FBI's Own Actions Likely Made Farook's iPhone Data Inaccessible

from the oops dept

On Friday, we noted that one of the reasons that the FBI was unable to get access to the data on the remaining iPhone from Syed Farook was because after the shooting and after the phone was in the hands of the government, Farook’s employer, the San Bernardino Health Department, initiated a password change on his iCloud account. That apparently messed stuff up, because without that, it would have been possible to force the phone to backup data to the associated iCloud account, where it would have been available to the FBI. But, after we published that article, a rather salient point came out: the Health Department only did this because the FBI asked it to do so.

From a San Bernardino County Twitter account:

If you can’t read that, it says: “The County was working cooperatively with the FBI when it reset the iCloud password at the FBI’s request.”

In short: a big reason why the FBI can’t get the info it wants is because of an action taken… by the FBI.

Apple has also provided further information on this, showing how it was perfectly willing to cooperate in reasonable ways with the FBI — but that it was the FBI that messed things up:

The Apple executive told reporters that the company?s engineers had first suggested to the government that it take the phone to the suspect?s apartment to connect it to the Wi-Fi there. But since reporters and members of the public had swarmed that crime scene shortly after the shootings occurred, it was likely that any Wi-Fi there had been disconnected. So Apple suggested the government take the phone to Farook?s former workplace and connect the phone to a Wi-Fi network there.

The executive said that Apple walked the government through the entire process to accomplish this, but the government came back about two weeks later and told Apple that it hadn?t worked.

Apple didn?t understand why it had not worked?until the company learned that sometime after the phone had been taken into the custody of law enforcement, someone had gone online and changed the Apple ID that the phone uses to conduct backups.

Two interesting points in there: first, do you remember how there was all this discussion about the insane media scrum that ransacked Farook’s house? And lots of people pointed out that useful evidence may have been harmed by it. At the time, the FBI insisted they were all done with the house, but it appears that may have been part of the reason why they couldn’t get the backup.

The second is that Apple had not revealed this tidbit earlier. The company explained that it had felt that its conversations with the government had been confidential until the FBI revealed this detail in the totally unexpected Motion to Compel it filed Friday. It appeared that the FBI was so eager to push its PR stunt that it filed the document (which it had no reason to file), and then revealed even more of its own bungling in this particular case.

Whether intentional or not, this is only going to add support to people who say that the FBI doesn’t actually care what’s on the phone, but wanted to be able to go after the data in this case because they knew they could set a precedent in a case where their argument will generate the most sympathy. Remember, back in September, after the Intelligence Community lost the fight to get a law banning strong encryption, intelligence officials said out loud that they’d just wait until the next terrorist attack:

Although ?the legislative environment is very hostile today,? the intelligence community?s top lawyer, Robert S. Litt, said to colleagues in an August e-mail, which was obtained by The Post, ?it could turn in the event of a terrorist attack or criminal event where strong encryption can be shown to have hindered law enforcement.?

There is value, he said, in ?keeping our options open for such a situation.?

Two months later, you get a “terrorist attack” (or a workplace dispute that can be painted as a terrorist attack) and a sorta, kinda encrypted phone, and voila. Just what the intel community asked for. It would be crazy to suggest that any of this was done on purpose — it’s almost certainly a bit of convenience for the intel and law enforcement communities. But the fact that the FBI directed the Health Department to change the password, and that’s part of the reason they’re now locked out, really raises some questions about what the FBI’s priorities were here. It also raises a separate question of whether or not companies should be forced to hack their own system in cases where the FBI’s own bungling was responsible for the loss of information. But, really, that’s a minor point, given that the DOJ wants that power even in cases where the FBI didn’t mess things up itself.

Filed Under: , , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “FBI's Own Actions Likely Made Farook's iPhone Data Inaccessible”

Subscribe: RSS Leave a comment
57 Comments
Bergman (profile) says:

Re: Front door

That reminds me of a story I read once, that I HOPE was a joke…

A customer gets a shop clerk to help them take their groceries out and put them in their car. While loading the groceries, the customer leaves their keys on the front seat, and closes the door, reflexively locking it as they close it — then realizes the keys are inside. The customer begins to panic, and in their panic ignores the driver’s side rear door that is still open, that the clerk is loading groceries into.

