We Read Apple's 65 Page Filing Calling Bullshit On The Justice Department, So You Don't Have To

from the and-off-we-go dept

Apple didn't need to reply until tomorrow, but has now released its Motion to Vacate the magistrate judge's order from last week, compelling Apple to create a new operating system that undermines a couple of key security features, so that the FBI could then brute force the passcode on Syed Farook's work iPhone. It's clearly a bit of a rush job as there are a few typos (and things like incorrect page numbers in the table of contents). However, it's not too surprising to see the crux of Apple's argument. In summary it's:
  • The 1789 All Writs Act doesn't apply at all to this situation for a whole long list of reasons that most of this filing will explain.
  • Even if it does, the order is an unconstitutional violation of the First Amendment (freedom of expression) and the Fifth Amendment (due process).
I really do recommend reading the 65 page filing (it goes fast!). But on the assumption that you have more of a life than we do, let's dig in and detail what Apple's argument is. The brief is quite well written (other than the typos) in making the issues pretty clear:
This is not a case about one isolated iPhone. Rather, this case is about the Department of Justice and the FBI seeking through the courts a dangerous power that Congress and the American people have withheld: the ability to force companies like Apple to undermine the basic security and privacy interests of hundreds of millions of individuals around the globe. The government demands that Apple create a back door to defeat the encryption on the iPhone, making its users’ most confidential and personal information vulnerable to hackers, identity thieves, hostile foreign agents, and unwarranted government surveillance. The All Writs Act, first enacted in 1789 and on which the government bases its entire case, “does not give the district court a roving commission” to conscript and commandeer Apple in this manner. Plum Creek Lumber Co. v. Hutton, 608 F.2d 1283, 1289 (9th Cir. 1979). In fact, no court has ever authorized what the government now seeks, no law supports such unlimited and sweeping use of the judicial process, and the Constitution forbids it.
The motion also notes the importance of strong encryption in keeping people safe and secure:
Since the dawn of the computer age, there have been malicious people dedicated to breaching security and stealing stored personal information. Indeed, the government itself falls victim to hackers, cyber-criminals, and foreign agents on a regular basis, most famously when foreign hackers breached Office of Personnel Management databases and gained access to personnel records, affecting over 22 million current and former federal workers and family members. In the face of this daily siege, Apple is dedicated to enhancing the security of its devices, so that when customers use an iPhone, they can feel confident that their most private personal information—financial records and credit card information, health information, location data, calendars, personal and political beliefs, family photographs, information about their children—will be safe and secure. To this end, Apple uses encryption to protect its customers from cyber-attack and works hard to improve security with every software release because the threats are becoming more frequent and sophisticated. Beginning with iOS 8, Apple added additional security features that incorporate the passcode into the encryption system. It is these protections that the government now seeks to roll back by judicial decree.
And the filing makes it clear that the government is lying in claiming that this is all just about this phone:
The government says: “Just this once” and “Just this phone.” But the government knows those statements are not true; indeed the government has filed multiple other applications for similar orders, some of which are pending in other courts.2 And as news of this Court’s order broke last week, state and local officials publicly declared their intent to use the proposed operating system to open hundreds of other seized devices—in cases having nothing to do with terrorism. If this order is permitted to stand, it will only be a matter of days before some other prosecutor, in some other important case, before some other judge, seeks a similar order using this case as precedent. Once the floodgates open, they cannot be closed, and the device security that Apple has worked so tirelessly to achieve will be unwound without so much as a congressional vote. As Tim Cook, Apple’s CEO, recently noted: “Once created, the technique could be used over and over again, on any number of devices. In the physical world, it would be the equivalent of a master key, capable of opening hundreds of millions of locks—from restaurants and banks to stores and homes. No reasonable person would find that acceptable.”
There's a footnote in the middle of that which points to Manhattan DA Cyrus Vance already talking about why he supports the FBI, and how he has 155 to 160 phones that he wants to force Apple to help unlock.

Apple also details how accepting the government's interpretation of the All Writs Act here could easily extend in absolutely crazy ways:
Finally, given the government’s boundless interpretation of the All Writs Act, it is hard to conceive of any limits on the orders the government could obtain in the future. For example, if Apple can be forced to write code in this case to bypass security features and create new accessibility, what is to stop the government from demanding that Apple write code to turn on the microphone in aid of government surveillance, activate the video camera, surreptitiously record conversations, or turn on location services to track the phone’s user? Nothing.
Apple also doesn't pull any punches on how the FBI itself messed things up:
Unfortunately, the FBI, without consulting Apple or reviewing its public guidance regarding iOS, changed the iCloud password associated with one of the attacker’s accounts, foreclosing the possibility of the phone initiating an automatic iCloud back-up of its data to a known Wi-Fi network... which could have obviated the need to unlock the phone and thus for the extraordinary order the government now seeks.21 Had the FBI consulted Apple first, this litigation may not have been necessary.
Apple's filing also does a good job debunking the DOJ's ridiculous "this is no burden, because it's just software and Apple writes software" argument:
The compromised operating system that the government demands would require significant resources and effort to develop. Although it is difficult to estimate, because it has never been done before, the design, creation, validation, and deployment of the software likely would necessitate six to ten Apple engineers and employees dedicating a very substantial portion of their time for a minimum of two weeks, and likely as many as four weeks.... Members of the team would include engineers from Apple’s core operating system group, a quality assurance engineer, a project manager, and either a document writer or a tool writer.... No operating system currently exists that can accomplish what the government wants, and any effort to create one will require that Apple write new code, not just disable existing code functionality.... Rather, Apple will need to design and implement untested functionality in order to allow the capability to enter passcodes into the device electronically in the manner that the government describes.... In addition, Apple would need to either develop and prepare detailed documentation for the above protocol to enable the FBI to build a brute-force tool that is able to interface with the device to input passcode attempts, or design, develop and prepare documentation for such a tool itself.... Further, if the tool is utilized remotely (rather than at a secure Apple facility), Apple will also have to develop procedures to encrypt, validate, and input into the device communications from the FBI.... This entire development process would need to be logged and recorded in case Apple’s methodology is ever questioned, for example in court by a defense lawyer for anyone charged in relation to the crime....

Once created, the operating system would need to go through Apple’s quality assurance and security testing process.... Apple’s software ecosystem is incredibly complicated, and changing one feature of an operating system often has ancillary or unanticipated consequences.... Thus, quality assurance and security testing would require that the new operating system be tested on multiple devices and validated before being deployed.... Apple would have to undertake additional testing efforts to confirm and validate that running this newly developed operating system to bypass the device’s security features will not inadvertently destroy or alter any user data.... To the extent problems are identified (which is almost always the case), solutions would need to be developed and re-coded, and testing would begin anew.... As with the development process, the entire quality assurance and security testing process would need to be logged, recorded, and preserved.... Once the new custom operating system is created and validated, it would need to be deployed on to the subject device, which would need to be done at an Apple facility.... And if the new operating system has to be destroyed and recreated each time a new order is issued, the burden will multiply.
From there we dig into the meat of the filing: that the All Writs Act doesn't apply.
The All Writs Act (or the “Act”) does not provide the judiciary with the boundless and unbridled power the government asks this Court to exercise. The Act is intended to enable the federal courts to fill in gaps in the law so they can exercise the authority they already possess by virtue of the express powers granted to them by the Constitution and Congress; it does not grant the courts free-wheeling authority to change the substantive law, resolve policy disputes, or exercise new powers that Congress has not afforded them. Accordingly, the Ninth Circuit has squarely rejected the notion that “the district court has such wide-ranging inherent powers that it can impose a duty on a private party when Congress has failed to impose one. To so rule would be to usurp the legislative function and to improperly extend the limited federal court jurisdiction.”

Congress has never authorized judges to compel innocent third parties to provide decryption services to the FBI. Indeed, Congress has expressly withheld that authority in other contexts, and this issue is currently the subject of a raging national policy debate among members of Congress, the President, the FBI Director, and state and local prosecutors. Moreover, federal courts themselves have never recognized an inherent authority to order non-parties to become de facto government agents in ongoing criminal investigations. Because the Order is not grounded in any duly enacted rule or statute, and goes well beyond the very limited powers afforded by Article III of the Constitution and the All Writs Act, it must be vacated.
In short, Apple is leaning heavily on the idea that CALEA pre-empts the All Writs Act here, and that CALEA explicitly says that companies can't be forced into helping to decrypt encrypted content. Beyond that, Apple is claiming that it's "too far removed" from the case for the All Writs Act to apply and mocks the idea (put forth by the DOJ) that because Apple licenses its software instead of selling it, that makes it okay:
Apple is no more connected to this phone than General Motors is to a company car used by a fraudster on his daily commute. Moreover, that Apple’s software is “licensed, not sold,”..., is “a total red herring,” as Judge Orenstein already concluded.... A licensing agreement no more connects Apple to the underlying events than a sale. The license does not permit Apple to invade or control the private data of its customers. It merely limits customers’ use and redistribution of Apple’s software. Indeed, the government’s position has no limits and, if accepted, would eviscerate the “remoteness” factor entirely, as any company that offers products or services to consumers could be conscripted to assist with an investigation, no matter how attenuated their connection to the criminal activity. This is not, and never has been, the law.
From there, Apple attacks the argument that there is no undue burden on Apple if it's forced to build this system, which Apple calls GovtOS. It starts out by noting that the idea that Apple can just create the software for this one phone and delete it appears nonsensical when put in context:
Moreover, the government’s flawed suggestion to delete the program and erase every trace of the activity would not lessen the burden, it would actually increase it since there are hundreds of demands to create and utilize the software waiting in the wings..... If Apple creates new software to open a back door, other federal and state prosecutors—and other governments and agencies—will repeatedly seek orders compelling Apple to use the software to open the back door for tens of thousands of iPhones. Indeed, Manhattan District Attorney Cyrus Vance, Jr., has made clear that the federal and state governments want access to every phone in a criminal investigation.... [Charlie Rose, Television Interview of Cyrus Vance (Feb. 18, 2016)] (Vance stating “absolutely” that he “want[s] access to all those phones that [he thinks] are crucial in a criminal proceeding”). This enormously intrusive burden—building everything up and tearing it down for each demand by law enforcement—lacks any support in the cases relied on by the government, nor do such cases exist.

