Apple Encryption Engineers, If Ordered to Unlock iPhone, Might Resist
nytimes.com
nytimes.com
Suppose that only about 5 people can do what the FBI wants done. Suppose all 5 refuse, to the point of quitting Apple. Does the FBI now compel them to return to Apple and write the software or go to jail?
And what if one of those engineers says that he doesn't actually know how to do it; Apple only thought he could, but he actually can't. Now we get into territory of proving competency and capability.
The idea that this would be a new low is ridiculous if one takes the time to consider conscription.
If you don't like that the government can coerce you (conscription, work in jail, contempt of court, eminent domain, etc) then rally against those laws, rather than the court using established powers
No, it's not an 'odd idea'. The fact that the government can coerce you has lots of limits placed on it. Conscription and the draft have been abolished in most places in the developed world, contempt of court may get you jailed but will not - and can not - be used to force you to create something and eminent domain can only be used to take something away from you.
So yes, this would be a new low, it would mean that ordinary citizens that have broken no laws can be forced to create something that does not currently exist against their express desire (and maybe even against their capability, how do you even begin to check if someone should be able to do something).
It would definitely be a new low.
All the things you pulled into it have nothing to do with the matter at hand, those are other things that you may or may not agree with but they are not the same as being ordered by a judge to perform a job that you have no desire to if you yourself are not guilty of breaking any laws. It would be an abuse of power that to me is unprecedented in any modern society.
> Conscription and the draft have been abolished in
> most places in the developed world
> contempt of court may get you jailed but will not -
> and can not - be used to force you to create something
http://www.nbcnews.com/id/17598441/ns/us_news-weird_news/t/m...
> eminent domain can only be used to take something away
> from you
> it would mean that ordinary citizens that have broken no
> laws can be forced to create something that does not
> currently exist against their express desire
> That is factually incorrect. There are plenty of counter-examples. One I can remember getting plenty of news coverage is: > http://www.nbcnews.com/id/17598441/ns/us_news-weird_news/t/m...
It's in 'weird news' for a reason, it's not there because this is the normal state of things. Yes, there are idiot judges, and yes, the system is broken to the point where you have no recourse. But to use that as examples to prove that the whole system is broken is reaching.
> Only if you ignore conscription, which is alive and well in the US (Selective Service), and the counter-examples where contempt of court is used to compel people to "create" something.
Neither of which prove that you could use either of those mechanisms to make a computer programmer create a piece of software, which was 'the topic under discussion', so what's your point?
That the US is a crazy country? That some judges are crazy? That you ought to place some checks on Judges power? Or that you actually feel that any of the examples above would be enough to prove to any person reading this that a judge will order a person (not Apple, the company) to create some intellectual property or be jailed if they don't?
> Selective service is a back-up plan that has not been
> used
> It's in 'weird news' for a reason, it's not there
> because this is the normal state of things
You said it was a new low for the courts. It's not even close. That's my point. You're twisting yourself and your words in circles.
That's all in your mind I'm afraid.
> Right. Except for WW1, WW2, Korea and Vietnam, which drafted collectively 15m people, when has it ever been used?
Yes, they were drafted. And since then the draft has been abolished and the US is at present operating an all volunteer force. Nobody got drafted into Iraq or Afghanistan.
That they can re-instate it does not change anything to the fact that right now the US does not have a draft. If you don't like the situation the way it is right now you have the following options:
(1) you can resist if a draft is re-instated, and you'll probably end up in a lot of trouble (I did this and got away with it (not in the US)) but it is possible to resist
(2) you can leave the country
(3) you can give up and get shot at for someone else's reasons
> Right, because the Apple case is run-of-the-mill? The Apple case is "the normal state of things"?
No, the Apple case is very much in the public eye and Apple is a very wealthy company. The courts may see fit to compel Apple to do this but if the employees resign I don't see how the courts are going to conscript them back into working for Apple, and so far nothing you've shown has made me change my mind on that.
> You said it was a new low for the courts. It's not even close. That's my point. You're twisting yourself and your words in circles.
No, I said it would be a new low.
If you feel that these other things are already below that then that's your right but for me there is a huge difference.
Anyway, I'm kind of tired of your personal attacks so I'll let this rest. Bye.
>>> Selective service is a back-up plan that has not been
>>> used
>> Except for WW1, WW2, Korea and Vietnam
> Yes, they were drafted
> And since then the draft has been abolished
> Nobody got drafted into Iraq or Afghanistan
> If you feel that these other things are already below that
Forcing people to work for the court does seems like a weird thing though. The whole "contempt of court" is a bit arbitrary (like you can be jailed indefinitely .. based on the decision of just a judge?) and just hasn't really been abused till now
It has been abused, plenty of times. But not in the manner the OP suggests.
> people have protested extensively when there was a
> draft
> as far as I understand [snip]
> no eminent domain would be pretty insane
> Forcing people to work for the court does
> seems like a weird thing though
What it's absolutely not is some kind of "new low".
Lavabit's problem was that they actually had access to the data, so they were capable of providing records and they didn't provide them. Then pen/trace laws require cloud email providers to provide this data to LE upon authorized request, and case law does not really support payment for hours expended to implement any data collection solution.
Demanding the SSL key in order to plug in their own packet capture (and we must presume appropriate filtering, yeah right) was a -- 'if you can't give us realtime feeds, we can get one ourself'.
So overall I think there are a lot of stark differences between Lavabit and Apple's case, thankfully. Apple is on much stronger legal footing. The corollary is iCloud and Apple has long since provided everything they had there, and there was no question they were required to do it.
Despite the differences in the two cases, it makes sense that Lavabit would want to help defend Apple's position.
There's only so much time they and their staff have to do research, so members of an industry and their legal representatives can contribute if the judges are on the fence or just looking for arguments.
Page 16 is the Thirteenth Amendment argument.
Now consider how slavery is defined. The slave-owners just got bigger.
Given that nobody is being put in a position where they might have to use deadly force, the usual pacifist or religious arguments don't apply. While suspect it would be hard to extend the concept to the orders given to Apple, the fact that the engineers involved would even consider resignation make it clear how strongly they object to the order.
Though I probably would anyway.
- I'd like to think. It's hard to really know.
> It's a bit like worrying about establishing your
> religious bona fides if you're a bishop
A better example would be trying to establish religious bona fides as a result of being a carpenter who makes church pews.
Unless they are atheist/agnostic and claim that this is a core belief for them. Not every atheist/agnostic is outspoken nor do they all share the same beliefs. It would be interesting to force the courts to make a judgement on the differences between the moral tenants atheists/agnostics follow and that of established religions.
If you only consider the subset of security related/conscious programmers they're fairly outspoken and on these particular issues they're probably more orthodox than comparable religious constituencies are on organized violence for which there have been pacifist exemptions. I'm not familiar with the law regarding conscientious objection (it's late, now I have my tangent reading for tomorrow) but I'd presume the first amendment would require that a secular philosophical objection would have to be as equally valid as a religiously motivated one?
That's correct, which is why I mentioned "pacifist or religious arguments". Various types of pacifist arguments have been recognized in the past, of both religious and secular origins.
From the Selective Service[1]:
WHO QUALIFIES?
Beliefs which qualify a registrant for CO status may be religious in nature,
but don't have to be. Beliefs may be moral or ethical; however, a man’s reasons
for not wanting to participate in a war must not be based on politics, expediency,
or self-interest. In general, the man’s lifestyle prior to making his claim must
reflect his current claims.
It's worth pointing out that being a conscientious objector doesn't necessarily excuse you from having to work for the government; as mentioned in [1], there are "alternate services" available for people that object to the usual draft.
I have no idea how any of this would apply to objecting to creating mass security vulnerabilities. It almost certainly requires a test case and judicial ruling.
If it was for a good reason then welp. Sometimes shit doesn't work. Oh well.
If they intentionally screwed it up then they could be found in contempt of court and fined and/or jailed.
In either case the would be asked to try again if that was feasible.
I understand that it's a common viewpoint on HN that the courts are ill equipped to make these determinations. Personally I think that viewpoint is vastly overstated, but that's a debate for another day.
As to your question about "unreasonable burden", Apple made something like 50 billion dollars in profit last year. The burden is going to have to get pretty high before it starts to get unreasonable. A couple of hours (or dozens of hours, or hundreds of hours) isn't going to even begin to get there.