Customer: "Oh no, I locked my keys in the car!"
Clerk: "This door is still open."
Customer: "You don’t understand, this is a disaster!"
Clerk: "But the door is open, you can just…"
Customer, irate because clerk isn’t reacting, slams the rear door.
Customer: "There! Are you happy now? The door is shut. Now you can pay attention to my serious problem instead of blathering about nonsense!"

art guerrilla (profile) says:

“It would be crazy to suggest that any of this was done on purpose — it’s almost certainly a bit of convenience for the intel and law enforcement communities.”

1. NO, it is NOT crazy, it is -in fact- wise and prudent to consider the eee-vil gummints and their minions HAVE DONE… REPEAT, HAVE DONE, not think they might have done, might could have done, might maybe, but HAVE DONE…

look up ‘false flags’ and i’m betting approx 90%+ of the kampers would be horrified to realize the number of so-called ‘terrorist’ attacks which HAVE BEEN perpetrated by ‘their own’ gummints…

we REGULARLY get a steady diet of made-up terrorist conspiracies TOTALLY the handiwork of the feebs, taking -literally- retarded people and setting them up as ‘terrorists’ who never were…

2. the second part is almost more damning: it is expected that the purpose in life of us 99% is to provide a convenient method for the goons of the state to jack us up… its just become so messy and inconvenient to railroad us under normal circumstances…

Anonymous Coward says:

Re: Re:

This is what constantly pisses me off about people.

The constant failure to understand that the 1st evil of any great concern in any nation is the Government where ‘power’ attracts these evil humans like a SUPER MAGNET. There is an endless debate on if this evil is necessary and how much power it needs to have.

Government has plagued and murdered their own citizens more than ALL of the WARS of Humanity Combined!

Hanlon was a fool… when viewing government through the scope of Wisdom, one MUST assume that malice is indeed present because there are mountains upon mountains of rules to follow that those humans constantly seek to avoid, subvert, or corrupt. There is an endless parade of people asking the government to save them, there is an endless parade of officials saying we must take your liberty away to protect you.

Vigilance must be Eternal and only a FOOL trusts theirs or ANY government!

Richard (profile) says:

Re: Re: Re:

The constant failure to understand that the 1st evil of any great concern in any nation is the Government where ‘power’ attracts these evil humans like a SUPER MAGNET. There is an endless debate on if this evil is necessary and how much power it needs to have.

(Perhaps) unfortunately the answer to your first question is “Yes” and to the second “quite a lot actually.”

Take Libya for example. Unquestionably Gaddafy was one of those evil humans attracted by the super magnet of power, and undoubtedly he plagued and murdered his citizens as intensely as any government anywhere.

However would you really prefer to live in the Libya of today to Libya under Gaddafy?

Anonymous Coward says:

Password change was intentional then?

Was this done to intentionally cause a situation where the FBI would then be able to get software created to allow for future access to peoples devices? This shows a level of either incompetence by the FBI or outright criminal behavior trying to damage the public’s expectation of privacy. Every day I loose more respect for our FBI/CIA/NSA etc… I keep forgetting that they are nothing more than Dinosaurs on one end of the table and a bunch of college grads working their first job at the other end.

Michael (profile) says:

But since reporters and members of the public had swarmed that crime scene shortly after the shootings occurred, it was likely that any Wi-Fi there had been disconnected.

Apple: FBI, if you take this phone back to the Wi-fi it normally connects to, it should make a backup that you can get at.

FBI: Well, we would, but we already shut off the Wi-fi at that house.

Apple: Can’t you turn it back on?

FBI: Possibly, but we think it would be easier if you wrote a custom operating system that allowed us to brute-force attack the phone with custom software written by our engineers and defeat the encryption. So, get right on that.