The alternative—keeping and maintaining the compromised operating system and everything related to it—imposes a different but no less significant burden, i.e., forcing Apple to take on the task of unfailingly securing against disclosure or misappropriation the development and testing environments, equipment, codebase, documentation, and any other materials relating to the compromised operating system.... Given the millions of iPhones in use and the value of the data on them, criminals, terrorists, and hackers will no doubt view the code as a major prize and can be expected to go to considerable lengths to steal it, risking the security, safety, and privacy of customers whose lives are chronicled on their phones. Indeed, as the Supreme Court has recognized, “[t]he term ‘cell phone’ is itself misleading shorthand; . . . these devices are in fact minicomputers” that “could just as easily be called cameras, video players, rolodexes, calendars, tape recorders, libraries, diaries, albums, televisions, maps, or newspapers.”...By forcing Apple to write code to compromise its encryption defenses, the Order would impose substantial burdens not just on Apple, but on the public at large. And in the meantime, nimble and technologically savvy criminals will continue to use other encryption technologies, while the law-abiding public endures these threats to their security and personal liberties—an especially perverse form of unilateral disarmament in the war on terror and crime.
That last point is key. Criminals will still use other forms of encryption, while forcing Apple to do this harms everyone else by putting them more at risk.

Here Apple goes even deeper in questioning what are the limits to the All Writs Act:
For example, under the same legal theories advocated by the government here, the government could argue that it should be permitted to force citizens to do all manner of things “necessary” to assist it in enforcing the laws, like compelling a pharmaceutical company against its will to produce drugs needed to carry out a lethal injection in furtherance of a lawfully issued death warrant, or requiring a journalist to plant a false story in order to help lure out a fugitive, or forcing a software company to insert malicious code in its autoupdate process that makes it easier for the government to conduct court-ordered surveillance.
Next, Apple calls bullshit on the DOJ's claim that it absolutely needs Apple's help here. First, the FBI messed things up with the whole resetting iCloud password thing, and then what about the NSA? Why can't the NSA just hack in? That's what the following is saying in a more legalistic way:
... the government has failed to demonstrate that the requested order was absolutely necessary to effectuate the search warrant, including that it exhausted all other avenues for recovering information. Indeed, the FBI foreclosed one such avenue when, without consulting Apple or reviewing its public guidance regarding iOS, the government changed the iCloud password associated with an attacker’s account, thereby preventing the phone from initiating an automatic iCloud back-up.... Moreover, the government has not made any showing that it sought or received technical assistance from other federal agencies with expertise in digital forensics, which assistance might obviate the need to conscript Apple to create the back door it now seeks. See... (Judge Orenstein asking the government “to make a representation for purposes of the All Writs Act” as to whether the “entire Government,” including the “intelligence community,” did or did not have the capability to decrypt an iPhone, and the government responding that “federal prosecutors don’t have an obligation to consult the intelligence community in order to investigate crime”).
From there, we move onto the Constitutional arguments, which the court might not even address if it decides the All Writs Act doesn't apply. But, here, Apple starts with the First Amendment concerns of "compelled" speech.
Under well-settled law, computer code is treated as speech within the meaning of the First Amendment.... The Supreme Court has made clear that where, as here, the government seeks to compel speech, such action triggers First Amendment protections..... Compelled speech is a content-based restriction subject to exacting scrutiny... and so may only be upheld if it is narrowly tailored to obtain a compelling state interest....

The government cannot meet this standard here. Apple does not question the government’s legitimate and worthy interest in investigating and prosecuting terrorists, but here the government has produced nothing more than speculation that this iPhone might contain potentially relevant information... It is well known that terrorists and other criminals use highly sophisticated encryption techniques and readily available software applications, making it likely that any information on the phone lies behind several other layers of non-Apple encryption....
This argument feels a bit weakly supported. Then there's the Fifth Amendment argument, concerning due process:
In addition to violating the First Amendment, the government’s requested order, by conscripting a private party with an extraordinarily attenuated connection to the crime to do the government’s bidding in a way that is statutorily unauthorized, highly burdensome, and contrary to the party’s core principles, violates Apple’s substantive due process right to be free from “‘arbitrary deprivation of [its] liberty by government.’”
Again, this feels a bit weakly developed, but not surprisingly so. Apple is betting heavily that its main argument, concerning the All Writs Act not applying, will win the day (which seems to have a strong likelihood of being true). The Constitutional arguments are just being thrown in there so that they're in the case at this stage, and can then be raised on appeal, should it get to that level.

I imagine the DOJ will respond to this before long as well, so stay tuned (we certainly will).

Reader Comments (rss)

(Flattened / Threaded)

  1. icon
    Ehud Gavron (profile), Feb 25th, 2016 @ 3:57pm

    ...also IOS running entirely in RAM

    Not to take away from the 1st and 5th Amendments and all the other problemss in the AWA, there's a technical issue not covered above:

    The government has also asked that "GovtOS" run entirel in RAM, something that IOS doesn't currently do, and is too big to do.

    While that's not detailed in the filing, it's covered in the Neuenschwander Declaration, page 52, item 19, lines 12-15.

    That makes this whole thing an order of magnitude more complex from the "just go write software" perspective. It may not even be possible that an IOS so small could do what the government would want it to do afterward -- access the filesystem and export its contents.

    E

    reply to this | link to this | view in thread ]

  2. icon
    Sean L. (profile), Feb 25th, 2016 @ 4:04pm

    Mike — first and fifth amendment arguments are mostly there to preserve on appeal, which is why they're not given great length. They might/will be relevant later on, in front of an appellate court, but don't need to be reached here (except, again, court rules say that you need to make the argument to preserve it on appeal).

    reply to this | link to this | view in thread ]

  3. identicon
    Mark Wing, Feb 25th, 2016 @ 4:15pm

    The government is sending us a mixed FUD message. If we decrease security, then we have the hackapolypse, but if we increase security, then the terrorists win.

    This whole FBI-Apple issue leaves me confused as to what I'm supposed to be scared of.

    reply to this | link to this | view in thread ]

  4. identicon
    Anonymous Coward, Feb 25th, 2016 @ 4:20pm

    Re: ...also IOS running entirely in RAM

    access the filesystem and export its contents
    Why would the government prefer filesystem layer access to storage layer access?

    reply to this | link to this | view in thread ]

  5. identicon
    Anonymous Coward, Feb 25th, 2016 @ 4:27pm

    I still have a problem with the government getting a court order to command Apple to create the software on it's own dime. Taking that slightly further, after this is established precedent, what would prevent the government from commanding GE to make tanks for the military free of charge? Or any other thing wanted?

    reply to this | link to this | view in thread ]

  6. This comment has been flagged by the community. Click here to show it
    icon
    Whatever (profile), Feb 25th, 2016 @ 4:33pm

    Apple's arguments are long on words (and well released on just about every digital fanboi site), but remarkably short on a single coherent argument. Instead, it's a scatter shot of "well then this then!" arguments that may not add up as they like.

    the CALEA arguments may not work, as Apple won't be decrypting anything. In fact, the court's order is very narrow in scope and the decryption would be done by the government. If that is their strongest point, then Apple may find themselves failing.

    Arguments about the All Writs Act may also fall short, if only because it's a very old law that has faced many challenges over it's more than 200 years on the books. Apple's argument seems to be "but not in the digital domain", which may not be compelling enough for the courts.

    Also, Aople's own claims that this would make millions of phones insecure are rather overblown. As Apple themselves control the update process, the only way this code gets on a phone is if Apple specifically applies it. Any other attempts to update a phone would lead to a brick (just ask any number of hackers out there about it). The only way this ends up on millions of phones is if Apple chooses to do so.

    That said, it should be pointed out that getting Apple to do the work rather than hiring outside hackers to completely root Apple's OS and firmware seems prudent. It's way more likely that a general purpose can opener approach to the IPhone would lead to code in the wild that would harm millions (third party hackers, plus government workers means someone will let it loose). Apple has a chance here to both control the application and work on a longer term solution that eliminates the security hole (and that is exactly what it is) without having to worry about others creating malicious code and distributing it.

    I agree with you that their first and fifth amendment arguments are weak, but they are there mostly to include for future appeals if need be. I think Apple knows they are going to lose a few times along the way until this one lands in the surpreme court, and are just trying to set up as many blinds to fight from. It's a very good idea, because their primary arguments while long on words seem to be light on specific harm and long on arm waving generalizations.

    reply to this | link to this | view in thread ]

  7. This comment has been flagged by the community. Click here to show it
    identicon
    Anonymous Coward, Feb 25th, 2016 @ 4:39pm

    We Read Apple's 65 Page Filing Calling Bullshit On The Justice Department, So You Don't Have To

    We Don't Have A Law Degree And Have Never Studied These Things, But We Repeat Them As If They're Unquestionably True Because We're Techdirt And That's How We Roll

    FTFY, Mike.

    Can't wait to see your economic analysis of how taking Apple's side here is net beneficial for society. Oh wait, when it comes to privacy, you don't care about economics. I almost forgot. Proof is irrelevant when it's privacy, right? That only matters when it's IP. Then you're super-inquisitive and demand economic analysis that sounds good. It doesn't have to actually be good, of course, since you're not an econometrician and wouldn't know the difference. But it's gotta sound good, 'cause that's what really matters. Unless it's privacy, naturally, since that's sacred.

    reply to this | link to this | view in thread ]

  8. icon
    Mike Masnick (profile), Feb 25th, 2016 @ 4:40pm

    Re:

    Mike — first and fifth amendment arguments are mostly there to preserve on appeal, which is why they're not given great length. They might/will be relevant later on, in front of an appellate court, but don't need to be reached here (except, again, court rules say that you need to make the argument to preserve it on appeal).