Does this mean that "unreasonable burden" is relative? That just seems really weird to me that such a vague clause would be allowed in law. Like who makes that call? (honestly trying to understand the laws here)
Edit: Also consider that pulling off key engineers to do something completely unrelated to helping the company means time away from trying to stay ahead of competition. 1 month is already a huge amount of time when you're trying to stay ahead in one of the most competitive markets (mobiles). Also, a couple hours in court doesn't factor in time away from the office, travel time, and the additional cognitive burden of being in court. This also assumes the court schedules things in a manner that works within Apple's internal schedules. To me, this just sounds like a huge burden to any company in the mobile market.
> I understand that it's a common viewpoint on HN that the courts are ill equipped to make these determinations. Personally I think that viewpoint is vastly overstated, but that's a debate for another day.
I never said the courts were ill equipped to make those determinations. I said a judge wouldn't be able to do it because... well... that's not their expertise. To restate my question more clearly (I hope), how can you safely bring in security experts without compromising the case and guarantees that the courts would be allowing Apple?
Yes, "unreasonable burden" SHOULD be relative. Not all tasks take the same amount of time.
An example I can use is a future court case that involves the safety of rockets transporting people to Mars. It becomes immediately obvious that any investigation and changes a court may demand would cost a large amount of money in such an expensive field.
It doesn't make sense for there to be a strict, absolute cap on burden, say $100000. Sure, that's the salary of an Apple engineer for the better part of the year, or several year's salary for people in other fields, but it's also a fraction of cost of a single rocket component and a tiny portion of the budget of a rocket launch for a company putting rockets into space.
Does the "unreasonable burden" mean something different in this case? Who makes the call as to when this crosses the line? Something just doesn't feel logically right to me if this line moves at the whim of the current decider (judge? jury? someone else?) despite being an identical request with identical financial impact (just relatively different). There has to be some sort of guideline definition for "unreasonable" somewhere, right?
They would ask a jury of people not sly enough to get out of jury duty (maybe with one or two people who are there because they want to do their civil duty). It will not be your peers, but it will be your peers as the government determines.
This is a criminal case, however. It would apply to real people, but likely does not apply to corporations regardless of rulings treating corporations as people for other purpose. I imagine the Apple lawyers would have had it as part of their defense strategy if it did.
I'm pretty sure Tim Cook and his lawyer mean it when they say they will comply with the law. Apple engineers need not worry so much about quitting their jobs over this. If I were there I would stick with Tim Cook. Consider,
If Apple loses this case, this becomes a gigantic public debate where we scramble to enact legislation that removes this power from the government.
If Apple wins this case, and the government pursues anti-encryption laws, this becomes a gigantic public debate.
If the case is delayed for 2 years and goes to the supreme court, this becomes a gigantic public debate.
Regardless, since this is in the public sphere, whether-or-not-we-put-back-doors-in-phones is going to become a gigantic public debate.
The only way it doesn't become a big debate is if Obama comes out and says he's been informed on the issue and now realizes encryption in our phones is, on balance, a good thing.
[1] http://www.theguardian.com/world/2014/sep/11/yahoo-nsa-lawsu...
Further complicating things is the fact that this is a complex topic and most people (including almost all lawmakers and law enforcement agencies) are too ignorant to understand the important nuances, and they have no interest in changing that because, frankly, encryption is hard.
People are already aware. It's being covered in all forms of media, across all demographics. Awareness and understanding are wildly different concepts. People are aware, they just don't understand. The public can't be properly educated in the matter, because it's so nebulous and complex that it requires dedication to understand it. That goes for most of the issues we face as a society.
Think about this: Do you think the President, or any of the candidates, know much of anything about technology? Do you think they understand the intricacies of encryption? Would they even be able to name standard cypher suites? No, because that's not part of their education or job function. They rely on the few, their advisors, just like they do with most major issues.
I've seen your comments on this story, more power to you for wanting to start a grassroots education movement. I've also seen you muddy the waters with making comments about anti-encryption laws; this is an extremist fabrication on your part and not part of the actual current issues. As I've said elsewhere, directly in response to you, the outcome may be similar but the approach is completely different. If you manipulate outrage to reach your desired goal, you're just as bad as they are. You could've taken the time to read my other comments about this before declaring me defeatist, but instead you jumped to conclusions based on a small sampling; is this what your education is about?
[editing what I wrote, I missed something you said]
I believe our best hope is to start informing the public about encryption so that when more laws about encryption start appearing, then they are knowledgeable enough to let their representatives know how they feel about it. The idea is to inform enough so that the government is unable to spread FUD and an alarmist view that we will be safer when US phones have back doors. Because we won't. Other encryption tools exist that are not governable by the US.
[end edit]
> Think about this: Do you think the President, or any of the candidates, know much of anything about technology?
No. I've been thinking this for 8 years since patent trolls started becoming a nuisance. I'm happy to see we now have a couple of computer science graduates as representatives, including Ted Lieu who has been pretty vocal on this DOJ vs. Apple case.
> because that's not part of their education or job function
Hmm. They're supposed to have advisors or lobbyists for this. My argument is, in part, tech is missing a sufficient amount of those in the White House and DC. There can and should be more.
> I've seen your comments on this story, more power to you for wanting to start a grassroots education movement. I've also seen you muddy the waters with making comments about anti-encryption laws; this is an extremist fabrication on your part and not part of the actual current issues. As I've said elsewhere, directly in response to you, the outcome may be similar but the approach is completely different. If you manipulate outrage to reach your desired goal, you're just as bad as they are. You could've taken the time to read my other comments about this before declaring me defeatist, but instead you jumped to conclusions based on a small sampling; is this what your education is about?
Sorry hold up a moment here. Since when is providing facts muddying the waters? In most of my comments I'm citing sources directly. I also welcome debate. There literally are laws on the table at the state level in NY and CA that would require phone manufacturers to only sell phones that are decryptable when they are sold. Is it muddying the waters to call these anti-encryption bills? What would you call them?
I certainly wouldn't call what I wrote extremist.
I'm sorry if you're offended by what I wrote. I have no control over that. You are the one claiming the populace can't be educated. I have difficulty seeing how a person who clearly benefited from some form of education growing up can stand by this particular viewpoint. However, I do respect your opinion, and I apologize if I missed some of your remarks and mischaracterized your position. HN doesn't have any notification system for comments, so I probably miss some. I can't be expected to read every comment from one user before I respond to one of their comments can I? Please feel free to email me if you would like to discuss it further, or I can talk on the phone.
I'm not trying to manipulate anybody. I'm saying, let's put facts on the table and let people decide for themselves. If some people choose to ignore the facts, that's fine. If some technologists don't want to participate in sharing the facts, that's fine. But what's wrong with encouraging technologists to try? Again I welcome criticism of any of the words I write. If I'm being biased in some way I want to know about it, because if I appear biased here on HN then it will be more obvious to the layperson.
The narrative you've put forth is: "They're trying to remove encryption entirely so we aren't safe." when in reality it's "They're trying to backdoor our encryption, which makes us feel safe even though we aren't". The former conveys an obvious threat, while the latter conveys a much deeper and nebulous threat. I have to explain this concept to you, and we're both invested in the industry and the technologies involved; Do you think grandma is going to be aware of it, understand it, and take meaningful action? Considering the long and continuing overreach of TSA/DHS/FBI/NSA, the odds are slim. That sucks, but it's a reality. Your narrative wasn't an intentional manipulation, but an accident due to inaccuracies and misrepresentations; all too often the people on the other side do it intentionally.
I agree there can and should be more educated people responsible for legislation in the government, but that's part of a larger problem; The need for complete reform and transparency. The system in its entirety is broken and ineffectual and that's not likely to change any time soon. While we vote for a candidate, we elect a cabinet we usually don't even know about until the election is over. Think about that for a second. Now add in the fact that modern law enforcement will break rules first before being eventually regulated. The FBI and NSA have learned to follow the curve we've been using for years: Technology and innovation outpace regulation. This is just one tiny aspect of the overall complexity of this one single problem.
I would say it's not that technologists don't want to participate, it's that we have learned to direct our focus and energy to where it has the most impact; or realize that we don't have control to exert and choose to support those that do.