I just realized that the FBI is run by the same executive board that runs the company I work for.

zm says:

Crime scene

The Apple executive told reporters that the company’s engineers had first suggested to the government that it take the phone to the suspect’s apartment to connect it to the Wi-Fi there. But since reporters and members of the public had swarmed that crime scene shortly after the shootings occurred, it was likely that any Wi-Fi there had been disconnected.

So, noone protected the crime scene.. why exactly?

Tim R says:

How Ironic

“The company explained that it had felt that it’s conversations with the government had been confidential until the FBI revealed this detail in the totally unexpected Motion to Compel it filed Friday.”

So what they’re saying is that, for a time, Apple was even respecting the government’s privacy? Now that the cat’s out of the bag on that one, I wonder how much it stings to have your private details encroached on…

Bruce says:

For an alternative conspiracy theory...

Cringely thinks Apple is cooperating with Obama DoJ to get a legal precedent AGAINST this sort of cracking.

href=”http://www.cringely.com/2016/02/19/the-fbi-v-apple-isnt-at-all-the-way-you-think-it-is/” http://www.cringely.com/2016/02/19/the-fbi-v-apple-isnt-at-all-the-way-you-think-it-is/

Not that I’m buying into that argument. It would be too hard to avoid a bit-trail.

Anonymous Coward says:

Re: Re: Response to: Anonymous Coward on Feb 22nd, 2016 @ 4:56am

“a workplace dispute that can be painted as a terrorist attack”

I expected better from Techdirt.

I too didn’t realise that Techdirt had sunk so far into the politically correct universe that they would parrot that line.

Listen – if anything the San Bernardino attack was more “a terrorist attack that was initially painted as a workplace dispute” than the other way around. The reason for that seems to be largely political correctness – perhaps driven by reluctance to admit the reality of Islamic terrorism – given the religious affiliations of some members of teh presidents extended family.

HOWEVER

This is not the area of Techdirt’s expertise. The clue is in the name.

On the substantive issues relating to technical security policy Techdirt is pretty much spot on – if you want to know about Islamic Terrorism go to exmna.org.

Anonymous Coward says:

Re: Re: Re: Response to: Anonymous Coward on Feb 22nd, 2016 @ 4:56am

“a workplace dispute that can be painted as a terrorist attack”

Listen – if anything the San Bernardino attack was more “a terrorist attack that was initially painted as a workplace dispute” than the other way around. The reason for that seems to be largely political correctness …

So you’re saying that the attack was terroristic because Political Correctness? And if this was a “terrorist attack”, would you be so kind as to point out the “instill terror” aspect of it that was not of our own creation? You’re quaking in fear, perhaps, that “someone else, anyone else” might do something similar. But that’s all you, baby. Can you name the religious or political goal that the attack furthered?

See, that’s the problem with “lone gunmen” (even if they come in pairs or groups)… The results are sometimes indistinquishable – in terms of lives lost, property destroy, etc – from those of groups that have an articulable agenda. Furthering their goals, though, requires a terrorist group to outlive the attack.

And that’s why the FBI is so desperate for something, anything, that can make this more than just one person saying “I want to kill a bunch of people and get my name in the papers.”

Anonymous Coward says:

Re: Re: Re:2 Response to: Anonymous Coward on Feb 22nd, 2016 @ 4:56am

So you’re saying that the attack was terroristic because Political Correctness?

No – I’m saying that the authorities were initially reluctant to describe the attack as terrorism because of political correctness.

But that’s all you, baby. Can you name the religious or political goal that the attack furthered?

The attack looks very similar on its face to the Paris attacks and others where the perpetrators expressed their motives more clearly.

Of course it is not our opinion of whether a cause was furthered that counts. From their point of view they have read certain texts and interpret them as divine commands to commit violence. They believe that an all knowing God has told them to do something and they don’t think any further than that. A logical calculation of whether it will actually further a goal plays no part in this. That kind of thinking is westernised secular infidel logic – which they despise.

Furthering their goals, though, requires a terrorist group to outlive the attack.

Not really. Or rather – not the particular small group responsible. They saw themselves as part of a larger movement – which is still very much around.

