But couldn't they write a modified iOS software themselves (obviously not easy as cake, but for the sake of the argument) and use a NSL to get Apple's key to sign the update?
It seems like having the update signed is the issue, not writing the update.
Edit: When looking at the scope of the NSL, it seems like only metadata can be requested, not arbitrary stuff. IANAL, but it seems like using an NSL makes no sense.
I think that Ladar Levison would disagree with that comment. According to wikipedia "US government ordered [Ladar] to turn over its Secure Sockets Layer (SSL) private keys" [0] which imho would be no different that forcing apple to turn over a software-signing key.
>“To make use of these keys, the FBI would have to manually input all 2,560 characters, and one incorrect keystroke in this laborious process would render the FBI collection system incapable of collecting decrypted data,” prosecutors wrote.
From what I remember, the NSL comes with a gag order which prevents even the council of the recipient from knowing about the issue.
That was changed with the USA PATRIOT Reauthorization Act of 2005.
Both the validity of the NSL and the application of a nondisclosure ("gag") order to an NSL (not all NSLs are inherently gag-ordered) are reviewable by court, and gag orders have been struck down by courts.
So its not at all the case that an NSL would never be discussed in open court. Still, its impossible to say what NSLs have been issued with gag orders that haven't been struck down, since those particular orders would not be publicly disclosed.
If there were true rule of the law and everyone would have been treated equally in US, then either both Lavabit and Apple should give out signing keys, or none at all.
Lavabit was forced and had no choice. As far as my reading and understanding goes, the Gov created some sort of loophole where Lavabit was denied a hearing and because of lack of hearing he was... found guilty (catch 22). I'm sure others can shed more light...
At this point, Lavabit could've complied by just handing over the original data, but instead decided to get cute. "Contempt of court" is an aptly named crime.
That may be. However, simply forcing them to hand over the key wouldn't imho.
And even if they did, it would take them months from receiving the source code to be even remotely prepared to do a custom iOS build to present to Apple to be signed. Domain expertise, familiarity with a code base, and just "simple" stuff like build/release engineering and QA aren't things you put together overnight.
>You make this sound hard: there are tons of qualified people who could do this in less than a week, including myself. We already have all of these tools just sitting around from the iPhone 4, and some of us have emulators for more recent devices: the only thing we don't have is Apple's key.
From the developer of cydia.