You, sir, keep being awesome and do what you feel is right. Just make sure you don't oversimplify massive problems for the sake of spreading awareness. That leads to people starting fights with misinformation; drugs are bad, muslims are terrorists, poor people are lazy, etc, etc.
Note that this is still an analogy. For better or for worse, analogies are used often in education. They're not the whole picture but they are a tool or gateway to other knowledge, if you will.
Anyway thanks again and I look forward to more critical feedback from you should we get a site off the ground. I can't say I'll necessarily agree but I will try to read and consider what you write.
How far down the advisor and lackey chain do you need to go before you get to someone who does understand the intricacies of encryption? Can name the standard cipher suites? Because I bet none of the advisers to the candidates or POTUS know those things either. This is not any of their jobs either.
Complete government reform and transparency are what is needed to correct most of the huge problems our world faces. Who has the ear of the king, can they be trusted, are they qualified, who has their ear, etc.
Lindsey Graham came around. Sam Harris changed his point of view after a fairly combative initial stance against technologists.
We will never know if we can inform the public unless we try. There are some good analogies out there supporting encryption. Use them. I recommend the one from Sam Harris' third video on the subject. There is also the whack-a-mole argument.
Honestly, the biggest thing standing in the way of the public being informed is not the unwillingness of the public to listen. It's the technologists' unwillingness to try to educate them.
I understand your trepidation. In life, we scientists are often ignored. But sometimes we are right and I do feel if we push hard here we can figure out ways to reach people.
What is the outcome of this major revelation? Much of the public thinks no different than before in regards to government spying or encryption, and security practices are not fundamentally different even after years of media advertising what happened. Many people don't even know the significance of Snowden.
We should definitely push harder for the correct stance on encryption but I cant help and think your hope is a bit pollyannish.
How many interviews did Tim Cook give again? How many news outlets brayed this at the top of their lungs? https://www.google.com/search?q=new+york+times+apple+fbi&ie=...
In this case we're talking about the FBI wanting access for regular police cases. That touches way closer to reality for many.
See, it's words like pollyannish that we shouldn't be using when engaging the public. Only kidding. But I did need to look that one up. Thanks for making me think about it. I'd say it describes me well.
If you think that is a worthless way to look at the world, then that is my problem right? What skin is it off your back?
Regardless of whether you see good in other people or not, the fact is people can and do learn about things and change their points of view. You can't point to an uninformed mass and say they are incapable of learning. En masse, yeah I agree, we can't flip a switch, but that's the way it should be. People have their own brains and should use them. We just need to present the facts about encryption in a manner that is clear for non-techies. I think there are a lot of ways to do that. If you aren't up for it, that is your decision and I support you in that.
Basically, he did a complete 180.
You should listen to both his first [1] and third [2] podcast on the subject. In the first one he really lambasted supporters of encryption, and in the third he changed his view completely.
He quotes a good analogy here [3] and concludes his thoughts with a final opinion here [4]
I don't fault him for his first podcast. He came up with a reasonable point of view given the facts he understood. And when presented with new information, he changed his mind.
[1] https://www.youtube.com/watch?v=ZQAmlVFjJ9k
[2] https://youtu.be/9HK4IBscfMQ
Edit
Here it is: https://www.youtube.com/watch?v=Yp6IhjK75oE
Apple's revenue is $658 million per day (2015), not sure if they care too much about "hundreds of thousands".
Will people please stop quoting revenue figures for things like this.
https://www.washingtonpost.com/news/the-switch/wp/2014/09/15...
Presumably it is not a random number, but is calculated based on factors like the company's revenue. A $250k fine would kill most small businesses. Google/Apple could pay it indefinitely without breaking a sweat. So it makes sense to me that the fine has a very wide range depending on the situation.
> Can the government just declare the moon to be their property tomorrow?
No. The United Nations Outer Space Treaty prevents nations from claiming the moon as territory (although the US could withdraw from this treaty, wait one year, and then claim the moon).
> How would they enforce the delivery of these funds?
The same way they enforce collection of taxes. Bank accounts can be frozen, property can be seized, perhaps corporate leaders could be arrested for brazenly ignoring an order to pay.
"Political power grows out of the barrel of a gun" - Mao Zedong
People at Apple just refusing to assist the government is, in a way, the government's worst nightmare: it shows just how little power they actually have.
Some weak forms of political power grow out of the barrel of a gun. True power grows from the consent and support of the governed. Withdraw that consent, and the gun is shown to be a pitifully ineffective tool of government. Maybe this is a historical lesson we need to re-learn.
"You don't really own anything that you couldn't carry at a dead sprint while firing an AK-47 over your shoulder."
We need to fix here because we actually have a shot of fixing it here.
No such thing will happen. The public will forget this ever happened, and politicians will do nothing to prevent the government from doing this again.
I'll fight this as long as it's under discussion. Talk to your friends and family, contact your representatives and let them know you care.
If we as technologists, the only ones who understand the tech side of things, are silent, then yes this defeatist attitude will win.
We need not be silent.
Unless you have a lot of money, your representatives don't care.
It seems like the only way to make progress is to support stronger encryption, with less of a possibility of engineering backdoors.
> Dick Durbin: I think most Americans would be shocked-- not surprised, but shocked-- if they knew how much time a United States senator spends raising money. And how much time we spend talking about raising money, and thinking about raising money, and planning to raise money. And, you know, going off on little retreats and conjuring up new ideas on how to raise money. [2]
...
> Barney Frank: If the voters have a position, the votes will kick money's rear end any time. I've never met a politician-- I've been in the legislative bodies for 40 years now-- who, choosing between a significant opinion in his or her district and a number of campaign contributors, doesn't go with the district. [2]
The point is, if they are voted out they lose their jobs and income, therefore they must listen to voters. I'm not saying I support super PACs or anything, but I find it comforting to know that if we come together on something then we do have a role in the democratic process that is stronger than money.
[1] http://www.thisamericanlife.org/radio-archives/episode/461/t...
[2] http://www.thisamericanlife.org/radio-archives/episode/461/t...
Or make your own campaign. The more, the merrier.
There is also the EFF, and an organization called Fight for the Future which is currently running a campaign called Save Security. I'm in touch with both about working together. Tech companies will also lobby for stuff themselves. I'm not sure whether the likes of Facebook, Google and Apple are coordinating on this issue yet or not.
My thought is to do this campaign at zero cost and on donated developer time. I don't plan to register as a 501(c)3 or take donations. I'm hoping Obama changes his mind and there is no need for a campaign. But, if that doesn't happen, I hope we can present the facts to non-techies and share some reasonable arguments techies can use when talking with friends or family, or when contacting representatives. I've read a lot of good arguments online. I think it's just a matter of putting them in one referable location, and making them relatable to non-techies.
Unless the voting public starts valuing their privacy more, the government can simply legislate around stronger crypto.
They can mandate key escrow, ban encryption altogether, or be old fashioned about it and send letters demanding you hand over the private key. Don't like it? Go to jail.
All of the companies I've mentioned have filed or joined in an Amicus Curiae brief in support of Apple [7]. If money mattered more than voters, then congress would have already passed a bill to satisfy the wishes of America's most financially successful company.
Why haven't they? Because money can only buy advertising and campaign staff. It can't buy votes and votes are what keep them in office.
[1] https://ycharts.com/companies/AAPL/cash_on_hand
[2] https://ycharts.com/companies/FB/cash_on_hand
[3] https://ycharts.com/companies/AMZN/cash_on_hand
[4] https://ycharts.com/companies/GOOG/cash_on_hand
[5] https://ycharts.com/companies/MSFT/cash_on_hand
[6] https://en.wikipedia.org/wiki/List_of_public_corporations_by...
[7] http://www.apple.com/pr/library/2016/03/03Amicus-Briefs-in-S...
The window of opportunity is short, and closing every day.
He thought encryption was something we could easily ban, and he's a civil engineer. I walked him through it mathematically, then gave examples until he understood, but not everyone has a technical background.
We are losing because we aren't presenting an alternative public narrative.
We must educate the public on the necessity of strong encryption to the modern economy, and the danger of backdoors. Even getting them to imagine how the Soviets would have used this technology is usually enough to get the greatest generation and the boomers to at least think.