Anonymous Howard says:

Re: Re:

“a workplace dispute that can be painted as a terrorist attack”

I expected better from Techdirt.

White Christian guy shoots up a church = not terrorism
Muslim shoots up workplace = terrorism

I may as well state for the record that I’m a White Christian Guy. But it does seem like the T-word only gets rolled out for a certain other faith.

Anonymous Coward says:

Re: Re: Re:

White Christian guy shoots up a church = not terrorism
Muslim shoots up workplace = terrorism

I may as well state for the record that I’m a White Christian Guy. But it does seem like the T-word only gets rolled out for a certain other faith.

Read the Islamic scriptures and compare to the Bible – and you will see that there might be a reason for that.

Richard (profile) says:

Re: Re: Re:2 Re:

So when James Eagan Holmes shot up a theater in Aurora, Colorado, killing 12 and hurting 70, but was not a Muslim, that it why it was not called a terrorist attack.

Terrorism is by definition an attack in the furtherance of a cause.

James Egan Holmes had no cause – and promoted no political or religious agenda.

When white westerners commit attacks in the furtherance of a cause – eg the IRA – then it is rightly called terrorism.

When Jews commit attacks in furtherance of a cause eg the King David Hotel or the killing of Rabin then it IS called terrorism.

If a muslim commits a murder and doesn’t make any claim that it is religiously motivated then we don’t call it terrorism.

However in the recent cases of islamic terrorism the perpetrators have generally said themselves that their actions were motivated by ideology. When we call it terrorism we are simply believing what they say.

Richard (profile) says:

Re: Re: Re:4 Re:

Here is the honest answer:

1. They were both very religious muslims and had visited Saudi Arabia several times for religious reasons including a recent visit.

2. They were found to have a large arsenal of weapons and home, including bomb making equipment (apparently they attempted unsuccessfully to detonate a bomb during the attacks.)

3. Farook’s father has been reported as saying that his son had expressed sympathy for ISIS. (however this has later been denied by Islamic organisations in the US (But then Mandy Rice-Davies applies there)

Given that religious muslims regard the whole of their lives as being controlled by the religion it is difficult to see how the attacks could have been unrelated to it.

Given the degree of preparation it is difficult to see how this could have been a spur of the moment incident.

Of course it might have been both a workplace incident and a terrorist one at the same time – since the only disputes they seemed to have at the workplace were about religion.

Anonymous Coward says:

Re: Re: Re:

But it does seem like the T-word only gets rolled out for a certain other faith.

Not true – remember the IRA, the “Red Army Faction” and many others.

If you look at this list https://en.wikipedia.org/wiki/List_of_designated_terrorist_groups

you will see a plurality of different faiths and ideologies represented – particularly if you look at the list of former terrorist organisations.

However you are right that one group seems to be over represented. IF that is the case one should not assume – as you seem to be doing – that somehow WE must be perpetrating an unfairnness towards them.

In a game of football (soccer in the US) if one team gets more red and yellow cards than the others it doesn’t have to indicate that the referees are biased – it might just be that they genuinely don’t play fair.

Wendy Cockcroft says:

Re: Re: Re:2 [terrorism / not terrorism]

I’ll bite: a hate crime that wants to be terrorism when it grows up.

This guy went in to kill black people. In a church. The idea was to commit a crime so heinous that anyone likely to take his side would be truly committed. And some very nasty people in positions of trust in the community came out of the woodwork.

Did Roof have a cause to promote? Vague right-wing race hate, nothing specific.

Did he use terror to advance his cause? It wasn’t advanced at all, nobody rallied to his flag, he just got a few horrible people to make sympathetic noises. Nobody is going to sing, “Dylan Roof’s body is a-moulder’ing in the grave,” or anything.

Okay, but was he trying to? Yes, but not in an effective way. Terrorists tend to organise; even the lone wolves will attach themselves to a faction even if they’re not part of a local group, if that makes sense.

