Hacker News Reader

Comment by wil421 | Hacker News Reader

Did anyone else catch part of the congressional hearing on CSPAN?

I was appalled that some of the representatives want Apple to provide legislation that will make them unlock the phone under certain conditions.

The 1st and 5th amendment are what apples general counsel are arguing here. Code is protected speech so Apple is being compelled to speak by the Govt. They also argue the 5th amendment is being infringed because the FBI is using an All Writs Act which subverts due process.

It's really unfortunate Congress will most likely pass legislation requiring Apple to do this in the future (most likely for San Bernadino type cases but not the drug case mentioned in the acticle). It's gonna be up to the courts to determine whether or not it violates the constitution.

View on HN

The "code is speech" argument is more subtle than people appreciate here. "Speech" is not a type of thing. "Speech" is something someone does. A black armband can be speech when it's being used to express an idea, or it could just be an article of clothing.

In my opinion, code in its functional capacity is not speech. The code that locks the user out after 10 tries is just the digital equivalent of a gear or valve: a functional building block of a machine. A gear in its functional capacity is not speech, but can be if used in a piece of sculpture for example.

In this particular context Apple has a stronger argument, though. The act of signing code does express an idea: Apple's trust in the code. That might well be protected speech.

It is, though I imagine there's better precedential cases for digital acts as speech than Tinker.

More importantly, good on you for this: > In my opinion, code in its functional capacity is not speech.

This is HUGELY important for people to recognize before arguing that "Code is speech" in an absolute sense. Sure, it seems like a clear-cut position in the Civil Liberties sphere, but then you find all that same protected speech is suddenly subject to © and 35 USC §101.

>In my opinion, code in its functional capacity is not speech. The code that locks the user out after 10 tries is just the digital equivalent of a gear or valve: a functional building block of a machine. A gear in its functional capacity is not speech, but can be if used in a piece of sculpture for example.

That makes some sense, but I would distinguish between the use of an object and the creation of an object. Wouldn't designing a new gear or a new valve be speech? Are you arguing that there's no 1st amendment defense if the government tried to compel someone to design a new valve?

The first amendment protects communication of ideas between people. What idea is communicated by a new gear design? What idea are you communicating when you write a function to lock a user out after 10 tries?

If you tell people that your device is designed to be secure, then by designing a gear for that device you are implying that that gear is secure.

A fair point. I guess what I'm getting at is whether the creative process is an "action" that the government can compel, or "speech" that cannot be so compelled. Is it constitutionally allowable for the government to force someone to design something?

In this particular case, there isn't any creative process being compelled or even anything being designed. It's turning off a couple of security features. It's as creative as flipping a light switch.

So do this thought experiment: Apple is ordered to create fbiOS, and one or more engineers baulks and says: "This order is compelling me to write code, thereby compelling speech from me, and I refuse to write it." And she's sent to jail for contempt of court.

Your argument rests heavily on code that exists. It's much easier to argue that isn't speech just because it's easier to call it an object, an artifact. A gear. A knob. But before code is written, it is in the realm of thoughts.

I appreciated the irony of the part where Comey stated it was not Apple's business to protect the public, it was the FBI's. The irony being that the San Bernidino terrorists could have been easily detected if law enforcement had done even the most trivial of background checks during immigration.

[EDIT for downvotes] This is just the first thing that came back when googling as to when they became radicalized. The investigation isn't complete and I don't know how much has been reveled or what is actually true, but it seems likely Malik came to the US for Jihad and that wasn't something she tried hard to keep a secret.

https://twitter.com/ABC7/status/674630837514596352/photo/1

They didn't become radicalized until they were already over here.

What basis do you have for being so certain about that claim?

Yes, I did, and I wrote up what happened at InfoQ. Incidentally the video stream is still available and I've linked to it from the news piece, so if you want to watch it again you can do so.

Note also that in the debate the FBI indicated that there were another 170+ phones that they'd like to use the backdoor on. So while they may only be able get Apple to create this software for this case, once it is built they'll just use standard subpoenas to get them to deliver it for each of the hundreds of additional phones on request.

http://www.infoq.com/news/2016/03/apple-fbi-congress

[edit] in the video the FBI has the first hour and a half, then there's a half hour recess, then Apple's lawyer and technical expert step in around the 2h mark. There's a great bit from the FBI around 20 mins in where they admit resetting the password on the iCloud account was not a sensible move.

I watched the hearing (or at least the parts of it I happened to skip to in the 5 hour YouTube video), and I actually found it encouraging. There were only a few representatives who acted as you describe, Gowdy being one of them. At first I found it discouraging, but after watching more of the hearing, I realized that other representatives had much more thorough understandings of the law and technology. It also seemed like none of the representatives in the chamber particularly respected this Gowdy guy, as evidenced by their shit talking him.