We won against the Clipper chip, munitions classifications, export grade encryption, 96-bit maximum key sizes, and SOPA.
We can win here.
This is something that I find is hard to explain to nontechnical people because it isn't intuitive of our understanding of the real world.
E.g. "If a bank can keep my money from being stolen, then surely you can keep this backdoor from being stolen, so stop complaining and just do it already!" -- As Trump would probably say when ordering it done, echoing the sentiments of many.
NYC: http://daringfireball.net/linked/2016/03/12/new-york-1620 TSA: http://www.engadget.com/2015/09/11/tsa-master-baggage-keys-3...
I remember being told that I was paranoid when I had concerns about CALEA. I was worried that it would be used for purposes other than warrant-backed monitoring of actual criminals and criminal suspects.
Here we are, 20 years later and even though there's no evidence that things are quite as bad as I feared, it's certainly much more invasive than we were told it would be.
Even the most controversial and contentious of issues are quickly forgotten or mis-remembered by the public.
This IS the last stand on this front. If Apple loses, we all lose.
I'm sure Apple has a legal army gaming out each one of these scenarios.
No, it doesn't work that way (see the post from dolske 7 hours ago):
https://news.ycombinator.com/item?id=11310214
Under these rules in only a few months all the money would be gone.
If a judge orders an injunction against these citizens and they don't comply, he won't fine them, he will jail them, which is an incredible hardship, esp. against people not used to the prison industrial complex and its dehumanizing effects.
Perhaps sitting in jail for weeks or months will endure these guys to the IT masses as martyrs-to-the-cause, but I would fully expect them to cave after a little while.
[1] I mean this in the sense of to deal with or correct a problem, and also to influence the result by improper or illegal methods
Creating code is not like being compelled to testify. Is the DoJ going to have a prosecutor ask them "Now what would be the next line of code?" until they get a working tool?
The coders have an excellent case against them being jailed. The government has already stated their fallback position - that they want Apple's source code and signing keys. Apple will probably at that point secure their signing keys and code, perhaps by moving them offshore.
It will be interesting to see if some defense contractor can make head or tail of Apple's code, build system, etc. That could be a comedy I'd pay to watch.
If you can show these people would know how to do it, then it must be common enough knowledge that the courts could find someone else.
If it is highly specialized knowledge that only these people might even know, then you can't prove that they do know how to do it.
Either way, you can't justify forcing them to do it. And it is if we are even fine with slavery to begin with, which I'm not.
Please cite me an example of somebody who hasn't broke the law being forced to work against their will for months to do something as an employee.
The expense may actually prove valuable as their willingness to "pay the cost of defiance" might make them seem more appealing to customers and increase the value of their products.
It doesn't work that way:
"dolske 7 hours ago: The feds threatened Yahoo with a fine of $250,000/day, _doubling every week_. It doesn't take long for that to become astronomical."
In just 26 weeks it's 16 trillions per day if I calculated right.
How does that work if say someone resigned some months before the events of the terrorist attack from Apple? And they still refuse to work for Apple? There's no legal obligation for me to work for Apple or anybody in the US Constitution. All I got to do is pay taxes where applicable. Taxes don't include writing software for a random agency.
One of them is that they have to be closely connected to the case. The arguments for Apple not being far removed are that they license the software, that they designed created and sold the phone, and so on. Most of the don't apply to the individual engineers, so they probably can't be compelled even if the court finds that Apple can.
Another is that it can be too burdensome, and part of the burdensome analysis is if it is "offensive" to them. Considering they quit their jobs over this the court would almost certainly find that it was too burdensome, even if the court doesn't find it is too burdensome to compel Apple.
I can't imagine any way in hell that would fly. The only remotely conceivable path to doing something like that would be to have Congress implement a draft, and draft them into the military. Anything else would almost certainly violate the 13th and/or 10th Amendments to the Constitution. And the draft thing is probably a stretch as well, especially in the absence of a declaration of war.
Then again, I never put it past the US government to try anything, no matter how illegal it is.
The sad part is, As Tim Cook said, all this will do is push the bad guys to use an encryption app from somewhere else.
I have a good deal of experience in the US criminal justice system, and the one thing everyone I've met and done time with inside the system, from bank robbers to drug dealers to murderers say is, in the end, "They (the courts and prosecutors) Do What They Want"
In fact its such a common saying, its almost a running joke inside.
I was definitely talking at the Public Defender level.
Maybe 5 people now can do that, but give a smart programmer (I'm sure Apple has more than a bunch of those) source code and I'm sure he will figure how to do what government requests in max few weeks time. It's not a rocket science.
Add in that I'm probably not super enthusiastic about the task and that month could end up being two months. And the end result due to unfamiliarity and stress has a non-zero chance of messing up and accidentally wiping the phone anyway. Notice I didn't use quotes there. You would need some significant qa resources to ensure that I didn't mess anything up.
Or maybe I'm wrong and there is a clearly marked single easy place to make all the changes that Apple has requested to make and there are already unit tests that verify it does something it wasn't originally designed to do. Then sure a few weeks time is all it will take. But Apple estimated 6 months for trained familiar engineers. Anyone else and we could be looking at close to a year.
#Legal:
* Judge orders them to comply, if they refuse they can be considered to be in contempt and incarcerated for a de facto arbitrary period of time at the judge's discretion (vide https://en.wikipedia.org/wiki/H._Beatty_Chadwick incarcerated for contempt for 14 years just because the judge suspected he had funds that apparently he didn't have, also Terrell Geiger http://articles.chicagotribune.com/2011-10-07/news/ct-met-lo...)
* Civil forfeiture. The state can just de facto steal every single item those people have and leave them unable to fight that in court (not that it would make much difference)
* Involuntary commitment. They can just be committed into a psychiatric institution where they can be drugged against their will and even tortured. This can be extended to an arbitrarily long period of time
* They can have their children taken away
* IRS can just accuse them of an astronomical tax debt, take all of their possessions and leave them effectively unable to get legal representation (not that it would make much difference)
#"Illegal":
* Just detain them in a secret facility and do with them as they dam well please
TLDR: The state does with you what it damn well pleases and there's nothing you can really do about it. Granted this usually doesn't happen but that's just because the stakes usually aren't that high.
Yes, a judge could hold them in contempt and jail them for some time. That's the only legal option.
It's possible they could seize some assets as part of the contempt charge, but there are already plenty of legal groups that would jump at the opportunity to represent them pro bono.
The other suggestions you offer are, to be blunt, those of a conspiracy nut.
Not some time, there's no limit. It can be extended arbitrarily.
All the others points I made in the legal section are indeed legal and have been used in the past though they are indeed unusual.
This, and other techniques you describe, have been used by the FBI in the past but as far as I know only against the relatively powerless. It seems silly to think the FBI would do it in this case.
If the FBI started doing that to employees or ex-employees I suspect Apple would leave the U.S.
The FBI can't take away the person's children. --Even if he's put in jail, the other parent would retain custody. The FBI would have to convince social services to remove the children from the home, and family court judges aren't overly likely to go along with that.
The FBI could potentially convince a psychiatrist to have a person involuntarily committed for a short time for observation, but they can't force any doctor or hospital to put the people on drugs or otherwise force some form of treatment on them if there's not diagnosis of mental illness.
The FBI doesn't get to tell the IRS to make claims about a person owing an astronomical sum. I suppose they could fabricate evidence and give it to the IRS, but then the individuals responsible would be performing illegal actions and risk being sent to prison themselves. Most members of the law enforcement community are decent people and aren't willing to do that type of stuff.
Given the importance of the situation it seems it is very likely it is going to happen just here. It's up to the judge(s).
>and family court judges aren't overly likely to go along with that.
It's up to the judge(s).
>The FBI could potentially convince a psychiatrist...
This is just redirecting pressure to a different person, keep doing it until you find that someone who will buckle.
> Most members of the law enforcement community are decent people and aren't willing to do that type of stuff.
Just like above, most are honest, but you only need one that isn't.
If you think all of those are impossible by the US government, take a look at you know where, where torture doesn't happen, and no-one was prosecuted for torture that didn't happen.
Black and white thinking. The government does something you disagree with, so suddenly now it's natural to expect them to wield literally every tool of state power against you to make that happen.
The government, after all, is not a singular entity. Its made up of many checks and balances and institutions that often act in disagreement with one another.