    Yup. Said that in the post, but yes, we agree.

    reply to this | link to this | view in thread ]

  9. identicon
    Anonymous Anonymous Coward, Feb 25th, 2016 @ 4:40pm

    Re:

    The FBI along with the rest of the government who listen more to contributors than constituents (which would include all the alphabet soup agencies, Congress, the Judiciary, and the Executive).

    Is there anyone in government who speaks the truth. Maybe, but they are really hard to find.

    reply to this | link to this | view in thread ]

  10. This comment has been flagged by the community. Click here to show it
    identicon
    Anonymous Coward, Feb 25th, 2016 @ 4:44pm

    Re:

    I still have a problem with the government getting a court order to command Apple to create the software on it's own dime. Taking that slightly further, after this is established precedent, what would prevent the government from commanding GE to make tanks for the military free of charge? Or any other thing wanted?

    The government will pay them for their efforts in doing this work. Standard procedure. But that's reasonable, and Mike doesn't report reasonable. You have to read other sources if you want the full truth. You will NEVER find that here.

    reply to this | link to this | view in thread ]

  11. identicon
    Anonymous Anonymous Coward, Feb 25th, 2016 @ 4:49pm

    Re:

    Hey, obvious troll, what makes you thing economics is a component of privacy? My stuff, keep your nose out of it. That's privacy.

    Economics, an analysis of systems of production and the various efficiencies achieved by different systems. Nothing to do with privacy, unless you want to highlight the weaknesses in certain systems where privacy was trampled.

    reply to this | link to this | view in thread ]

  12. icon
    Will-INI (profile), Feb 25th, 2016 @ 4:50pm

    Code Is Speech

    To reinforce the idea that code is speech, Apple should publish the code for the iPhone in book form. It should take the book to the judge and highlight sections that the DOJ wants Apple to change. Then ask the judge to explain how the government isn't violating their right to free speech.

    reply to this | link to this | view in thread ]

  13. identicon
    Anonymous Coward, Feb 25th, 2016 @ 4:54pm

    It occurs to me...

    It occurs to me that if Apple did write GovtOS for the FBI, then they might as well include an auto-bruteforce password cracker. A subroutine to automatically run through the million or so passwords in a few minutes instead of forcing the FBI to enter them manually.

    I'm assuming that Apple can't just extract the password from from ROM.

    reply to this | link to this | view in thread ]

  14. icon
    Mike Masnick (profile), Feb 25th, 2016 @ 5:03pm

    Re:

    I still have a problem with the government getting a court order to command Apple to create the software on it's own dime. Taking that slightly further, after this is established precedent, what would prevent the government from commanding GE to make tanks for the military free of charge? Or any other thing wanted?

    The order does require reasonable compensation for the work. Doing it for free would clearly be deemed an unreasonable burden.

    reply to this | link to this | view in thread ]

  15. identicon
    Anonymous Anonymous Coward, Feb 25th, 2016 @ 5:06pm

    Re: Code Is Speech

    Now there is an interesting thought. Charge the government with copyright violations. If the government is forcing Apple to rewrite part of their code, then there is part of the code that is not being rewritten, and the governments taking and potential distribution of that could possibly violate their copyright, at least according to the MAFIAA's various definitions of violation.

    I would love to hear their fair use arguments.

    reply to this | link to this | view in thread ]

  16. identicon
    Anonymous Coward, Feb 25th, 2016 @ 5:11pm

    Re:

    As Apple themselves control the update process the only way this code gets on a phone is if Apple specifically applies it. Any other attempts to update a phone would lead to a brick (just ask any number of hackers out there about it).

    However, the source code to GovOS will leak. And that changes the ballgame quite a bit here.

    The reason why it will leak is simple: too many people with too much interest in leaking it will get their hands on it. The source code to GovOS will need to be available to prosecutors, defense counsel, and other people, as outlined in Jonathan Zdziarski's blog post. That's not counting the FBI itself, who cannot defend themselves against 16-year-old British hackers. If I were an organized crime boss, and GovOS becomes a reality, I'm intentionally engineering a crime where GovOS would become relevant, just so my attorneys can get their hands on GovOS (for review purposes) and can spirit away a copy. Or, I'd just put the word out about the serious sum of money that'll be available to somebody who supplies the GovOS source code.

    Now, having GovOS does not provide direct benefit. As you note, it will not be signed with Apple's signing key. However, source code to a valid iOS boot process is huge as a source of intel for those looking to bypass iOS protections in other ways.

    There is also the distinct possibility that GovOS winds up being more general-purpose. The FBI argument that it only needs to work on this one device doesn't hold a lot of water, as then it will be useless as a forensic tool (as noted by Apple in their response). Forensic tools need to be tested and vetted, and that testing and vetting can't be done on the iPhone in question (see Z's post), just as a breathalyzer can't be tested and vetted using just that one drunk guy in the corner. And if you change GovOS from what was tested and vetted (e.g., to lock it down to this one device), that might invalidate the testing and vetting. If GovOS, to qualify as a forensic tool, has to be able to be applied to a wider range of devices (say, any iPhone 5C), now it has intrinsic value in binary form to miscreants, let alone the value in the source code.

    reply to this | link to this | view in thread ]

  17. identicon
    Anonymous Coward, Feb 25th, 2016 @ 5:11pm

    Re: It occurs to me...

    I'm assuming that Apple can't just extract the password from from ROM.
    On p.10 of th IOS 9 Security Guide, Apple claims:
    The device’s unique ID (UID) and a device group ID (GID) are AES 256-bit keys fused (UID) or compiled (GID) into the application processor and Secure Enclave during manufacturing. No software or firmware can read them directly; they can see only the results of encryption or decryption operations performed by dedicated AES engines implemented in silicon using the UID or GID as a key. Additionally, the Secure Enclave’s UID and GID can only be used by the AES engine dedicated to the Secure Enclave. The UIDs are unique to each device and are not recorded by Apple or any of its suppliers.
    The “Secure Enclave” is not applicable, however, to the iPhone 5C's A6 application processor. (See p.7: “The Secure Enclave is a coprocessor fabricated in the Apple A7 or later…”)

    The uid and gid are not the whole story, though. For more, see A (not so) quick primer on iOS encryption, Oct 2014.
    • A random key is generated and used as basis for encrypting the entire disk

    • This key is itself encrypted using key0x89b, and stored in a special form of memory called “effaceable storage”
    “key0x89b” is derived from the passcode entangled with the device uid.

    reply to this | link to this | view in thread ]

  18. identicon
    Anonymous Coward, Feb 25th, 2016 @ 5:12pm

    "We Read Apple's 65 Page Filing"

    Which seems like a lot more than Whatever ever seems to do since he hardly ever seems to even read the article.

    reply to this | link to this | view in thread ]

  19. icon
    Ehud Gavron (profile), Feb 25th, 2016 @ 5:13pm

    Re: [troll]

    > Apple's arguments are long on words

    That's what you say but you never point out where.

    > the CALEA arguments may not work,

    That's what you say, but you only say:

    > as Apple won't be decrypting anything.

    CALEA has a lot more than decryption in it, LOL.

    > In fact, the court's order is very narrow in scope

    That's what you say, but in fact the court is requiring Apple to write a minimalist RAM-only IOS that has restrictions against Apple's will. If you weren't a troll I'd say you missed that point, but it's obvious you never wanted to see it.


    >Arguments about the All Writs Act may also fall short, i

    Again you make something up that says "may... fall short" but offer nothing substantive.

    For a troll you're a really awful one. I think you should go back to whomever paid you and tell them to send someone who can add source citations, and properly use English grammar.

    E

    reply to this | link to this | view in thread ]

  20. icon
    Ehud Gavron (profile), Feb 25th, 2016 @ 5:16pm

    Whatever - the troll

    He has no need to read the filing. His talking points were supplied by either his prejudice, his masters, or his ethereal otherworld spirit.

    The Government's request is outside the boundaries of lawful and it will not stand. The reasons have been discussed. Any attempt to shift this to "it's easy for them to decrypt" and "nothing will fall into the wrong hands" is a strawman argument.

    E

    reply to this | link to this | view in thread ]

  21. identicon
    Anonymous Coward, Feb 25th, 2016 @ 5:18pm

    Re: Re:

    I think the question isn't whether or not the government is going to pay them for the work. I think the question is can the government force them to do something, even with 'reasonable' compensation, against their will? To what extent do you have the right to refuse someone a service?

    This is a little tricky because it is Apple that provided the encryption tool here. If the government were asking Fedex or UPS for assistance in tracking a potentially dangerous or illegal package to what extent do they have to comply with the request and provide assistance? To what extent is this analogous?

    reply to this | link to this | view in thread ]

  22. identicon
    Anonymous Coward, Feb 25th, 2016 @ 5:21pm

    Re:

    " since you're not an econometrician and wouldn't know the difference."

    and who are you? Oh, that's right, just a random anonymous commentator.

    reply to this | link to this | view in thread ]

  23. identicon
    Anomylous, Feb 25th, 2016 @ 5:21pm

    Re: Re: ...also IOS running entirely in RAM

    Ok so, this is how the computer we call a phone works.

    An OS is written in to ROM. This is not really a problem to overwrite, but for evidence needs to be preserved as well.

    The OS is loaded from ROM into RAM. Not entirely as some things are accessed only when needed, but the basics of the OS are already running in RAM.

