FBI Director Comments on San Bernardino Matter

I think you're applying some fairly strict high-mindedness to the US legal system while others (myself included) worry that creative extension of intent appears rampant in cases that touch on technology or terrorism and therefore fall into your second form. Many of us don't, as a general rule, trust the courts, law enforcement, or our government to do anything but what is politically expedient and beneficial to them at the moment.

While the wording of this ruling is about one phone and a particular method the FBI has laid out, it appears to set precedent that law enforcement can compel a product company create a non-existent product (no matter how trivial) in order to exploit a known security vulnerability in one of their products. This is what concerns me and many others, because it brings us very short steps away from "make us a version that works against the Secure Enclave" to "make it work as an OTA update over WiFi" to then "make it work as an OTA update over cellular" and subsequently "make a version we can incorporate into a StingRay" and forward. None of these would be illogical steps to take in abject pursuit of stamping out terrorism and might even applauded by parts of society, but taken as what some perceive as an inevitable whole they paint a dim picture for personal privacy.

It's an improbable coincidence that the FBI has elected this particular charged case in which to stake their flag. Given their pleas with technology companies for cooperation over bypassing cryptography in recent months, this appears to be a logical continuation of that campaign.

In conclusion, we likely disagree, specifically due to my cynicism and your seeming lack thereof.

My main point related to this was above:

>The only concern would seem to be if the future court fails to analyse a case properly. But they can fail regardless of what precedent is or is not set.

To argue against that, you'd need to claim that precedent makes it easier for the later court to fail. Do you have examples, where it should have been clear that precedent didn't apply, yet the court reached the conclusion that it did, incorrectly?

(Preferably in important cases.)

>While the wording of this ruling is about one phone and a particular method the FBI has laid out, it appears to set precedent that law enforcement can compel a product company create a non-existent product (no matter how trivial) in order to exploit a known security vulnerability in one of their products.

I've said elsewhere that this argument seems to be useless. If Apple says it's "unreasonable" to expect them to do this, then they might be forced to hand over the source code, and the FBI will create it themself. The problem is

1. iOS is closed source and

2. iPhone requires a signature from Apple

If Apple doesn't help them, they could conceivably be forced to simply hand the keys and code over. It's a benefit to Apple to be able to create it themselves and maintain control over the keys.

>This is what concerns me and many others, because it brings us very short steps away from "make us a version that works against the Secure Enclave" to "make it work as an OTA update over WiFi" to then "make it work as an OTA update over cellular"

All of these seem fine, assuming that Apple is not modifying the phones to make it easier to hack. In other words, I agree that they follow as direct precedent from this case. (Although they can decide to only update a phone after a proper warrant.)

>make a version we can incorporate into a StingRay

This is the part that doesn't follow from precedent. Giving over control of the tool to the FBI who could use it without a warrant is novel, and would require a judge to justify it.

>In conclusion, we likely disagree, specifically due to my cynicism and your seeming lack thereof.

Maybe I'm just more cynical than you. You worry about a future court doing the wrong thing because they're misled by precedent here, I'm worried about a future court doing the wrong thing just because. I don't think the risk goes up significantly based on this precedent, because I think it could happen anyway.

>It's an improbable coincidence that the FBI has elected this particular charged case in which to stake their flag. Given their pleas with technology companies for cooperation over bypassing cryptography in recent months, this appears to be a logical continuation of that campaign.

Pure tinfoil material here. Do you know of any cases where the FBI had a phone but didn't try to unlock it, that could be said to be as urgent as this? This isn't the only court case with Apple going on, it's merely the one that got a lot of attention, and certainly much of that attention is Apple's fault (not all, but a lot).

Maybe, but it's fun to discuss, and there are enough of us spread throughout that can educate on this single issue. It's pretty easy for me to explain to my non-tech friends the implications of what the FBI is asking. Word of mouth travels fast and I would give pro-encryption the upper hand in this "debate". I have not heard anyone outside government protesting that Apple yield on this issue and I doubt I will.

In fact, the only ones who speak up against encryption are those who do not listen to the people. Since they're supposed to represent us, they will be very easy to not vote for.

Like you said though, it isn't even a question, encryption is here to stay whether the American government permits it or not. Ironically, by putting up such a fight, the government is simply telling criminals where the weak points are in law enforcement, and are thus empowering criminals.

I hope our government can have a good sit down with tech company leaders and experts in cryptology. Despite Comey's request to have an open discussion, they seem to be excluding this group. It's apparent from his discourse, Hillary's, and Obama's that they've spent no time sincerely listening to anyone with any knowledge about the benefits of encryption. The "conversation" he so desires has only happened in Washington among people with no tech background. Presumably there will be some public hearings coming up.

How? They either need to break the PIN or they need to break the AES256 key that is used to encrypt file metadata.

They cannot use EC2 GPU instances to attack the PIN because the function that derives the AES key from the PIN uses a key that is unique to each phone and not readable by software so they cannot get a hold of it unless they resort to opening the crypto chip and trying to read the key by examining the hardware (and if they do that, they won't need a GPU...any desktop computer would be able to brute force the PIN quickly).

They can use EC2 GPU instances to go after the AES256 key for metadata encryption, but that will take a hell of a lot longer than a decade.