The key point here is that if the USG find a way to force Apple and Apple engineers to do this work then the government, by default, they must have too much power.
This is always better but they don't even need to find it. That's just a bonus.
They can just fabricate it. Assange is still in effective house arrest because someone apparently was a victim of "sex by surprise".
If that were actually implementable against large powerful corporations universally, we would not have had a bailout after the derivatives bomb. As it is, not even the ratings agencies got nicked.
That doesn't mean your due process rights disappear. You can challenge the warrant and the applicability of the All Writs Act all the way to SCOTUS. You can even still file a writ of Habeas Corpus.
You can even say that you forgot how to make the modifications. The onus is on the DOJ to prove you haven't. Awfully hard to prove what's in a man's head.
You could even argue that there's potential criminal liability (e.g. state wiretap laws) in your assistance, and invoke the Fifth Amendment. It's also awfully hard to prove that a man has definitively not committed a crime.
Best and most commonly, you can convince the judge that as a matter of conscience there is no amount of time in jail that will convince you to comply with the court's order. Thus holding you in custody serves no judicial purpose, and you are free to go.
This may be one where going to jail out of protest is necessary. I say that as someone who faced felony charges that were wholly fabricated, and was offered deal after deal, but I told them I would never take any deal because it wasn't right. I've never forgotten the look I got in response on the prosecutor's face.
I've got a feeling, however, that the FBI has made a grave PR mistake here. People have such a personal connection to Apple. A huge portion of the powerful population holds considers their iPhones their most significant inanimate posession.
Holding the makers of these devices indefinitely in a jail cell, without trial, might finally connect the American populace to the fact that they have just witnessed the largest scandal since... probably post-Vietnam.
This is a moment that where history turns on the decisions of a few. And people have been known to sacrifice far more than time in U.S. prison for ideals far less worthy.
If the warrant is upheld, it will be a very individual decision whether to comply.
Resistance has power, even under far more hostile governments than ours.
I'd like to think I wouldn't. But truly I don't think anyone can really know that until it's real.
--------
If anybody from Apple happens to read this:
You are already naked. There is no reason not to follow your heart. - Jobs
You only have power over people as long as you don't take everything away from them. But when you've robbed a man of everything, he's no longer in your power - he's free again.
An equally likely outcome is that we lose, they end up known in the future in the same light as Guido Fawkes - you know, that guy who fought for freedom of religious association and an end to oppression based on your flavour of christianity some three hundred years ago, who we still get children to burn in effigy every year.
Or more likely they're completely forgotten and ignored, and our grandchildren can't even imagine a world in which your boss doesn't know your most intimate personal details, for the word "private" no longer exists.
In fact, I'd say the Nov. 5 plot immortalized his ideas and spread them far wider than their original audience and circumstance.
I'd say the gunpowder treason is far from being forgot.
Everything is viewed through the lens of relativism, of course, but history has repeatedly shown that great men are viewed as villains, villains as great men, and very little of what you "know" is in any way actual. This reality is as fabricated as a film.
We live in a society which is governed on the idea of the Rule of Law.
Big difference.
>of or relating to a system of government that is centralized and dictatorial and requires complete subservience to the state.
When the rule of law says obey or else, then it is totalitarian. You can't just point at some other government and say "But they are worse."
North Korea is "governed on the idea of the Rule of Law".
Germany and Italy were "governed on the idea of the Rule of Law" in the 30's.
Franco's Spain was "governed on the idea of the Rule of Law".
Shall I go on?
Comparing the US today with Soviet Russia under Stalin or NK under Kim is so ill-informed its impossible to process.
To completely disregard any comparison because "they're bad and we're good" is so dogmatic and jingoistic it's impossible to process.
Edit: And I see in a parallel comment you say re: the US justice system "They (the courts and prosecutors) Do What They Want"
Would you really quantify that as the rule of law, or as arbitrary rule?
It's somewhat arbitrary within a pretty solid framework, if you want my opinion.
My OP and this thread was about macro-level rule of law, my other comment was micro-level obviously.
No one is talking about "bad and good" here, I'm just saying you cannot compare them as you have attempted to do, as the fundamental differences defy equivalence.
This is old territory, really. Courts have been ordering people to do things under the All Writs Act (including skilled labor) since it was first enacted more than 200 years ago. (The government's brief has some examples, starting on page 17. http://www.wired.com/wp-content/uploads/2016/03/2016.03.10-1...)
If an employee claimed he or she did not have the skills to comply with he order then, yes, there could be some sort of hearing to determine whether this was true. But establishing the requisite level of competence probably would not be as hard as you think.
Ah who am I kidding, there's always a dude willing to give away his baby's kidney for money. Systems that screw people over are built by humans.
And then give the same capabilities to the governments of every country they do business in.
Our politicians might actually fight for our interests in digital privacy/security if theirs is directly threatened by the governments of China, Iran, North Korea, and Russia.
If our government needs this to do lawful search and seizure, so do all these others.
I'm tired of our gov acting like they're above reproach and somehow more deserving than any other naive government. History has shown they can't protect us from terrorists 100% of the time, and it shouldn't come at the expense of our civil liberties - at the expense of the principles and detracting from the identity of what makes us American. They can't even protect the information of people who elect to share their privacy with the gov (OPM breach/leak of which I was a victim). They shouldn't have the ability to violate the security of [realistically] billions of phones. It's absurdly overreaching and a massive abuse of the authority we "give" them.
Caveat: Not complying and this other plan of action would both upset stockholders.
- Government power and rights > individual power and rights. - Mass surveillance of their own people. - Constitution consistently ignored. - Civil liberties viewed as an annoyance. - Militarized police force. - Secret court systems that "OKs" any government action. - Mainstream media little more than an arm of government propaganda. - Whistleblowers treated like criminals. - Indefinite detention laws ready to be used for any reason. - Can justify any action in the name of "national security". - Political class rules all.
We have a word for this type of government but but no one is talking about it yet. Whatever the outcome to Apple, a government like this will try again and find other ways to do what they want.
What is the word to describe what we now have in the US?
I don't think we would live in a forced back door world for too long. After another 2, 4, or 8 years, we will eventually realize that giving the government a back door to the iPhone did not give it a back door to the myriad of other encrypted communications tools out there. Terrorists will find other ways to hide their communications.
I really don't want to see Apple lose this case, or any sort of anti-encryption bill. I also wouldn't want to see someone throw away working at Apple over it. Apple can maintain its integrity by complying with the law as it has publicly stated. Engineers can remain true to an employer they respect knowing said employer did everything they could to resist the government. There aren't many great employers out there like this. Don't take it for granted.
That's just my 2c.
[1] http://www.theguardian.com/world/2014/sep/11/yahoo-nsa-lawsu...
The fact is, if nobody stands up for this, do you really think anyone is going to stand up and try to take away the back door to the iphone and get away with it?
Do you really believe they will stop there?
This case isn't over. There are a lot of good things about the US. I believe our commitment to freedom of speech is stronger than elsewhere. This case is strongly testing that belief. And, according to the ACLU, it will be at least two years before this court reaches the supreme court [1]. There is a lot of time to educate the public on the facts about the case and how the technology in their pockets works.
There are multiple examples of public figures changing their minds when presented with evidence. Lindsey Graham and Sam Harris are two.
I and a few other developers are forming a grassroots campaign around this. If you'd like to get involved, whether you're a developer or not, shoot me an email at stillastudent on google's email service
[1] http://www.usnews.com/news/articles/2016-03-04/apple-and-the...
".@tim_cook Our nation is at war & this Iphone was used to kill Americans. Protect our homeland, not terrorists. Please cooperate with @FBI."
https://twitter.com/GrahamBlog/status/700348813807063040 http://www.lgraham.senate.gov/public/index.cfm/
The video is 6 minutes and worth watching. It sounds like he is still forming his whole opinion. He certainly has changed his view from his initial comments. He's now calling for the debate to be held in Congress via passage of new laws.
That said, there's probably one benefit to being forced to do the work: the engineers involved will be extremely motivated to stick it to the government by designing systems that can't be circumvented like this again. "Too bad, so sad - we can't do that any more. We're very, very sorry for the inconvenience."