    What they want is use something other than ROM to load into RAM and boot the device and run it. In the context of a home computer, its like loading off a USB drive instead of your normal boot drive. In this case though, that ability does not exist on iOS devices. My cheapy Android tablet can boot from ROM or from an SD card (i love that so much) but most can't as far as I know, and no iOS device has that capability (cause they don't have SD cards).

    reply to this | link to this | view in thread ]

  24. icon
    Will-INI (profile), Feb 25th, 2016 @ 5:22pm

    Re: Re: Re:

    Apple has been very vocal in saying that they don't agree with the judge's order. In order for the new build to work, Apple would have to sign it for authentication. It's very hard to see how the government isn't forcing Apple to sign speech that they are in vocal disagreement with.

    It's almost like asking a newspaper to publish an op-ed the whole world knows they're in disagreement with.

    reply to this | link to this | view in thread ]

  25. icon
    Ehud Gavron (profile), Feb 25th, 2016 @ 5:26pm

    Microsoft, Facebook, Google, Twitter to file as amicus curiae

    I guess other companies, having read the filing, agree with Apple's point of view, not the trolls'. We won't know what the DoJ/FBI response is until they file it, of course, although lately they're more than happy to provide that in the media first. (Motion to compel before filed response, anyone?)

    http://recode.net/2016/02/25/google-will-join-microsoft-in-backing-apple-with-a-legal-filing -in-fbi-case/

    Trolls are like those cantankerous people and their TV show heroes... never pay attention to what anyone else says but just repeat the message they want to say.

    E

    reply to this | link to this | view in thread ]

  26. icon
    surfer (profile), Feb 25th, 2016 @ 5:28pm

    if you're not outraged, you are not paying attention..

    really? divine debate? understanding? IP insinuations? w0w, just w0w.. I thought the techdirt community was more enlightened than this..

    you amerikans are hilarious, deceived and duplicitous in your own demise.

    does anyone REALLY think this is about 'following every lead'?, if the FBI is so intent in following every lead, why not dig deeper into Hillary Clintons email fiasco? hmm?

    this is nothing short of your gov fscking you even deeper, longer and with no reach around, or lubricant. This is nothing short of getting their precedent using third party doctrine and the all writs act to circumvent congress, due process and your 'inalienable' rights, face it, you have no rights anymore, sitting on your couch watching football and drinking pisswater beer. you actually deserve this victimization.

    never has a terrorist toxified over 300,000 citizens drinking water for a payout, see Flint, MI, or daily murder 100s in remote drone attacks in countries you dont even have international relations with. I am absolutely amazed at the utter stupidity being dealt to the obese sheeple in the states of amerika. just w0w.

    if you cannot see that this is nothing more than another chip off you're privacy rights in a country completely benign of privacy rights anymore you should be ashamed, and re-read the subject line of this post.

    so much for 'going quietly into the night', change the channel, find some football, eat some more pringles and drink more beer, never in my life have I seen a more pitiful wretchedness of incontrovertible stupidity in my existence.

    land of the free eh? keep believing in that 'amerikan dream'

    reply to this | link to this | view in thread ]

  27. identicon
    Anonymous Coward, Feb 25th, 2016 @ 5:31pm

    Re: Re: Re: ...also IOS running entirely in RAM

    Ok so, this is how the computer we call a phone works.
    This is completely irrelevant to the question I was asking.

    An OS normally has a filesystem driver. But why do you need a filesystem driver for this application? For forensics, what you want is an image, plus the necessary keys to interpret the image as a filesystem.

    So, what prevents exporting an unlocked ”system keybag”?

    reply to this | link to this | view in thread ]

  28. identicon
    GreenDragon, Feb 25th, 2016 @ 5:41pm

    There's one CRUCIAL argument that hasn't been given ANY press, due to conflation and confusion.
    THE PHONE DOESN'T BELONG TO THE SHOOTER!
    It was bought by the County Agency that employed him, and was ISSUED to him!
    Isn't this a matter of a property owner seeking help from a product's manufacturer?
    It's fundamentally the same as asking Masterlock to help you get into your locker if you forget the combination or lose the key.

    reply to this | link to this | view in thread ]

  29. identicon
    Anonymous Coward, Feb 25th, 2016 @ 5:46pm

    Re: Re:

    No one speaks the truth. Human society never wanted truth at any level to begin with. They just want information gives them comfort or information that makes them feel righteous in their anger.

    I give you world history and the 2 party system of America as proof. Each party disparages the other and disrespect each other extensively.

    reply to this | link to this | view in thread ]

  30. identicon
    Anonymous Coward, Feb 25th, 2016 @ 5:47pm

    Re: Re: Re: ...also IOS running entirely in RAM

    that ability does not exist on iOS devices.
    Besides giving me a completely irrelevant answer, your answer also appears to be wrong.

    From A (not so) quick primer on iOS encryption
    Booting a Trusted Image

    The second is a bit more complicated. Essentially, you’re booting the device using an external drive as the operating system. But since you’re still “on” the device, the locally-stored keys and UID are still available…
    You're saying that this method is not available on the 5c?

    reply to this | link to this | view in thread ]

  31. identicon
    Scote, Feb 25th, 2016 @ 5:49pm

    Wrong, this has been publicized

    "There's one CRUCIAL argument that hasn't been given ANY press, due to conflation and confusion.
    THE PHONE DOESN'T BELONG TO THE SHOOTER!"


    If this hadn't been given "ANY" press then you wouldn't know about it.

    Nobody disagrees with the FBI's right to search the government-owned iPhone. That isn't the issue. The issue is the order for Apple to make backdoor software that Apple doesn't want to make. "Property owners" don't have a right to force the maker of a product to create special tools for them, especially not property owners who failed to use the enterprise management solutions Apple has for corporate owned iPhones.

    reply to this | link to this | view in thread ]

  32. identicon
    Nonya beeswax, Feb 25th, 2016 @ 5:54pm

    Bad govt

    I am going back to a dumb phone. Hope they don't force you to buy that $500.00 iphone. Sad that the government is stupid to the fact this could hurt profit at apple if they have to reply.
    Using the terrorist in this way can backfire. What happens if they dont find anything? Then what? We gave our freedom away for no reason other than give the control freaks what they want.i am afraid of what will happen in the future. Didn't anyone but me see that that "new world order" shit that Bush was pushing. Hope you like Nazi America, you voted for it. Like Flint,Mi. Which is worse than a what a terrorist would do. Why cant we bug the governor of Michigan for evidence of criminal activity.

    reply to this | link to this | view in thread ]

  33. identicon
    Anonymous Anonymous Coward, Feb 25th, 2016 @ 6:06pm

    Re: Re: Re:

    I think some are honest, at times. The hardest part is being honest with oneself because if one cannot see that they are not being honest with their own self, then being honest with others is impossible. Having the moral courage to quit a job rather than toe the boss's or parties' line has impact greater than just oneself and ones own integrity. The survival of others may be an important factor.

    When heartfelt honesty conflicts with agendas inculcated by parties, or thirst for power, the strength of the indoctrination or weakness of spirit become the deciding factors. The actuality of honesty assessment is in the mind of the observer, who has to take into consideration factors impacting their own judgment at any given time. Not always an easy thing to do.

    If you follow any of my posts you will understand that I am no fan of the two party system.

    reply to this | link to this | view in thread ]

  34. icon
    Ehud Gavron (profile), Feb 25th, 2016 @ 6:07pm

    Re: Re: Re: Re: ...also IOS running entirely in RAM

    >Besides giving me a completely irrelevant answer, your answer also appears to be wrong.
    >
    >From A (not so) quick primer on iOS encryption

    That also modifies the filesystem on the device. What the FBI has requested is -zero- modifications to the device. That is not (according to the declaration under oath) possible.

    This is not unreasonable. For example (this is an example so as you know some parts apply and some parts don't)... you can boot Ubuntu-Live without ever touching the local drives. However, that requires more than the 1GB of RAM you'll find in the iPhone 5c.

    There are other considerations that their "Secure Enclave" does that renders this difficult to accomplish. They're not saying impossible... I believe 6 coders, 2 support people, 1 doc person, 3 from legal... all for 4 weeks although that time might double.

    That seems to be an unreasonable burden -- not because the government wouldn't pay _something_ for it, but because it's not Apple's desire[5th am] to write this code [1st am], sign this code[1st am], or in any way be a part of the process[AWA].

    To the person who said: But it belongs to its owner and they're just asking for help getting into it: They can get into it. That's not what they want. I'll spell it out:

    Owner: I want to get into that phone. break into it for me.
    Apple: You can get into it any time. Enter the wrong PIN ten times and your brand-new used iPhone 5c will be ready for you to setup.
    Owner: But I want my employee's data!
    Apple: Well 1)You could have setup MDM. You didn't? 2)You could have plugged it in at the office and let iCloud do the backup. You changed the password? Well you screwed up the data and your employee's dead. Go look in the mirror; point at yourself a few times; we're not the problem.

    If you don't follow best practices, it doesn't make it Apple's problem, and that is the truth the FBI doesn't want to discuss.

    reply to this | link to this | view in thread ]

  35. identicon
    Anonymous Coward, Feb 25th, 2016 @ 6:08pm

    Re: Re: Re:

    Correct, reasonable compensation is not the issue here.

    It is compelling a company to do something that it does not want to that serves a manufactured purpose.

    If just compensation is the only factor here, how about we just go ahead and bring back slavery and call 3 meals a day just compensation.

    Apple did not break the law, they are just the makers of a device used by someone that committed a crime.

    If this passes why not now require gun manufacturers to install an electronic GPS & authentication device to prevent anyone but the owner from pulling its trigger and so that that we can know their location the moment the trigger was pulled. After all as long as well compensate them...

    Well lets just say, it is damn evil to make the tax payers pay to compensate a company by forcing it to steal their privacy!

    reply to this | link to this | view in thread ]

  36. identicon
    Anonymous Coward, Feb 25th, 2016 @ 6:10pm

    Re:

    >It's fundamentally the same as asking Masterlock to help you get into your locker if you forget the combination or lose the key.