I’m subjectively splitting hairs here based on Roof’s vague hatred of black people and saying he’s not organised enough to be a terrorist in the way the IRA, PLO, and other groups are. Had he been acting as part of a group, even on his own, I’d have called him a terrorist.

Syed and Malik were alleged to have been acting as associates of ISIL and to have pledged allegiance to its leader. They are alleged to have used instructions provided by ISIL via its websites to carry out the attack. Okay, but that’s speculation, there’s no evidence to tie all that together. They may well have been acting on behalf of ISIL or they may have had a beef with their workplace. Until the “sources” are revealed, we’ll have to take the words of anonymous people whom we can’t cross-examine for it. They killed people, that is true. Why they did it is not known.

Whatever (profile) says:

Re: Re: Re:

You have to remember that the concept of terrorism gets back to it’s intent.

A guy pissed off at Christians for being uppity snobs or whatever isn’t shooting them for any other reason except anger. He doesn’t have a grand political agenda, he just wants to harm as many of them “f—ing christians” as he can get away with before the police stop him. People won’t stop going to church as a result of an idiot like this, they won’t change their lives.

Terrorism isn’t about that personal anger (although the targets may be personal). It’s more about advancing a common goal, where your goal is to eliminate as many of the infidels as possible, knowing that the next brave jihadist will be there to take out the next wave behind you after you die. It’s the reason why terrorists don’t have a problem strapping a bomb to themselves or dying in the process of harming others. For them, they are doing their part in a much greater, much more longer term set of goals.

Terrorism is about making you believe that another one is just around the corner, they you shouldn’t do this or go there because you might get hurt or die in the next attack.

White guys shootup up a church (or a dozen people between Uber clients) are not doing thing to terrorize you, they just plain want to kill you. They have not part of a big movement to eliminate your country. They aren’t sworm to kill every infidel. They are only there for the cheap thrill of making someone else suffer for their lack of (insert missing thing here).

To dismiss this case as “workplace violence” is to miss the point entirely. I guess is just doesn’t play into the narrative. Perhaps you need more cowbell, or maybe a few more mentions of David Bowie’s legacy.

Anonymous Coward says:

Re: Re: Re:

I feel like I’m missing something because if “someone had gone online and changed the Apple ID that the phone uses to conduct backups” and that’s the reason the phone is no longer able to connect and make an accessible backup can’t Apple just change it back to the way it was before?

If the phone makes backups onto iCloud the phone presumably logs into iCloud. The phone presumably enters credentials to log in. Can’t Apple just configure their iCloud servers to accept whatever password the phone throws at it as being the correct pw so that it can make the backup upon the phone making the request? It’s Apple’s servers, the phone can verify that it’s connecting to Apple’s servers.

Anonymous Coward says:

Re: Re: Re: Yes, Apple should be able to revert the FBI's resetting of the Password!

“I feel like I’m missing something”…me too, the solution SEEMS SO SIMPLE.

“can’t Apple just change it back to the way it was before?”…yes, Yes, YES! Finally someone online thought of my idea! I had thought of this too, even before reading your comment. I was actually trying to Google to see if anyone else had mentioned this & you had! (so it’s your idea too)

Problem: The FBI reset the iCloud password…so, now the device won’t be able to trigger an automatic backup.

Solution: Restore that account’s password from backup, to BEFORE the FBI reset it!…via direct Database manipulation — SQL commands on the server.

I’m sure Apple has multiple backups of the iCloud user database, maybe even hourly, they could dig thru those backups (a simple grep, not hard) to find every time (or the most recent time) that that account’s password was changed & simply restore the old password & then hope the device will auto-backup.

As some of you may not know, Apple doesn’t need to know the old iCloud password to restore it: I assume (& hope) Apple is using the industry best-practice of using bcrypt (in PHP terms, the “password_hash()” function) to store the password hash instead of the password (but actually how they store it don’t matter for this procedure)…so you simply restore the previous password hash into the live iCloud Database (Apple would have direct Database access on the iCloud server, of course). No one knows the old password, but the device does & could then, theoretically perform an auto-backup.