But that's exactly why this case is so, so critical. FBI is fishing for a precedent that will make designing these types of systems explicitly illegal. Apple is well aware of this strategy, which is why they've chosen to take their stand here, as unpleasant as the PR ramifications may be.
The court isn't ruling on whether Apple has the right to modify their systems to prevent this strategy in the future. No matter how the court decides, it won't affect how Apple can design future devices. If the FBI were to ask for a ruling like that, they'd either lose or it'd be overturned on appeal. Something like that, where the government is actively telling manufacturers how they can and cannot design their products, could really only come from a new law instead of trying to backdoor it through the courts.
I don't doubt that the government would love a tool like that, but it'd be aggressively challenged as an unprecedented expansion of federal power if it was ever signed into law. And that's iffy; a law like that would jeopardize overseas sales for tech companies even more than the NSA's actions already have. They'd have no choice but to pour an incredible sum of money into lobbying efforts, major PR campaigns, and campaign donations to fight it politically and hit back hard against any politicians who supported such a law.
I don't think it'd succeed for the reasons above, but when the alternative is nothing, dumb ideas can look awfully good to people at first. If there's one thing that's come out of all the publicity over the FBI's request, it's that every criminal and terrorist in the world now knows to turn off their iCloud backups. It was obvious before, but never so publicized. Oops? Unintended consequences.
I would quibble with this characterization. Security engineers may well improve their employment prospects and professional visibility by publicly demonstrating that they are unwilling to do work that is counter to the mission of securing systems. It seems likely to me that this sort of highly public gesture would be personally profitable, rather than a net sacrifice.
Quitting doesn't save Apple. Does it help your job prospects as a security engineer? I'm not so sure about that either, but then again I'm not a security employer.
Hypothetically, if I were, then as an employer I might be more interested in the guy who stuck it out working with the government at Apple. He'd be able to give me a heads up on what conversations are like with the government and what the government might be able to impose on my business.
One of the principal drivers of the positive effect on career prospects is the publicity this sort of public gesture would generate. Sure, all else being equal, many may prefer the engineer that sticks with the company. But all else is not equal. This particular gesture would generate a lot of publicity tied to the engineers eligibility for hire. Sticking with the company ends the story and would not likely garner nearly the same level of personal publicity, if any.
I'm not making any sort of value judgement as to whether this would be an ethically good or bad thing for an Apple security engineer to do. I just don't think they will really be risking much because enough people will view it as an attractive public display of personal integrity that s/he would have her/his pick of jobs. It would also be an ideal opportunity to launch a security consultancy.
The move isn't completely devoid of personal risk, but the risk seems to be overwhelmed by the opportunities that it would generate in my estimation. That is to say, it would be a good bet, and far from a true self sacrifice.
Well, it kind of does. Right now we're approaching Poe's law with the use of AWA to compel the writing of code, but we're still just barely in the realm of keep-a-straight-face-defensible (largely because the bulk of the population is less tech literate than is ideal). If even a few of Apple's key security engineers quit at the same time, then it becomes very easy for Apple to make the case that they literally cannot do what is asked anytime soon (how long for a new team to cold boot with a new codebase whose domain is cryptography and no one around to provide guidance/tribal knowledge?). In any sane universe this would show that the request has crossed the line into overly burdensome. It is very hard to justify massive penalties to incentivize compliance with something that Apple may or may not be able to do anytime soon [0].
So that would basically leave them the option of stopping the insanity or going after the individual engineers and compelling them, which opens up a whole other heap of lunacy which might have to get resolved before Apple would again be on the hook for action.
If the court then decides that it will compel the individual engineers who are now no longer Apple employees to work.... They're forcing labor from unwilling non-criminal citizens (13th?); they're compelling code, which is speech, and compelling association between the engineers and Apple who would presumably need to be compelled to rehire them because you can't make someone work for free (double 1st); as someone has mentioned they could institute a draft (??) but I'm sure there would be legal contest regarding conscripting specific individuals against their will and this would require the cooperation of congress, the military, the NSA, and it still wouldn't get them the thing they actually want which is precedent.
[0] From wikipedia: "the [fined] party is said to "hold the keys" to his or her own cell" which justifies the lack of a trial for civil contempt fines. If you cannot comply, you lack the ability to escape the fines, you are not receiving due process. I think this little corner of the law might actually be the bulwark that makes zero knowledge systems legally safe as well, though if you have an auto-update system you still would need the code-is-speech, cannot-compel-speech protections to round this out.
I'm going to disagree with you here. Didn't we think, back in 2001, that we'd only have to live with pat-downs on every plane flight for so long? That the government would eventually realize that terrorists couldn't hijack planes once passengers knew that the proper response was to storm the cockpit rather than waiting for the usual ransom demand to be acquiesced to? That the terrorists would find other ways to cause terror?
If the US Government gets what it wants with this case they will use it as a wedge to permanently deny us any semblance of electronic privacy. You will get to choose between using paper and having some random police officer [1] decide that it's time for you to go down and he's absolutely sure he can find something you've done wrong [2].
This move is one of the last things standing in the way of that future. Apple's engineers are threatening to destroy one of the most successful, profitable organized entities in human history in protest. A sort of technological mutually assured destruction. I hope their threat works, and that they don't have to follow through on it, and that if they do, their statement is understood.
[1] https://www.washingtonpost.com/news/the-watch/wp/2016/03/10/... [2] https://en.wikipedia.org/wiki/Parallel_construction
Congress can't do it alone.
If they can't quite do that, then they bring back the whole "export-grade cryptography" thing, except they call it "terrorist-grade cryptography" this time around. Then they start monitoring every crypto-capable open-source project's responsible disclosure system. When they see a vulnerability good enough to subvert that open-source project, they shut down that project before the bug can be fixed. And then they suppress all knowledge of the bug.
Or they infiltrate popular open-source projects in plain view. Wouldn't be hard at all to get that one bug they need in some peripherally relevant subsystem that nevertheless breaks the entire thing.
...to exploit it? seriously?
i'm not saying it's impossible or unlikely, it just sounds like 1. it's a tremendous amount of work 2. it still doesn't actually solve the problem
As for it being a tremendous amount of work: First, I'd guess that, given the infrastructure they already have, they could probably pull it off with a few dozen people. It's not bigger than, say, Reddit (78 employees?!). Second, have you seen how much effort they're putting into the kind of thing? They already have server cabinets throughout the US that read most of American's internet. IIRC they managed to stick a black box between Google's datacenters that could snoop on people's email while it was flying back and forth between their distributed storage system. Just imagine how much money, physical access, and and reverse-engineering those things took. And not only that, but that was theoretically GCHQ that did them, not the NSA! Foreign soil!
Seriously. The right mindset here isn't that it's "too much effort" or that it "doesn't work that way". We're dealing with something that has in the past demonstrated the ability to do these kinds of things. If you want a good set of tools for getting into the right state of mind for this, we should be treating it sort of like a hostile superintelligence, not any kind of bureaucracy.
Look at the fight against child pornography. Tech companies dedicate a lot of resources to fighting child pornography and working with the FBI to help prosecute offenders and NCMEC to help identify the children being exploited. Even with the active and enthusiastic support of the tech community, it's an uphill battle. How much more difficult would that fight be without that support?
Point being, if governments can't make child pornography--something everyone is against--go away, how likely is it that they'll be able to make a dent against encryption?
Remember that all that is required is that the majority of people comply.
As PHK pointed out, the NSA (and other large SIGINT agencies) obviously already have some amount of influence on popular free and open source software.
If anybody find this at all surprising, watch PHK's "Operation Orchestra"[1] asap.
[1] https://archive.fosdem.org/2014/schedule/event/nsa_operation...
All the more reason to educate the public now about how encryption works.
Thank you for bringing this into the picture.
The thing is that once you give up a bit of your liberty to the state, you never get it back.
The TSA is an abomination. You can basically shred the whole Bill of Rights as soon as you step into an airport.
> You will get to choose between using paper and having some random police officer [1] decide that it's time for you to go down and he's absolutely sure he can find something you've done wrong [2].
"Show me the man and I'll show you the crime."
And the shoe and underwear bombers were some kind of geniuses. "Hey, his putting a failed bomb in his shoe made all the Americans take off their shoes in aiports. I wonder what would happen if I put one in my underwear?"