    ... by disassembling your lock and reassembling in its place a completely different and newly invented/engineered thing that ... doesn't actually, like, keep anyone from opening the locker?

    reply to this | link to this | view in thread ]

  37. identicon
    Anonymous Coward, Feb 25th, 2016 @ 6:12pm

    Re:

    Did you actually have anything to say? Nope.

    reply to this | link to this | view in thread ]

  38. identicon
    Anonymous Coward, Feb 25th, 2016 @ 6:14pm

    Re: Re: Re: Re: Re: ...also IOS running entirely in RAM

    that their "Secure Enclave"
    This is a “Apple make: iPhone 5C, Model: A1532, P/N: MGFG2LL/A” with an
    A6 processor. It does NOT have a “secure enclave”. See IOS 9 Security Guide p.7.

    reply to this | link to this | view in thread ]

  39. This comment has been flagged by the community. Click here to show it
    icon
    Whatever (profile), Feb 25th, 2016 @ 6:19pm

    Re: Re:

    "However, the source code to GovOS will leak. And that changes the ballgame quite a bit here."

    It doesn't matter if people cannot update the phone themselves. Changing the OS bricks the phone, end of discussion. Apple could reveal all the code and still nobody can update the phones.

    " That's not counting the FBI itself, who cannot defend themselves against 16-year-old British hackers."

    Standard horse crap. Social hacking and spear phishing is unavoidable, most end users are not techie enough not to realize they are being targeted.

    "There is also the distinct possibility that GovOS winds up being more general-purpose. "

    Doesn't matter. Without a method to apply it to the phone (the one Apple must do in each case), having in the wild or posted on every street corner won't change a thing. Apple is trying to scare you, and apparently it's working.

    reply to this | link to this | view in thread ]

  40. identicon
    Anonymous Coward, Feb 25th, 2016 @ 6:19pm

    Re: Re: Re: Re: Re: ...also IOS running entirely in RAM

    That also modifies the filesystem on the device.
    Personal knowledge? Or do you have a source to support the assertion that any bootup at all will modify this device's filesystem? Even an external boot? Is that enforced by hardware?

    (I'm not necessarily totally disinclined to believe your assertion, but reference to your source would be nice.)

    reply to this | link to this | view in thread ]

  41. icon
    Whatever (profile), Feb 25th, 2016 @ 6:24pm

    Re: Whatever - the troll

    Translation: "I don't agree with him, so he must be a troll".

    Simply minded concept.

    reply to this | link to this | view in thread ]

  42. identicon
    Anonymous Coward, Feb 25th, 2016 @ 6:48pm

    Re: Re: It occurs to me...

    “key0x89b” is derived from the passcode entangled with the device uid.
    While this statement is indeed what I myself understood from David Schuetz, looking again at p.46 of Belenko and Sklyarov (Hi, Dmitry!), it may be that key 89b is not entangled with the passcode, after all? 89b is just derived from uid? Only key 835 is entangled with passcode? (In order to unlock system keybag).

    reply to this | link to this | view in thread ]

  43. identicon
    Anonymous Coward, Feb 25th, 2016 @ 6:57pm

    don't forget the 4th

    Also the 4th amendment guards against unreasonable search and seizure. The FBI is wanting to search and seize the Apple O/S code which is Apple's property. It is unreasonable to demand that the owner of the property significantly modify the property so that the property may comply with the terms of the warrant.

    "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or
    affirmation, and particularly describing the place to be searched, and the persons or things to be seized.".

    reply to this | link to this | view in thread ]

  44. identicon
    Anonymous Coward, Feb 25th, 2016 @ 7:05pm

    I am befuddled. If Apple is so concerned for the privacy of it customers they have one tiny little flaw. I always wondered about cloud backups and syncs. If the data on the cell tablet is to be absolutely protected from both good and bad, why isn't the data that is stored in the cloud offered the same protections as the physical device. I for one have always been skeptical of cloud services. How can the cloud service provider hand over the data un-encrypted? Shouldn't the data in the cloud also be encrypted to alleviate Apple from the picture? Hmmmm, makes me wonder what dropbox etc has on me.

    reply to this | link to this | view in thread ]

  45. identicon
    Anonymous Coward, Feb 25th, 2016 @ 7:23pm

    This is nothing but an unconstitutional power grab by the bureau. Thankfully the house and senate haven't gotten to heavily involved. Those jokers are responsible for the patriot act. The phone is the property of the government, let them deal with it.

    reply to this | link to this | view in thread ]

  46. identicon
    Anonymous Coward, Feb 25th, 2016 @ 7:38pm

    don't forget the 13th

    "Amendment XIII.
    Passed by Congress January 31, 1865. Ratifi ed December 6,
    1865.
    (Note: A portion of Article IV, Section 2 of the Constitution
    was changed by the 13th Amendment.)
    SECTION 1.
    Neither slavery nor involuntary servitude, except as a
    punishment for crime whereof the party shall have been
    duly convicted, shall exist within the United States, or any
    place subject to their jurisdiction."

    ** Requiring Apple to use its resources to create an unsecured O/S that currently does not exist against its will (and better interests) and without remuneration could be construed as "involuntary servitude" and is therefore illegal according to the 13th Amendment to the US Constitution. **

    reply to this | link to this | view in thread ]

  47. identicon
    Anonymous Coward, Feb 25th, 2016 @ 7:40pm

    "Apple is dedicated to enhancing the security of its devices, so that when customers use an iPhone, they can feel confident that their....—will be safe and secure."

    it's not imporatant that they ARE secure- just that they FEEL secure... If apple wanted their customers to actually BE secure, they'd open source, and segregate their baseband processors.

    "government from demanding that Apple write code to turn on the microphone in aid of government surveillance, activate the video camera, surreptitiously record conversations, or turn on location services to track the phone’s user?"

    Previous leaks has show every single thing mentioned above can be done to ANY phone through standard baseband functions.


    “federal prosecutors don’t have an obligation to consult the intelligence community in order to investigate crime”

    fed prosecutors know damn well the intel community can do it, they're probably sick of the under the table consults, and having to parallel construct evidence and flat out fraudulently make cases.

    reply to this | link to this | view in thread ]

  48. identicon
    Anonymous Coward, Feb 25th, 2016 @ 8:00pm

    Re: Re: Re: Re:

    Were it so easy... a glass of water must remain pure for it to be safe to drink, a drop of darkness here, and a drop of poison there and you will soon find none will wish to drink it.

    Many individuals may indeed be honest, but they are often crowded out by the lies, and an honest person is loathed to join the ranks of the dishonest... because any that know truth, know that it is hated for the sake of political & social expediency.

    As far as your other posts, I don't think we disagree much on the fundamentals, but it might be said you have more faith in humanity than I, and it is likely we both disagree on how to clean up corruption, despite us both wanting to be rid of it.

    reply to this | link to this | view in thread ]

  49. icon
    TechDescartes (profile), Feb 25th, 2016 @ 8:09pm

    Maybe

    It's clearly a bit of a rush job as there are a few typos (and things like incorrect page numbers in the table of contents).
    Maybe their brief was hacked.

    reply to this | link to this | view in thread ]

  50. identicon
    Anonymous Coward, Feb 25th, 2016 @ 8:11pm

    Re: Re: Re:

    You are a straight up clown and completely ignorance.

    Phishing, Social Hacking, and OS updates have NOTHING do with with any of this. We are talking about a Company being forced to knowingly compromise their own products to prop up a tyrannical Agency and its whims.

    You are grossly ignorant of technology. You may not have been watching much of recent history but there are quite a number of ways to get malicious code onto devices even while those very systems have been designed to prevent just that from occurring.

    reply to this | link to this | view in thread ]

  51. This comment has been flagged by the community. Click here to show it
    icon
    Whatever (profile), Feb 25th, 2016 @ 9:09pm

    Re: Re: Re: Re:

    Thanks for all the adhoms, you so completely added to the discussion and made this so much more informative.

    Read the comments before mine, I was only addressing them. If you don't care to read, well, too bad for you. troll on!

    reply to this | link to this | view in thread ]

  52. identicon
    Troll, Feb 25th, 2016 @ 9:18pm

    But it was my RICE KRISPIES that did the talking!

    And I do whatever my RICE KRISPIES tell me to do!

    reply to this | link to this | view in thread ]

  53. identicon
    Anonymous Coward, Feb 25th, 2016 @ 9:23pm

    Re: Maybe

    They were a non-party, they only had about a week to respond to the order, and the government filed an additional motion to compel in that time frame which they then also needed to address in this document. So perhaps they can be forgiven if it looks a bit rushed.... it WAS rushed to some degree.

    reply to this | link to this | view in thread ]

  54. identicon
    Anonymous Coward, Feb 25th, 2016 @ 9:40pm

    Re: Re: Re: Re: Re:

    Just to be pedantic...

    > a glass of water must remain pure for it to be safe to drink

    Pure is a relative thing, when it comes to drinking water. Certainly, one can foul it to a point where it is unsafe to drink. No argument there.

    But while you CAN drink highly distilled / purified water, it is by no means the "best" water. In fact, drinking JUST distilled water can be highly dangerous to your health. I'll leave the ancillary reading to you.

    Put in a tasty array of dissolved minerals (or other substances) and water becomes much better for you. ... even without caffeine, sugar, or flavorings.