“Can’t Apple just configure their iCloud servers to accept whatever password the phone throws at it as being the correct pw”…actually, yes, they probably can. My solution (even before reading your comment) was to restore the old password from backup, but with custom code in the login function, they could configure “that account” to accept any password…they’d wanna lock it down tho, otherwise anyone who tries that account would get in, with any password, while the phone was doing the backup.

What they could do instead tho (besides just restoring the password hash from backup, as above) is, assuming the phone tries to login by sending the literal password, in plain text (over a secure connection), just start logging any passwords tried on that account, then they would know the plain text password the phone is trying to use, then they could change the password hash to match that plain text password. On the other hand, if the phone is trying to connect using some other “login token”, instead of the “password” in plain text…they could just configure that “token” to be “correct”.

However, if the device’s auto-backup was turned off, none of this will help (unless they can turn auto-backup on remotely). Before doing anything more complicated, Apple could look into their logs to see if that phone has even been TRYING to connect to them at all. We know it hasn’t done a backup in months, but has it even talked to Apple’s Servers at all? — for example: iOS Update check? App update check? Check for new msgs? They should be able to see any attempts the phone made to connect to their Servers…which includes failed login attempts. If there are any, then they would know the phone is trying & failing to connect (due to the password being changed) or they would find out it’s not even trying to connect…making the fact that the FBI changed the password, not matter at all.

Anonymous Coward says:

Every time I hear more about this case...

“Whether intentional or not, this is only going to add support to people who say that the FBI doesn’t actually care what’s on the phone, but wanted to be able to go after the data in this case because they knew they could set a precedent in a case where their argument will generate the most sympathy. Remember, back in September, after the Intelligence Community lost the fight to get a law banning strong encryption, intelligence officials said out loud that they’d just wait until the next terrorist attack:”

Every time I hear more about this case, I’m more convinced that it’s purely a setup to get precedent. Now we get evidence that locking out the phone was caused by the FBI themselves, raising the question of it was intentional just to get their precedent. The only way this could get MORE egregious is if we found a wire transfer from James B. Comey to Farook’s family.

Anonymous Coward says:

This was the FBI’s screwup in a couple of directions. The changing of the password, the failure to keep the apartment secure until the end of the investigation, the breaking of privacy with Apple for convenience sake, to name a few.

I don’t hear anything in all this about the destroyed phones. Not a peep about recovery from those. It’s only the one with the encryption on it that is being drummed. That tells you there is method behind the madness.

Congress is in no mood to pass the law requiring encryption be broken with a back door and Silicon Valley doesn’t want to hear it either. John Mcaffee offered to break the encryption with his hacker team. Where is the FBI in taken up that offer? Nope this one has a reason.

http://www.bloomberg.com/news/articles/2016-02-19/secret-memo-details-u-s-s-broader-strategy-to-crack-phones

Anonymous Coward says:

Re: Re:

In fairness to the FBI John Mcaffee is a nutter.

There actually in information out there about the destroyed phones. They were destroyed. No data is recoverable from them.

(none of this is relevant to the matter at hand, which is “should the FBI be given a precedent to force private companies to hack their products?” Which, any reasonable person should realize is a resounding “NO!”)

Tim R says:

I've said it before

The goal of terrorism is to make you fearful. Murder is just a means to an end, and the fear doesn’t have to spawn from the perpetrator.

The day that the federal government started curtailing civil liberties in the name of fighting terrorism, making us jerk and twitch at the slightest mention of bad people, is the day the goal was achieved. Whether anybody died from the act is immaterial to the results.

Rest assured that if Farook had survived, the FBI would have surely used some form of liberty-depriving investigative technique to get the information it needed. To paraphrase a snippet of an old parable, it’s in the snake’s nature.

In the context of the situation, Apple’s biggest sin here (along with anybody who owns, operates, or manufactures a cell phone) is that they’re the ones still living.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Ctrl-Alt-Speech

A weekly news podcast from
Mike Masnick & Ben Whitelaw

Subscribe now to Ctrl-Alt-Speech »
Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...