The guy who convinced TSA to confiscate my 12oz bottle of shampoo because I hadn't poured it into 4 3oz bottles, then put them in a Ziplock bag, also deserves a prize.
Let's give imagination a run:
After 10 years of FBI cases where child molesters and terrorist houses were raided only to find they were able to shred evidence last minute, the FBI decided that they don't have time, energy, money and will-power to sit down all day long and play with 10,000 pages-long paper puzzles.
Therefore they asked congress to pass a law where every company selling shredding machines will attach a little tiny camera to their device. Upon shredding, a photo will be taken of what you shred. This photo will be obviously securely transferred and stored in FBI vault, just in case, locked with each shredder's individual key until proper Court gives a warrant to give out encryption key and decrypt photos of documents that have been previously destroyed.
There you have it!
And don't get me started on 2030, where we will be able to read and print out people's thoughts...
It's interesting to note that passengers figured out about storming the cockpit was the way to go on 9/11 itself, literally an hour and eleven minutes after the first plane hit the World Trade Centre. They clearly knew that the old "wait out for ransom" no longer applied.
So you really think the government will have gathered all that power, only to readily hand it back?
I'm not 100% sure about what happens after 2/4/8 years. That scenario also relies on a really informed public to fight back and care.
This is why I and a few other engineers are forming a grassroots campaign to support encryption. If you'd like to get involved, send me an email at stillastudent on google's email service
Remember Truecrypt, Hushmail, Lavabit, etc? Too small to fight back.
That's why so much rests in the outcome of the fight with Apple.
Of course, if you have nothing to hide from your friendly government agency, you have nothing to fear!
Let's say Apple is forced to bake a back door into their devices.
Criminals and people who care about privacy will use their own encryption tech (they probably do anyway) and life goes on for them.
Eventually the govt's backdoor is abused or cracked. The people grow fretful. A truly secure device from somewhere outside the US gains market traction. The US tech industry's shrieks gather volume.
The govt realises the game is up and allows Apple devices to be secured again.
This issue is not one that demands that anyone fall on their sword. Even if the govt gets its way, no-one will be killed or even harmed. Eventually the natural order of things will be restored.
Why would another government allow the selling of a device with a know (not just suspected) backdoor for the US government? Sounds like a great opportunity to boost local companies.
I would expect some serious repercussions on foreign market sales.
also, we're still paying for v-chips.
Also, there won't be any anti-encryption laws. The risk is backdoor encryption across the board, which could have very similar outcome but isn't what's at stake here.
They could, but they're still a publicly traded company. I wouldn't hold it against a board that wasn't OK with spending $250,000 a day on a principle, but I'd be mad as hell at the people collecting the fine.
might take a few years of striking though.
With a court order, LE asked to unlock a device, and I was able to do it, did it and they sent me a letter of thanks which I still might have somewhere. I remember being happy to help, it was a drug case, drugs are bad mmmmkay.
In thinking about it I'm embarrassed at my younger self, but also cognizant that anyone familiar with the art could break it. It was a terrible, reversible scheme. After I pushed through the change to store the password I was confident that it could not be reversed and that it was "safe" and that I could no longer break it.
If they had suggested removing the other safeguards e.g. allowing any number of tries, etc. That would be this Apple situation and I really hope my younger self would have had the sense to plead "ignorance," refuse or whatever because my principles have not changed that much, and I am 100% on Apple's side on this issue.
Yahoo would have owed the US gov. a sum equivalent to the GDP by the end of a month.
Security engineer: "Meep?"
HR: "That's right. Oh, and here, since you were such a great employee (up until we noticed your hair, anyway), have this extremely generous dollar amount severance package. Maybe if your hair is a different color someday we'll hire you back."
:
Apple to FBI: "We have no one with the expertise to work on this. Golly, sorry about that."
Is the FBI then going to make a grab for source code, signing keys, and conscript people to do the work?
I think it's become clear that they'd at least try.
What kind of dystopia are we living in again?
The U.S. military draft required passage of the Selective Service Act [1] Something similar would be required before Apple's coders could be forced to carry out court orders directed at Apple, the corporation. Even in these times (so far!) I think this wouldn't happen.
[1] https://en.wikipedia.org/wiki/Selective_Service_Act_of_1917
My point is, the individuals won't suffer.
That said, Apple security engineers probably would land on their feet.
Apple doesn't have the ability to compel an individual's conduct. The court's order applies to Apple, not to named individuals. Given that, I don't see a legal basis for fines, executive criminal charges, etc.
I think there's a lot of power in the hands of a few employees (and potential replacements) here. It'll be interesting to see what they decide to do.
A court order doesn't extend to Apple being required to be a dick to its ex-employees.
(And yeah, if any of you folks want a job, there are a zillion people on HN happy to talk, I'm sure)
No, they're going to grab for source code, signing keys, and _pay_ people to do the work. There are lots of competent engineers out there, and not all of them share your politics (and some that do might be willing to reconsider it for a sufficiently large dollar amount).
Hell there are probably engineers working at the NSA right now who would easily do it as part of their day to day job if you just handed them the keys and source code.
Who knows if the FBI's request carries as much as the NSA's. Probably not. Former NSA Director Michael Hayden confirms it was easier for him to get things done than the FBI [2]
[1] http://www.theguardian.com/world/2014/sep/11/yahoo-nsa-lawsu...
Way less likely, but Apple could move HQ to another country. And take their secret source code and keys with them.
I'm not sure whether a company should be 'too big to govern', but it is on occasion hilarious.
Lots of arbitrary stuff is banned in a lot of countries. Singapore just thought the littering cons of gum outweighed the pros.
Note that stuff like nicotine gum and other "therapeutic" chewing gum is still allowed, they just don't allow the candy that leads to littering.
And honestly looking around in a lot of cities where the entirety of downtown is slowly growing into a white blob composed of little individual pieces of squashed chewing gum I don't blame them.
Gum wall in Seattle, case in point.
And there's only a handful of companies large enough to do this: http://www.businessinsider.com/25-corporations-bigger-tan-co...
We're getting into "kill the company to make a point" territory, which is probably not realistic however we might imagine they do it.
Whatever leverage Apple has over the federal government will come from the millions of citizens who are customers, shareholders, developers, fans, employees, etc. They can activate those people just as well from Cupertino as they can from their own island.
(If Apple can't resist the government request, neither can anyone else, only the crankiest of people will punish them for being the test case.)
To take your question in a completely different way, China could compel their Apple manufacturing staff to install a back-doored chip into Apple devices on the production line. Seems reasonable if the US government is asking for a software back door into all phones.
Wouldn't that be opening a whole different can of international worms? In this hypothetical,
- Is China doing this with or without Apple's knowledge?
- If not, then it's a very very different situation than the US. I wouldn't equate them at all in such a case.
- If so, then Apple presumably would openly fight this and could even move all of their production outside of China as an extreme last resort. Against the US government, they don't have such a last resort situation since the company is based in the US. And unless every essential employee is a non-US citizen, then Apple has no such last resort. Hence why I am asking my original question of what international laws come into play here?
In this hypothetical, sure. The Chinese govt orders Apple to install a backdoor chip on the production line.
> - If so, then Apple presumably would openly fight this and could even move all of their production outside of China as an extreme last resort.
Moving their production doesn't seem to be more or less difficult than moving their corporate HQ.
Unless there is something in US law that says you can reincorporate outside the US, keep an office in the US, and yet somehow be excluded from US jurisdiction. Cause from what I understand, if you have an office in some country, you are bound to those laws to some degree.
The FBI when it compels people to do things, pays nothing to have them do it. That's the power of the law.
I'm pretty sure the FBI/Government has stated they will compensate Apple/any external consultants for their time at their usual rate.
http://www.acm.org/about/code-of-ethics/
Nothing is stopping you from just affirming yourself to live by them without paying the dues, if you want.
As Gandhi states:
>You can chain me, you can torture me, you can even destroy this body, but you will never imprison my mind.
He said that in the 20th century. Imprisoning the mind is the province of the 21st century. Both governments and pseudo-"activists" now seek to do this by leveraging the Internet.
[1] https://www.youtube.com/watch?v=lHcTKWiZ8sI
[2] https://consumerist.com/2015/08/05/facebook-patent-would-all...