    Moderation in all things, friend.

    reply to this | link to this | view in thread ]

  55. identicon
    Anonymous Coward, Feb 25th, 2016 @ 10:01pm

    Re: Re: Re: Re: Re:

    what do you think jailbreaking is? it is fact that the government has hacked root cert providers to get their keys so they can do man in the middle. they were doing this to look at googles stuff as it went between data centers. if the government has the key to say they are apple and they have a GOVTos that they want loaded getting it on the phone is far from impossible. how to you think apple does over the air upgrades? the documentation and source code from this project will allow to government to do some very interesting things to ios. i remember when Obama was upset that he had to use a black berry and couldent use his iphone cause it wasnt secure now its secure and the government wants it insecure.

    reply to this | link to this | view in thread ]

  56. identicon
    Anonymous Coward, Feb 25th, 2016 @ 10:10pm

    now to see if this government agency will follow their own laws or ignore them like they usually do when it gets in their way.

    reply to this | link to this | view in thread ]

  57. identicon
    Anonymous Coward, Feb 25th, 2016 @ 10:52pm

    Re: Code Is Speech

    Unnecessary, because it is well settled that code is speech. The paragraph of citations that Apple provides on this point eliminates the need for any fancy demonstrations.

    reply to this | link to this | view in thread ]

  58. identicon
    Anonymous Coward, Feb 25th, 2016 @ 10:56pm

    Re: Re: Re: Re:

    It's telling that Whatever thinks that full grown adults who a teen ran circles around should manage everyone's security. (Of course, by "manage" they mean open wide like a pornstar's worn asshole.)

    reply to this | link to this | view in thread ]

  59. identicon
    Anonymous Coward, Feb 25th, 2016 @ 10:57pm

    Re: Re: Whatever - the troll

    Which you incidentally regularly exhibit.

    reply to this | link to this | view in thread ]

  60. identicon
    Dingledore the Flabberghaster, Feb 26th, 2016 @ 3:17am

    Re:

    confused as to what I'm supposed to be scared of


    You're not supposed to be scared OF anything, on the off-chance that thing goes away.

    You're just supposed to be scared.

    reply to this | link to this | view in thread ]

  61. identicon
    Anonymous Coward, Feb 26th, 2016 @ 4:47am

    Re: Re: Whatever - the troll

    Physician heal thyself!

    reply to this | link to this | view in thread ]

  62. icon
    Ninja (profile), Feb 26th, 2016 @ 5:14am

    Re:

    It's not that the arguments won't work. It's you that already made up your mind based in your little internal rosy universe and seem to be impervious to reality.

    Also, Aople's own claims that this would make millions of phones insecure are rather overblown. As Apple themselves control the update process, the only way this code gets on a phone is if Apple specifically applies it. Any other attempts to update a phone would lead to a brick (just ask any number of hackers out there about it). The only way this ends up on millions of phones is if Apple chooses to do so.

    Guess you never heard of jailbreak. I won't even develop this argument, it's pretty clear that you are full of bullshit. The rest of what you said isn't worth discussing.

    reply to this | link to this | view in thread ]

  63. icon
    Ninja (profile), Feb 26th, 2016 @ 5:19am

    Re: Re: Whatever - the troll

    The irony!

    reply to this | link to this | view in thread ]

  64. icon
    Ninja (profile), Feb 26th, 2016 @ 5:22am

    Re: Microsoft, Facebook, Google, Twitter to file as amicus curiae

    Facebook, Google, Microsoft and Apple united. Color me pleasantly surprised. Now excuse me as I buy rations to the impeding zombie apocalypse.

    reply to this | link to this | view in thread ]

  65. identicon
    jim, Feb 26th, 2016 @ 5:29am

    what?

    I thought all this was settled in the first wiretap hearings, way back when. Or did people get stupid, and allow personal id information on a phone. I guess it depends on the level of security wanted by a victium. But, if you want to get worse, remember, they can tap the phone, warrents are also good for computers, now remember, thats your thoughts. Both have been settled law for years prior to 911. What makes this different?
    I still believe apple was pricing themselfs out of business. Asking for too much with each opening, looking for what the market will bear. FBI wants their tool. Just like they gave the chineese back in November.
    Google and MS already acknowledge that long ago they had chineese versions, and let them have sourcecodes. Apple just acknowledged it.

    reply to this | link to this | view in thread ]

  66. icon
    Ninja (profile), Feb 26th, 2016 @ 5:34am

    Re: Re: Re:

    Add Google, Microsoft, Facebook and Twitter. They must all be dumbasses that don't know what they are saying, no?

    reply to this | link to this | view in thread ]

  67. icon
    Ehud Gavron (profile), Feb 26th, 2016 @ 5:42am

    Re: Re: Re: Re: Re: Re: ...also IOS running entirely in RAM

    >... but reference to your source would be nice.

    Like when I said it was part of the declaration attached to the motion?

    E

    reply to this | link to this | view in thread ]

  68. identicon
    Anonymous Coward, Feb 26th, 2016 @ 5:47am

    Re: Re: Re: Re: Re: Re:

    lol, that is pedantic, I think everyone got the gist of the message.

    Yes moderation in all things when talking about food and physical activity, but that saying was never meant to be implied with honesty, context is indeed king.

    reply to this | link to this | view in thread ]

  69. identicon
    Anonymous Coward, Feb 26th, 2016 @ 5:54am

    Re: Re: Re: Re: Re:

    Thanks for all the adhoms, you so completely added to the discussion and made this so much more informative.

    As opposed to your disinformation that you keep parroting like an idiot clearly out of his league.

    Stick to copyright issues because you don't know jack shit about security.

    Nothing.

    reply to this | link to this | view in thread ]

  70. identicon
    Anonymous Coward, Feb 26th, 2016 @ 5:55am

    Re:

    apple was never concerned about privacy for its customers. Like every business they are only concerned with the image of providing privacy.

    Apply currently rolls over like a bitch for fucking China from the looks of things. But you see in china the Emperor wears a different set of cloths and the serfs there do not have the same freedoms as Americans, sure the 2 parties want to get us there, but we are not there yet.

    reply to this | link to this | view in thread ]

  71. icon
    drewdad (profile), Feb 26th, 2016 @ 6:15am

    GovtOS? How did they miss FBIOS?

    I mean, really, guys. Get it together.

    reply to this | link to this | view in thread ]

  72. icon
    That One Guy (profile), Feb 26th, 2016 @ 6:26am

    Re: GovtOS? How did they miss FBIOS?

    Too specific. After all if the case does't go Apple's way every agency is going to want to have their turn issuing demands. FBIOS is more accurate in this case, but wouldn't make as much sense when another agencies comes knocking with a demand for the same.

    reply to this | link to this | view in thread ]

  73. identicon
    Anonymous Coward, Feb 26th, 2016 @ 6:36am

    Re: Re:

    The order does require reasonable compensation for the work. Doing it for free would clearly be deemed an unreasonable burden.

    I agree and would add if Apple is forced to comply with this order and even if they are paid, Apple will still feel an unreasonable burden because now people will no longer trust their phones are security which could lead to less sales which would lead to lower stock prices and Apple losing more money than they make by creating this new version.

    reply to this | link to this | view in thread ]

  74. identicon
    Anonymous Coward, Feb 26th, 2016 @ 6:48am

    Re:

    If Apple loses, we ALL lose. You just don't seem to understand that. Imagine if all the FBI needs to do is get hold of a phone. Then simply fill out the paperwork and file it with some judge who is friendly with them. They give some reason (possibly even bogus ones) why they need a warrant. Judge issues the warrant. Now the FBI says to Apple, unlock it now.

    reply to this | link to this | view in thread ]

  75. identicon
    Anonymous Coward, Feb 26th, 2016 @ 6:55am

    Re: Re: Microsoft, Facebook, Google, Twitter to file as amicus curiae

    This may be the year the Cubs win the World Series too. Watch for Hell to freeze over.

    reply to this | link to this | view in thread ]

  76. identicon
    Anonymous Anonymous Coward, Feb 26th, 2016 @ 7:06am

    Re: Re: Microsoft, Facebook, Google, Twitter to file as amicus curiae

    Ninja, did you mean that you wanted to buy tickets to the impending zombie apocalypse? It is shaping up to be a good show.

    reply to this | link to this | view in thread ]

  77. identicon
    Anonymous Coward, Feb 26th, 2016 @ 7:33am

    Re:

    Why is this initially hidden? There is nothing in it that deserves such treatment.

    reply to this | link to this | view in thread ]

  78. icon
    nasch (profile), Feb 26th, 2016 @ 7:36am

    Re:

    The upshot is, just give up all your liberties and give the NSA and FBI as much power as possible and they promise to protect us from both. Except when they don't it will be because we didn't give up enough liberties and/or didn't give them enough power and/or money.

    reply to this | link to this | view in thread ]

  79. icon
    nasch (profile), Feb 26th, 2016 @ 7:40am

    Re: Re:

    Why is this initially hidden? There is nothing in it that deserves such treatment.

    Probably because Whatever has earned whatever you call the opposite of the benefit of the doubt.

    reply to this | link to this | view in thread ]

  80. identicon
    Anonymous Coward, Feb 26th, 2016 @ 7:41am

    Re: Re: Whatever - the troll

    A troll is as a troll does regardless of why a troll trolls.

    reply to this | link to this | view in thread ]

  81. icon
    nasch (profile), Feb 26th, 2016 @ 7:45am

    Re:

    Isn't this a matter of a property owner seeking help from a product's manufacturer?

    No, that would be if the county (the owner of the phone) called Apple up and asked for help. Then Apple would say no and the story would be over. What actually happened is the FBI went to a court and had them order Apple to help.

    You did read the story, right?

    reply to this | link to this | view in thread ]

  82. identicon
    Anonymous Coward, Feb 26th, 2016 @ 7:47am

    Re:

    That point has been reported (which is why you know about it). No one dwells on it because it's largely unimportant. No one is making a 4th amendment argument here.

    reply to this | link to this | view in thread ]

  83. identicon
    Anonymous Coward, Feb 26th, 2016 @ 7:48am

    Re: don't forget the 4th

    Are you trying to argue that corporations are people?

    reply to this | link to this | view in thread ]

  84. identicon
    Anonymous Coward, Feb 26th, 2016 @ 7:52am

    Re: Re: Re: Re:

    It seems to me like that may be what they're laying the groundwork for in the first amendment argument.

    reply to this | link to this | view in thread ]

  85. icon
    nasch (profile), Feb 26th, 2016 @ 7:53am

    Re: don't forget the 4th

    The FBI is wanting to search and seize the Apple O/S code which is Apple's property.