This is a pretty good analysis of the 'code = speech' argument: https://www.technologyreview.com/s/600916/apples-code-speech....

It's analysis I hadn't really considered before and you might find it interesting. That said, I agree it's a bad idea that Apple be asked to write legislation where they're compelled to comply for other reasons.

Excerpt:

"But on the other hand, and critically, there are many things that humans will do with code that will have nothing to do with the First Amendment (e.g., launching denial of service attacks and writing computer viruses). Code = Speech is a fallacy because it would needlessly treat writing the code for a malicious virus as equivalent to writing an editorial in the New York Times. Similarly, if companies use algorithms to discriminate on the basis of race or sex, wrapping those algorithms with the same constitutional protection we give to political novels would needlessly complicate civil rights law in the digital age.

It’s easy to argue that Code = Speech, but accepting that argument would create a mess, and an avoidable one at that. It’s harder to look at what the government is trying to do, and harder to figure out whether this is in conflict with the values the First Amendment protects, but that’s the way the law works. The hard way is also far more preferable to giving tech companies whose businesses run on code a free pass from the kinds of meaningful regulation we’ve imposed upon other companies since the New Deal."

> Code = Speech is a fallacy because it would needlessly treat writing the code for a malicious virus as equivalent to writing an editorial in the New York Times.

I don't see that that is the case. Not all speech is treated "equivalent to writing an editorial in the New York Times", to start with; not all speech is treated equally, and harmful speech, particularly deliberately harmful speech, and particularly deliberately harmful speech that isn't communicating ideas about a matter of public concern, is not universally protected.

The full article gives a more nuanced view than the relevant excerpt I posted.

I doubt the "code is speech" argument will hold up when the only speaking is to a device that the government has the court-granted right to access. Apple isn't being asked to publish the modified iOS version at-large. Also, commercial speech has substantially less protection than political speech.

(Explain your down-votes, please).

The SF/SV perspective is not universal.

The here was an EFF article that mentioned a few cases where the courts have deemed code = speech. The question now is what protections this specific instance of speech is awarded. Here is another review of previous case law. From the second circuit court opinion

"Communication does not lose constitutional protection as “speech” simply because it is expressed in the language of computer code."

http://digital-law-online.info/lpdi1.0/treatise50.html

>"Communication does not lose constitutional protection as “speech” simply because it is expressed in the language of computer code."

Well duh. I can express a book as a C program and that is obviously protected speech. You can't take a shortcut like "is it code" to determining whether something is protected speech. Just because something is expressed in the "language of computer code", doesn't mean it gains constitutional protection as speech. You have to do a substantive evaluation.

Apple isn't being asked to publish the modified iOS version at-large.

Compelled speech in private is still compelled speech.

Imagine instead of Apple, we were dealing with a single programmer who wrote security code for a device. So the result is it's a single person being forced to sit a keyboard and type out code for the government.

Does it make a difference that it's a company instead? Should it?

Yes, drawing the line is difficult. Law is not mathematics. A judge must apply his judgment to decide whether a particular court order represents an "unreasonable burden". That is the precedent set by the case United States v. New York Telephone Company. An unreasonable burden for a one-man development shop is not necessarily an unreasonable burden for Apple. Judges are fully capable of considering this.

The precedent for United States v. New York Telephone Company has just recently been judged not to apply to Apple unlocking an iPhone. And unreasonable burden is not the only criteria. In addition, this specific situation has First Amendment implications that United States v. New York Telephone Company did not (although this has not been tested in court yet).

We'll see what the appeals courts think.

Consider however that Apple is being asked to digitally sign the modified FBiOS in order to load it onto the phone. The implications underlying the act of signing are the sort of speech that deserves the highest protection.

The fact that we take a digital signature to mean something about other human beings' intentions is just our own wishful thinking. Our security models rise and fall according to the constraints of reality, not our desires. Apple thought it could be its customers' confidant against the government. Apple is not your lawyer, doctor, priest, or spouse, so it is not entitled to be your confidant in the face of a court order. If they want to protect their customers from government court orders, then they need to re-think their threat model and include Apple as an adversary. According to recent news, that's what they're planning to do. It's also what they've been saying about iPhones for the last few years, even though it's now been shown to be untrue.

> It's also what they've been saying about iPhones for the last few years, even though it's now been shown to be untrue.

Well, the model of phone in that case (5C) is 2.5 years old using a 3.5 year old version of their CPUs lacking some of the modern hardware necessary (Secure Enclave.)

High-level details here: https://www.apple.com/business/docs/iOS_Security_Guide.pdf

That's what I figured at first too, but this line from Apple's open letter says otherwise:

>In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession.

