provided that the Company be fully reimbursed at prevailing rates, and compliance with it required minimal effort on the part of the Company and no disruption to its operations." [1]

We already know law enforcement can get a warrant for access to information, and that people cannot reasonably expect privacy of information given to a 3rd party, including information on computers. Those decisions, unfortunately, have already been made and that's not what's at stake here.

[1] https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

Thanks, you have reminded me some huge IT companies that can also be related with this case! Amazon and the other IT infrastructure companies. Why are they missing or remain silent? Does it implies anything?

If the government wins this case, I will permanently destroy my personal cell phone and will never have one again. I will maintain a cell phone for work only.

That's a bit extreme. Just because there is a weakness in the implementation details of the iPhone PIN mechanism does not mean that all phones are weak. Apple already uses extremely strong encryption, and when coupled with a largish alphanumeric passcode, the phone would not fall to such easy attacks as the phone in question (4-6 digit PIN).

This case is not about weakening encryption in any way, something that I think is not well understood outside a technical audience.

That's a bit far. I'll just stop using mine to plot major crimes.

Snapchat?

I didn't see anything wrong with 'Should Apple be forced to give the Terrorist's phone data to the FBI'

It is what it is. You guys focuses more on how to limit FBI to abuse the terrorist card to violate privacy. But in case of a true terrorist, the answer should not be not that hard.

This is exactly what the FBI want's you to think and why they've carefully handpicked this case to try and set this legal precedent on - ridding us of our fundamental rights to privacy and security.

Out of all the 13 pending cases the FBI have with Apple using the All Writs Act (they've also said they have another 175 iPhones to unlock), this has the least chance of holding anything meaningful given it's his consent-to-monitor work phone, not his personal phone (which he destroyed), wasn't used at the scene of the crime, of which the FBI already have 6 week old iCloud backups of and would've had all the phones iCloud backups if they hadn't disabled them by instructing for the phones password to be reset.

Yet of all the pending cases under seal this is the one they've chosen to break character and go public on, exploiting this tragic event and using the fear around terror and emotions of victims for maximum PR and political effect to further their agenda of violating the security of millions of customers - which is both deceitful and clever, as apparently it's working.

I've always watched in bewilderment at the US Govt's response to terror, they're prepared to spend trillions fighting wars, billions changing Airport security, aren't prepared to do anything to change the easy access to the semi-automatic weapons that were actually used to kill all the victims, but are prepared to compromise the security and privacy of millions of peoples lives, violating 1st and 5th amendment constitutional rights for the theater of accessing useless data on a dead terrorist's work phone - for something which US citizens have less chance to die from than their own furniture? ...and the US public majority approves.

> trillions fighting wars, billions changing Airport security

That's only the means, not the goal, because...

> bewilderment

Spending massive amounts of money on wars makes a lot more sense once you realize that it's intended to channel money into their friends (and their jobs post-public service) in the military-industrial complex. Eisenhower warned[1] us, but the public didn't listen.

[1] his farewell address was amazingly prescient: https://www.youtube.com/watch?v=CWiIYW_fBfY

> But in case of a true terrorist, the answer should not be not that hard.

In the cases of true terrorists, having access to phone records and even having the father of a terrorist report on his own son hasn't been enough to stop attacks.

So, you should be asking whether or not you should be giving up your right to privacy and awarding the government broad powers that, based on historical data, won't reliably help prevent terrorist attacks, but that will be used far outside the original scope for which they were granted.

You should also not just be asking about the current government, but all future governments, and be able to trust that they will only act in the best interest of their citizens.

> I didn't see anything wrong with 'Should Apple be forced to give the Terrorist's phone data to the FBI'

Thats really not even remotely a legitimate question in this instance. If Apple "had" the data Im sure they would give it up readily (and probably have already in this and other instances). But they physically or digitally do not have the data to give.

But the FBI's request isn't limited to only phones used by categorically proven terrorists. They want to be able to unlock and unencrypt phones that pass a much lower bar regarding evidence of criminal activity - arguably to the point where they have a backdoor to any phone they want to look inside of. That's why Apple has to fight this case. It isn't about terrorists, that's just the PR spin the FBI are using. It's about much more than that.

https://medium.com/@jamesallworth/the-u-s-has-gone-f-ing-mad...

Reply on news.ycombinator.com