    I don't believe the order requires either of those things.

    reply to this | link to this | view in thread ]

  86. identicon
    Anonymous Coward, Feb 26th, 2016 @ 7:54am

    Re: don't forget the 13th

    except that they will pay Apple for it. I agree with Apple but they are n't making them do it for free.

    reply to this | link to this | view in thread ]

  87. icon
    nasch (profile), Feb 26th, 2016 @ 7:55am

    Re: don't forget the 13th

    Requiring Apple to use its resources to create an unsecured O/S that currently does not exist against its will (and better interests) and without remuneration could be construed as "involuntary servitude" and is therefore illegal according to the 13th Amendment to the US Constitution.

    Has the 13th ever been found to apply to corporations?

    reply to this | link to this | view in thread ]

  88. identicon
    Anonymous Coward, Feb 26th, 2016 @ 7:58am

    Re:

    It's fundamentally the same as asking Masterlock to help you get into your locker if you forget the combination or lose the key.

    Sometimes that involves breaking the lock. In terms of your analogy, they CAN get into the phone. It might be wiped, but that certainly isn't Apple's fault.

    Back to your analogy: masterlock isn't guaranteeing a pickable lock. Who'd buy such a worthless piece of shit?

    reply to this | link to this | view in thread ]

  89. identicon
    Anonymous Coward, Feb 26th, 2016 @ 8:00am

    Re: Re: Re: Re: Re: Re: Re: ...also IOS running entirely in RAM

    Like when I said it was part of the declaration attached to the motion?
    If you're seeing support for your assertion in either of the declarations, then please extract the exact statement for me. I just don't see it.

    (Unless you're referring to Neneunshwander para 19. In which case, then I believe you're simply not reading carefully enough. That statement does not support your assertion.)

    reply to this | link to this | view in thread ]

  90. identicon
    Anonymous Coward, Feb 26th, 2016 @ 8:05am

    Re: Re: don't forget the 4th

    Since it's already been decided for us, we may as well try to use it to our advantage.

    reply to this | link to this | view in thread ]

  91. identicon
    Anonymous Coward, Feb 26th, 2016 @ 8:10am

    Re: Re: Re: don't forget the 4th

    The problem there is making that argument, should it be accepted, while winning this case, only adds precedent to support a ruling that needs to be overturned.

    reply to this | link to this | view in thread ]

  92. icon
    Adam (profile), Feb 26th, 2016 @ 8:26am

    Re:

    I don't buy the arguments that Apple isn't decrypting anything. The man who drives the getaway car is still guilty of robbing the bank.

    reply to this | link to this | view in thread ]

  93. icon
    nasch (profile), Feb 26th, 2016 @ 8:31am

    Re: Re:

    Back to your analogy: masterlock isn't guaranteeing a pickable lock. Who'd buy such a worthless piece of shit?

    If a lock is not guaranteed to be unpickable, then that's effectively the same as guaranteed to be pickable because no lock maker is going to advertise that their lock can be picked. So pretty much everyone is willing to buy pickable locks. The locks on your house, if they're standard door locks, are pretty easily pickable by someone with the right tools and expertise. They may even be pickable almost immediately by someone with the right tool and little to no expertise.

    https://www.youtube.com/watch?v=131j0htYIoU

    reply to this | link to this | view in thread ]

  94. identicon
    Anonymous Coward, Feb 26th, 2016 @ 8:46am

    Re: Re:

    Actually, it's aiding an abetting unless he was involved in the plot and then it's conspiracy to commit the act as well.

    reply to this | link to this | view in thread ]

  95. identicon
    Anonymous Coward, Feb 26th, 2016 @ 8:52am

    Re: Re: Re: Re: Re: Re: Re:

    To be even more pedantic...

    Don't you mean "Purity is a relative thing..."?

    reply to this | link to this | view in thread ]

  96. identicon
    Anonymous Coward, Feb 26th, 2016 @ 8:54am

    Re: Re: Re: Re: Re: ...also IOS running entirely in RAM

    … that requires more than the 1GB of RAM you'll find in the iPhone 5c.
    I will tell you from personal experience that an IBM PC XT with 256K ram (128K was standard) would boot and run from floppies without touching the 10M hard drive. That wasn't my first machine, but it was my first personal(*) machine with a hard drive. It also was just before the Apple Macintosh was introduced.

    Anyhow, my experience with ramdisks came later. Quite a bit later, in fact.


    (*) I never personally owned an IBM 360, and my mainframe experience remains extremely limited to this day.

    reply to this | link to this | view in thread ]

  97. identicon
    Anonymous Coward, Feb 26th, 2016 @ 9:07am

    Re: Re: Whatever - the troll

    Yeah, you keep thinking that.

    reply to this | link to this | view in thread ]

  98. icon
    nasch (profile), Feb 26th, 2016 @ 9:10am

    Re: Re: Re: Re: Re: Re: ...also IOS running entirely in RAM

    I will tell you from personal experience that an IBM PC XT with 256K ram (128K was standard) would boot and run from floppies without touching the 10M hard drive.

    Unless it would boot and run a recent version of Ubuntu that way, I'm not sure how that's relevant. Or was this just intended as an aside?

    reply to this | link to this | view in thread ]

  99. identicon
    Anonymous Coward, Feb 26th, 2016 @ 9:20am

    Re: Re: Re:

    This underlies a core principle. Security is a process not a state.

    reply to this | link to this | view in thread ]

  100. identicon
    Anonymous Coward, Feb 26th, 2016 @ 9:22am

    Re: Re: Re: Re: Re: Re: Re: ...also IOS running entirely in RAM

    Unless it would boot and run a recent version of Ubuntu that way, I'm not sure how that's relevant.
    I'm pointing out that booting from external media does not, in general, require running from a ramdisk.


    (In the case at hand, the FBI made some technical suggestions to achieve an objective. But the order did not absolutely require the specific methods that the government requested.)

    reply to this | link to this | view in thread ]

  101. identicon
    Anonymous Coward, Feb 26th, 2016 @ 9:22am

    Re: Re: don't forget the 13th

    As I said before, do we really want to be reinforcing the idea that corporations are people?

    reply to this | link to this | view in thread ]

  102. This comment has been flagged by the community. Click here to show it
    icon
    Whatever (profile), Feb 26th, 2016 @ 9:37am

    Re: Re: Re: Re: Re:

    Actually, I made no such claim. The only open wise asshole here is you. Put a cork in it already, your trolling is really, really way too obvious.

    reply to this | link to this | view in thread ]

  103. This comment has been flagged by the community. Click here to show it
    icon
    Whatever (profile), Feb 26th, 2016 @ 9:40am

    Re: Re: Re: Re:

    I think they do know what they are saying - but I also think that they all have a fairly common agenda. So it's generally not surprising to see them more or less on the same side of this sort of topic.

    Google wants the governments of the world to butt out of their data collection business. Facebook wants the government to stay out of their data collection business. They generally don't want the government to stand up for people's rights unless it impinges on their business models predicated on knowing everything about their clients.

    So I am not surprised to see bird of a feather...

    reply to this | link to this | view in thread ]

  104. identicon
    Anonymous Coward, Feb 26th, 2016 @ 11:01am

    Re: Re: Code Is Speech

    I like this argument. I've heard the concern about signing the code possibly being considered speech, but this is the 1st time I've thought about the requested Apple code also being thought of as speech.
    It's almost like a court forcing an artist to paint a certain subject. Or compelling Mike Masnick to write about how the world need an eternal copyright. It starts to look a whole lot more tyrannical in that light.

    reply to this | link to this | view in thread ]

  105. identicon
    Anonymous Coward, Feb 26th, 2016 @ 12:46pm

    Re: Re: Re: Re: Re: Re: Re: Re: ...also IOS running entirely in RAM

    I'm pointing out that booting from external media does not, in general, require running from a ramdisk.
    Although, somewhat incidentally to the exact point I was making here, it does appear that the Elcomsoft “iOS Forensic Toolkit” did run from a ramdisk on the iPhone 4.
    Once the iPhone or iPad is in DFU mode, select action two, ‘Load Toolkit Ramdisk into the iOS device’ by typing ‘2’ at the command prompt, and pressing enter. The Toolkit Ramdisk loads into the iOS device, and the ‘Welcome’ screen appears once again.
    Notwithstanding that, a ramdisk should not be strictly essential to implement limited functionality in an extremely resource-constrained environment. Instead, a ramdisk is a luxury which trades memory to get improved on-demand program load speed. If the program is so big that you're going to need load an overlay —because the entire executable won't fit into available memory— then a ramdisk is the wrong direction to go.

    reply to this | link to this | view in thread ]

  106. identicon
    N, Feb 26th, 2016 @ 1:22pm

    Re: ...also IOS running entirely in RAM

    This is not a significant technological hurdle as all they really need to do to overcome it is remove the on-board memory and insert it into a separate device or, more likely, cobble a tether that would run from a technicians laptop but allow access the device to boot-up.

    This has already been done in the past by people who have jailbroken their personal devices.

    reply to this | link to this | view in thread ]

  107. identicon
    Anonymous Coward, Feb 26th, 2016 @ 2:43pm

    no doubt the FBI's rebuttal will be "if you do not support helping us, you support terrorism"

    reply to this | link to this | view in thread ]

  108. identicon
    Anonymous Coward, Feb 26th, 2016 @ 2:45pm

    Re:

    It is real simple.