This line has been quoted a lot and Apple has not redacted or clarified it. If newer iPhones were not vulnerable to these types of attacks, Apple wouldn't say that they are. Especially since they've openly said that one of their big concerns is damage to Apple's reputation for security and privacy.

The whole point of a signature, handwritten or digital, is to act as proof of identity and intent. If the government can compel Apple to sign FBiOS (against Apple's stated intent of signing their OS), where do you propose the government's ability to coerce a signature stop?

If your handwritten signature, to be interpreted by a machine, is all that stood between the government and their ability to carry out a legal search, I have no doubt that you could and should be compelled to produce it.

In my mind, that leads to scenarios where the government "asks" someone to sign a confession. That's been done before, and it doesn't end well.

No court would ever issue an order forcing you to sign a confession. You could make the same fallacious slippery-slope argument against any government power at all. "If they began to use this in a different way, it would be terrible". Of course, which is why we have a court system that decides what is and isn't an appropriate use of the government's authority.

The 5th amendment guarantees that you can't be forced to incriminate yourself. As an example that courts are perfectly capable of drawing lines, you can be compelled to hand over encryption keys for a third-party's data, but not for your own.

> The 5th amendment guarantees that you can't be forced to incriminate yourself.

It does, and my example was hyperbolic to my detriment by bringing in the 5th. The point I was trying to make was that the act you described (a manual signature to enable a search) was equally transgressive in my eyes.

The 1st Amendment does prohibit government-compelled speech, of which the act of digitally signing is (by analogy to signing) expressive conduct that merits protection. That alone should be sufficient to stop this case.

Your example doesn't apply here. For one, as far as I can tell, being forced to reveal one's own encryption key remains an unsettled matter (I would argue 5th Amendment protections apply, were I before the court). Apple is not being asked to supply something that they possess, they are being asked to use something that they possess, to create something that doesn't exist, to give to the government in order to enable a search. The government hasn't established if they have exhausted their own resources, they haven't (to my knowledge) proposed payment for Apple's services (which would as I see it constitute taking), and they haven't established the probative value of what might be on the phone (probably zip). And, if the product of this search were to come up in court, Apple would have to testify to their methods and be subject to cross-examination.

This whole situation is a tire fire.

You misunderstand the notion. Happens often because I think "speech" in this case is a misnomer, as it makes people believe that it's about having a monologue or a dialog. That's not the case. This freedom is about expression in all its forms. Which for example includes art, which is the act of creating artifacts to be primarily appreciated for their beauty or emotional power. Art is not necessarily about the author wanting to speak.

Going back to software, the freedom of expression is important, because software, functioning like an extension of us, of our intellect, probably more than any other human occupation except for art, happens to be very opinionated, to expose values and to incite both hope and despair for our future. It's not without reason that software development gets compared with making art.

It's not a wonder that Apple is taking a stand now. Any company worth its salt has values declared long ago and breaking those values is betraying your customers, not to mention that it can also hurt your bottom line. And the people at such companies are more than just cogs in the machine. Many of them work for their paychecks, sure, but many also have gotten in this industry to make a difference and now they risk being coerced in doing something they probably don't believe in.

Take Apple. They promised security and privacy to their customers and I'm sure many people at Apple worked hard to deliver that. How would you feel if you considered this to be your life's work, only to be forced later to aid in doing the exact opposite? Now that's an issue of freedom of expression ;-)

You're stretching the definition of free speech so far that any government regulation of industry would become a First Amendment violation. Not even during the Lochner era was such an expansive reading of rights accepted by the courts.

All of these large tech companies have massive government compliance programs. They regularly comply with government subpoenas for account information that they can access. They most certainly have developed custom software and workflows to make their compliance easier. I don't see how this request is a greater burden than that.

>How would you feel if you considered this to be your life's work, only to be forced later to aid in doing the exact opposite? Now that's an issue of freedom of expression ;-)

I'd feel pretty silly for thinking that I couldn't be compelled by the government to produce secrets I possess. If want to protect my customers from the government, I have to protect them from myself as well. You'd need some kind of multi-party trust system that allows people to require multiple third-party signatures before any code is loaded by the device. Free expression doesn't mean that the government has to refrain from exercise its legitimate authority, just avoid raining reality onto your premature parade.

But this isn't about being compelled by the government to produce secrets. This is about the government wanting you to produce malicious code that you're going to give your customers, signed with your keys. So those customers will receive that code from you, signed in your name.

>This is about the government wanting you to produce malicious code that you're going to give your customers, signed with your keys. So those customers will receive that code from you, signed in your name.

That's just not true. The government is not asking Apple to release this to anyone.

Reply on news.ycombinator.com