While publicly the U.S. government probably wants to keep on the good side of popular opinion, they've proved time and again that in private they have little to no compunction about doing "whatever it takes" to get their way.
Let millions starve in manmade famine, massacres, 200 years of resource theft...
Bad things happened under their rule but they weren't actively evil in the same league as so many regimes. If you think British rule was the worst thing that could happen to a place you're pretty sheltered.
The NSA increasingly is not a room full of mathematicians, but an IT outsourcing customer. But in neither case would they be very competent at creating a variant of iOS that doesn't touch flash memory and enables brute-forcing the PIN.
The government doesn't want a backdoor. They want Apple to remove barriers slowing and limiting the number of guesses at the key. If the key were longer, those barriers wouldn't be needed. So this isn't about strong encryption, without backdoors. It's about some sort of right to short, memorizable keys, and technical barriers protecting them.
Now maybe we have such rights. (I don't think so, I do think we have a right to strong encryption and strong keys.) But that's a very different argument than "backdoors are bad". If Apple's case is "no backdoors", they make that argument look not like a technical argument but a preference to not comply with a warrant. Non-technical people could easily get the idea that technical people say "no backdoors" when they just don't agree with the government's ability to execute warrants, and that all the technical arguments about real security are mumbo jumbo to avoid obeying laws they don't care for.
Using strong encryption with phones is a usability issue. If the phone were somehow protected by a strong key, Apple could easily comply with this order and the government still could't read the phone. But they haven't figured out how a user can deploy a strong key in some usable fashion. Well, that's obviously a challenge to phone data privacy. I expect it is solvable. And it is much less an issue in contexts like desktops and laptops.
But we have a right to encryption. We don't have a right to usability. Claiming the two are the same weakens the case to the right we do have.
Funny to see Jean-Louis's name out of the blue again. He was the creator of BeOS back in the days.
It might very well help public appeal if there was a person resisting the government compared to a large corporation.
Then again, if they get to the point of ordering Apple to break their security seems like they already lost the case at that point.
> if the engineers refused to write the code, rather than outright quit, “then I think that the court would be much more likely to find Apple in contempt,”
I was thinking that too, but then I reflected on the anti-Apple opinions I've seen in this case (mostly from a small subset of my Facebook friends). My fear is that it would actually do the opposite - it would give a face to the "spoiled" and "liberal nutjob" Silicon Valley nerds who "want to help terrorists." I hope I'm wrong...
Why force it? To drop all pretext of what this really is, and reveal the US Government's actions as being that of the fascist monster it has become. After all, we've got the US military directly, intentionally spying on everything Americans do electronically. We're probably two or three steps or 'events' away from our first Caesar attempting to take permanent executive power. It's going to get a lot worse yet, just look how far they've come in a mere 15 years in their power grab. It's better to just stop pretending, here and now, regarding what's really happening.
It would be the Tiananmen Square for privacy in America.
Or a single election. Hitler gained initial power democratically, after all.
This whole discussion has led me to reconsider the much too expensive iPhones, and my next phone might very well be an iPhone 6 or newer.
If you're still alive when "they" want information they'll just extraordinarily rendition you and torture you. Or they'll implement laws like UK RIPA which require you to make available the unencrypted version when asked by a court. Or they'll install covert surveillance equipment.
I'm not saying that anyone should refuse, I think that's a foolish idea and as has been pointed out the Government has many tools and sanctions available it can use to compel compliance. I just find the current debate somewhat blinkered.
Apple said in court filings last month that it would take from six to 10 engineers up to a month to meet the government’s demands. However, because Apple is so compartmentalized, the challenge of building what the company described as “GovtOS” would be substantially complicated if key employees refused to do the work.
But I don't want to go to my room!
Son, go to your room!
Mommy, what would happen if on the way to my room I ran into a pack of wild dogs in the hallway blocking my path? Would I still have to go to my room?
Or is it a transparent and poor attempt to get out of going to their room?
(Incidentally, I have an 8 month old son. So, yes, I've got a few years before I get to have conversations like this.)
Who knows if it's transparent...children's brains function in a completely different universe sometimes.
So, the reply to the last question in your mother/child conversation is likely: "No. You would not be required to do so. However, there are presently no known obstructions between you and the door to your room. Go to your room now, lest I find you in contempt of Mother.".
Simple, right? Right.
So, make your commentary more productive in the future, please. :)
> "No. You would not be required to do so. However, there are presently no known obstructions between you and the door to your room. Go to your room now, lest I find you in contempt of Mother."
Your comment omitted the explanation -thus ignoring the hypothetical- and went directly to analysis of the situation as it currently is.
Context is everything, and the person to whom you were speaking was not likely a child and wasn't asking a series of hypothetical questions in order to put off some unpleasant task. Therefore, the lack of explanation in your comment makes it substantially different from mine and -because it lacks the useful components- not really productive. :)
Really?
The sentiment is nice, but I doubt the government is worried in the slightest. The government is all powerful and can be whatever it wants, lest we forget.
Compelling a company to produce a product is bad enough, let's not add treating people like chattel on top of it.
A Judge can order you to leave work and sit on a Federal Grand Jury for 36 months.
A Judge can order an innocent bystander to testify or sit in jail until he agrees to do so.
Employment status has nothing to do with anything. Just because you quit the police department doesn't mean you don't have to cooperate with a federal investigation or anything that a Judge orders you to do during that trial, from the grand jury phase up to and through sentencing.
I so often agree with the general sentiment of HN posters but the lack of understanding around basic civics is disheartening.
I'm sure there'd be a GoFundMe up within minutes that would collect enough money to cover the salaries of a few engineers while the court battle plays out. Afterward, go back to work for Apple.
On what grounds? None of them have broken the law and the order, should it come about, would be for Apple to perform this work, not specific employees (or, if they resign, ex-employees). What would be the route for the government to compel specific individuals – who do not own or control Apple's code or data, and individually are not the only people who can perform this work – to do this?
2) Judge issues a subpoena to an employee that another employee has said is capable of retrieving the information.
"Do you have the capability to retrieve this PIN number?"
"Yes, your honor."
"Will you do so?"
"No, your honor."
"I find you in contempt. Lock this gentleman up."
The answer to this question is no, since the person would be no longer employed by Apple, would not possess the source code, and would not possess the signing key.
Even if you assumed that the court could force Apple to disclose these items to somebody who is now a third-party, it may be the case that there isn't any person who is capable of doing this. Are the same people at Apple responsible for code signing and writing the code necessary to do this?
If it reaches anything approaching this point (it won't) stopping it basically requires an individual to commit to doing the work then sabotaging the device when presented with it.
That's the act of civil disobedience. And you can expect to spend more than a night in jail should you grow the balls to do it.
> The answer to this question is no
Doesn't matter. All the judge needs is to notice in your face that you do have that capability.
Don't believe me? Look at this case:
http://articles.chicagotribune.com/2011-10-07/news/ct-met-lo...
According to the judge:
"What I saw in his face was just defiance. He was not going to testify in this double homicide case because he wasn't going to testify. That's all there was to it. So I saw pure scorn for the judicial system in the defendant's face."
Because the judge didn't like his face he gets 20 years for contempt.
20 years!
Care to say what were the charges originally?
It was an excellent lesson in how arbitrary and asymmetric the criminal justice system is. The police are basically free to make shot up on the police reports, and it was only because we had so many people with identical reports with egregious mistakes that we were able to fight them on the charges.
Um... no. Perhaps until they get a whiff of a professional, um, "motivator" in the guise of an FBI agent or carefully-chosen warden. Some of you guys crack under the pressure of solving a C++ warning. The guy who upvotes every "Ten things about being an Introvert" post at HN will last precisely ten seconds when presented with that reality.
I admire a good hunger strike every now and then but this case has been mismanaged by both sides. Slippery slopes and domino theories but really -- you're gonna rot in jail versus coughing up a pin code to protect the privacy of a dead terrorist? This could have been narrowed, should have been narrowed, and an anonymous post card with four digits on it could end the standoff. And that's the way it's always been done. Apple seems ignorant of this reality and they are going to pay a dear price for their position -- even before they incur the cost of forcing employees into an ethical rat trap.
Apple shouldn't have been surprised by this. They will however pay a dear price for the posturing. And they will have wasted valuable public sentiment when the government tries again, which it will.