    If you support more security for the people running things, then that's good. If you support laws and security that protect everyone equally then you are supporting terrorism.

    reply to this | link to this | view in thread ]

  109. identicon
    Anonymous Coward, Feb 26th, 2016 @ 2:51pm

    Re: Re: ...also IOS running entirely in RAM

    … remove the on-board memory…
    You were referring to the “Toshiba THGBX2G7B2JLA01 128 Gb (16 GB) NAND flash” on the 5c. Yes?

    But has anyone ever separated the “Elpida B8164B3PM-1D-F 8 Gb (1 GB) DDR2 RAM”, which is stacked under the A6 in a Package-on-Package configuration? It occurs to me that with, say dual-port ram, one could modify a process' instructions after an executable's signature has been validated.

    reply to this | link to this | view in thread ]

  110. icon
    tqk (profile), Feb 26th, 2016 @ 6:06pm

    Re: Re: Re:

    I think the question is can the government force them to do something, even with 'reasonable' compensation, against their will?

    Apple should tell 'em to piss off on principle. What happens if Apple tries it, it fails and corrupts the data? What's to stop this psycho prosecutor from going after Apple for tampering with evidence/aiding and abetting ISIS?

    reply to this | link to this | view in thread ]

  111. icon
    tqk (profile), Feb 26th, 2016 @ 6:55pm

    Re: Re:

    But you see in china the Emperor wears a different set of cloths and the serfs there do not have the same freedoms as Americans ...

    Yeah, poor buggers don't have their own DHS, CIA, NSA, FBI, ...

    reply to this | link to this | view in thread ]

  112. icon
    tqk (profile), Feb 26th, 2016 @ 6:58pm

    Re: Re: don't forget the 13th

    You order me to write malicious code, and I'll decline to participate. I want to talk to a lawyer. I don't care how much you're offering.

    reply to this | link to this | view in thread ]

  113. icon
    tqk (profile), Feb 26th, 2016 @ 7:07pm

    Re: what?

    Or did people get stupid, and allow personal id information on a phone.

    They got stupid and trusted it to be stored in "the cloud." They no longer have any say as to how much PII it stores or sells to trusted partners.

    reply to this | link to this | view in thread ]

  114. identicon
    Anonymous Coward, Feb 26th, 2016 @ 10:45pm

    Re: Re: Re: Re: Re: Re:

    The asshole really needs to get a better mirror.

    reply to this | link to this | view in thread ]

  115. identicon
    Anonymous Coward, Feb 27th, 2016 @ 8:31am

    Re: Re: Re: don't forget the 13th

    You order me to write malicious code, and I'll decline to participate.
    Identifying back doors, attack points, and surveillance mechanisms in iOS devices. Jonathan Zdziarski: PDF, p.6
    The file relay is among the biggest forensic trove of intelligence on a device’s owner and, in my best and most honest opinion, a key “backdoor” service that, when used to its full capability, provides a significant amount of that that would only be relevant to law enforcement or spying agencies.

    Apple seemingly has been making many changes over the past few years to enable the extraction of information through the undocumented file relay service that really only has relevance to purposes of spying and/or law enforcement. . . .
    Malicious code? Or not?

    I want to talk to a lawyer.
    It's getting awfully dark outside to be talking to lawyers.

    I don't care how much you're offering.
    If unions are too blue-collar, too “socialist” —coders are not longshoremen— then how about a nice professional society?

    reply to this | link to this | view in thread ]

  116. identicon
    Anonymous Coward, Feb 27th, 2016 @ 10:48am

    Re: Re: Re: It occurs to me...

    While this statement is indeed what I myself understood from…
    Stashing this link to Zdziarski here as further explanation:
    Tl;Dr Notes on iOS 8 PIN / File System Crypto.

    This aids in understanding p.11ff. of IOS 9 Security Guide.

    reply to this | link to this | view in thread ]

  117. identicon
    Anonymous Coward, Feb 27th, 2016 @ 5:23pm

    Re: Re: Re: ...also IOS running entirely in RAM

    An OS is written in to ROM.
    Bootrom 1145.3 is burned into the A6 processor.

    The OS is loaded from ROM into RAM
    During system initialization, the bootrom is mapped into address space.
    The VROM, or Virtual Read Only Memory, is said to be the earliest significant code that runs. It is believed to be copied from the bootrom and mapped to an offset. The VROM performs one of two functions: boot the device, or go into DFU Mode.
    As I read this, it indicates to me that the bootrom is not merely mapped into the address space, but shadowed into ram.

    If the bootrom is indeed shadowed, then an attacker with full control over the ram (via hardware) nows owns the machine.

    If the bootrom is not shadowed, then an authentic low-level bootloader would need to be loaded (nominally from flash), decrypted and verified, before an attacker with full control over the ram (via hardware) would then own the machine.

    reply to this | link to this | view in thread ]

  118. identicon
    Anonymous Coward, Feb 27th, 2016 @ 5:46pm

    Re: Re: Re: Re: ...also IOS running entirely in RAM

    an attacker with full control over the ram (via hardware)
    Oh, btw, this looks like a handy place to stash a link to How to Destroy Pandora's iPhone and to note this Chipworks Whitepaper:
    Functional analysis entails system monitoring during functional operation. . . . Using the cell phone example once again, the phone can be partially disassembled, but still electrically connected to allow for operation.

    reply to this | link to this | view in thread ]

  119. identicon
    Anonymous Coward, Feb 27th, 2016 @ 6:09pm

    Re: Re: Re: Re:

    What happens if Apple tries it, it fails and corrupts the data?
    You know, if I was NSA, I'd consider providing Apple a cloned copy of the target iPhone, just to see if they could detect the counterfeit.

    That would be one helluva capability, wouldn't it? To be able to create a clone so perfect that the manufacturer doesn't spot it. If I was NSA, I would be absolutely drooling over that capability. Absolutely drooling.

    reply to this | link to this | view in thread ]

  120. identicon
    Anonymous Coward, Feb 27th, 2016 @ 10:03pm

    Re: Re: Re: Re: Re:

    … if I was NSA, I'd consider providing Apple a cloned copy of the target iPhone, just to see if they could detect the counterfeit.
    The San Bernadino incident at the Inland Regional Center took place on Dec 2, 2015. According to the Government's Ex Parte Application, the warrant pursuant to which the phone was seized (exhibit 1) was issued early in the morning of the next day, Dec 3, 2015, 2:27am. While the warrant return in that exhibit is blank, the FBI elsewhere states that the warrant was executed and the phone was seized on Dec 3, 2015, as well.

    The Government's Ex Parte Application, however was not filed until February 16, 2016.

    Seventy-five days.

    About seventy-five days after the phone was seized in a high-priority, high-profile case—a national security investigation of a domestic terrorism incident—the government makes its ex parte application to compel Apple's assistance under the All Writs Act.

    What was the government doing with the phone during those seventy-five days?

    reply to this | link to this | view in thread ]

  121. identicon
    Anonymous Coward, Feb 28th, 2016 @ 8:39am

    Re: Re: Re: Re: Re:

    I'd consider providing Apple a cloned copy of the target iPhone, just to see if they could detect the counterfeit.
    Seventy-five days, of course, is a very long time to be stuck in a holding cell in a customs area.

    But with sufficient practice, it seems likely that the NSA could develop procedures to the point where someone could be held up by customs and separated from their phone for a shorter period. A few hours, or a few days, in lockup, and then apparently released—with a clone of the phone so perfect that the manufacturer wouldn't spot it during a forensic examination.

    And, naturally, it wouldn't have to be customs. Any time any of the authorities could play catch and release with a target of sufficient value.

    More daringly, any time CIA could carry out an evil maid attack.

    The adversary is a major nation-state. The adversary just needs a believable cover story about the ‘unhackable’ iPhone. The adversary just needs people to put their faith in a pin selected from a pinspace with insufficient entropy.

    reply to this | link to this | view in thread ]

  122. identicon
    Anonymous Coward, Feb 29th, 2016 @ 12:14am

    Re: Re: Re: Re: Re:

    Seriously, if you're so angry about the companies who do business on the network and infrastructure you hate so much, why not leave it and go build your own? Right? Because you can't disagree with copyright unless you create something, right?

    reply to this | link to this | view in thread ]

  123. icon
    Mat (profile), Mar 1st, 2016 @ 11:36pm

    Re: Re: Re: Re: Re: Re: Re: Re: ...also IOS running entirely in RAM


    I'm pointing out that booting from external media does not, in general, require running from a ramdisk.

    No, but it -does- require you either can A: Shove everything into ram to run the system (Command.com runs from RAM until you run something else.) or B: Have external media access to load things up from instead of onboard. And B is precluded because that'd require changing data on the phone, which -was- on the list of things they said had to be left alone.) Which makes this ... much more challening.

    reply to this | link to this | view in thread ]

  124. identicon
    Anonymous Coward, Mar 2nd, 2016 @ 8:28am

    Re: Re: Re: Re: Re: Re: Re: Re: Re: ...also IOS running entirely in RAM

    Have external media access to load things up from instead of onboard.
    Why would external media access require changing the data stored in flash?

    I haven't seen a block diagram of this device's architecture. Are you telling me that there's an i/o channel controller and dedicated ram sitting on a bus on the far side of the flash memory? That the application processor and i/o channel controller are mediated only via the flash memory? That would be weird. Very weird. Extremely weird.

    So, again, why would external media access require changing the data stored in flash?

    reply to this | link to this | view in thread ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Use markdown for basic formatting. HTML is no longer supported.
  Save me a cookie
Follow Techdirt
Insider Shop - Show Your Support!

Advertisement
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Advertisement
Report this ad  |  Hide Techdirt ads
Recent Stories
Advertisement
Report this ad  |  Hide Techdirt ads

Close

Email This

This feature is only available to registered users. Register or sign in to use it.