Apple takes a (cautious) stand against opening a killer's iPhone

Two iPhones used by the gunman in a Pensacola, Florida, shooting are the focus of a fight between Apple and the Justice Department. Photo / Getty Images

The Silicon Valley giant is preparing for a legal fight over encryption, even as it works to reduce tensions with the Justice Department.

Apple is privately preparing for a legal fight with the Justice Department to defend encryption on its iPhones while publicly trying to defuse the dispute, as the technology giant navigates an increasingly tricky line between its customers and the Trump administration.

Timothy D. Cook, Apple's chief executive, has marshalled a handful of top advisers, while Attorney General William Barr has taken aim at the company and asked it to help penetrate two phones used by a gunman in a deadly shooting last month at a naval air station in Pensacola, Florida.

Executives at Apple have been surprised by the case's quick escalation, said people familiar with the company who were not authorised to speak publicly. And there is frustration and scepticism among some on the Apple team working on the issue that the Justice Department hasn't spent enough time trying to get into the iPhones with third-party tools, said one person with knowledge of the matter.

The situation has become a sudden crisis at Apple that pits Cook's long-standing commitment to protecting people's privacy against accusations from the US government that it is putting the public at risk. The case resembles Apple's clash with the FBI in 2016 over another dead gunman's phone, which dragged on for months.

This time, Apple is facing off against the Trump administration, which has been unpredictable. The stakes are high for Cook, who has built an unusual alliance with President Donald Trump that has helped Apple largely avoid damaging tariffs in the trade war with China. That relationship will now be tested as Cook confronts Barr, one of the president's closest allies.

"We are helping Apple all of the time on TRADE and so many other issues, and yet they refuse to unlock phones used by killers, drug dealers and other violent criminal elements," Trump said Tuesday in a post on Twitter. "They will have to step up to the plate and help our great Country."

Apple declined to comment on the issue Tuesday. Late Monday, after Barr had complained that the company had provided no "substantive assistance" in gaining access to the phones used in the Pensacola shooting, Apple said it rejected that characterisation. It added that "encryption is vital to protecting our country and our users' data."

But Apple also offered conciliatory language, in a sign that it did not want the showdown to intensify. The company said it was working with the FBI on the Pensacola case, with its engineers recently holding a call to provide technical assistance.

"We will work tirelessly to help them investigate this tragic attack on our nation," Apple said.

At the heart of the tussle is a debate between Apple and the government over whether security or privacy trumps the other. Apple has said it chooses not to build a "backdoor" way for governments to get into iPhones and to bypass encryption because that would create a slippery slope that could damage people's privacy.

The government has argued it is not up to Apple to choose whether to provide help, as the Fourth Amendment allows the government to violate individual privacy in the interest of public safety. Privacy has never been an absolute right under the Constitution, Barr said in a speech in October.

Cook publicly took a stand on privacy in 2016 when Apple fought a court order from the FBI to open the iPhone of a gunman involved in a San Bernardino, California, mass shooting. The company said it could open the phone in a month, using a team of six to 10 engineers. But in a blistering, 1,100-word letter to Apple customers at the time, Cook warned that creating a way for the authorities to gain access to someone's iPhone "would undermine the very freedoms and liberty our government is meant to protect."

Bruce Sewell, Apple's former general counsel who helped lead the company's response in the San Bernardino case, said in an interview last year that Cook had staked his reputation on the stance. Had Apple's board not agreed with the position, Cook was prepared to resign, Sewell said.

The San Bernardino case was bitterly contested by the government and Apple until a private company came forward with a way to break into the phone. Since then, Cook has made privacy one of Apple's core values. That has set Apple apart from tech giants like Facebook and Google, which have faced scrutiny for vacuuming up people's data to sell ads.

"It's brilliant marketing," Scott Galloway, a New York University marketing professor who has written a book on the tech giants, said of Apple. "They're so concerned with your privacy that they're willing to wave the finger at the FBI."

Cook's small team at Apple is now aiming to steer the current situation toward an outside resolution that doesn't involve the company breaking its own security, even as it prepares for a potential legal battle over the issue, said the people with knowledge of the thinking.

Some of the frustration within Apple over the Justice Department is rooted in how police have previously exploited software flaws to break into iPhones. The Pensacola gunman's phones were an iPhone 5 and an iPhone 7 Plus, according to a person familiar with the investigation who declined to be named because the detail was confidential.

Those phones, released in 2012 and 2016, lack Apple's most sophisticated encryption. The iPhone 5 is even older than the device in the San Bernardino case, which was an iPhone 5C.

Security researchers and a former senior Apple executive who spoke on the condition of anonymity said tools from at least two companies, Cellebrite and Grayshift, have long been able to bypass the encryption on those iPhone models.

Cellebrite said in an email that it helps "thousands of organizations globally to lawfully access and analyze" digital information; it declined to comment on an active investigation. Grayshift declined to comment.

Cellebrite's and Grayshift's tools exploit flaws in iPhone software that let them remove limits on how many passwords can be tried before the device erases its data, the researchers said. Typically, iPhones allow 10 password attempts. The tools then use a so-called brute-force attack, or repeated automated attempts of thousands of passcodes, until one works.

"The iPhone 5 is so old, you are guaranteed that Grayshift and Cellebrite can break into those every bit as easily as Apple could," said Nicholas Weaver, a lecturer at the University of California, Berkeley, who has taught iPhone security.

Chuck Cohen, who recently retired as head of the Indiana State Police's efforts to break into encrypted devices, said his team used a $15,000 device from Grayshift that enabled it to regularly get into iPhones, particularly older ones, though the tool didn't always work.

In the San Bernardino case, the Justice Department's Office of Inspector General later found the FBI had not tried all possible solutions before trying to force Apple to unlock the phone. In the current case, Barr and other Justice Department officials have said they have exhausted all options, though they declined to detail exactly why third-party tools have failed on these phones as the authorities seek to learn if the gunman acted alone or coordinated with others.

"The FBI's technical experts — as well as those consulted outside of the organization — have played an integral role in this investigation," an FBI spokeswoman said. "The consensus was reached, after all efforts to access the shooter's phones had been unsuccessful, that the next step was to reach out to start a conversation with Apple."

Security researchers speculated that in the Pensacola case, the FBI might still be trying a brute-force attack to get into the phones. They said major physical damage may have impeded any third-party tools from opening the devices. The Pensacola gunman had shot the iPhone 7 Plus once and tried destroying the iPhone 5, according to FBI photos.

The FBI said it fixed the iPhones in a lab so that they would turn on, but the authorities still couldn't bypass their encryption. Security researchers and the former Apple executive said any damage that prevented third-party tools from working would also preclude a solution from Apple.

A Justice Department spokeswoman said in an email: "Apple designed these phones and implemented their encryption. It's a simple, 'front-door' request: Will Apple help us get into the shooter's phones or not?"

While Apple has closed loopholes that police have used to break into its devices and resisted some law enforcement requests for access, it has also routinely helped police gain entry to phones in cases that don't require it to break its encryption. Apple has held seminars for police departments on how to quickly get into a suspect's phone, and it has a hotline and dedicated team to aid police in time-sensitive cases.

In the past seven years, Apple has also complied with roughly 127,000 requests from US law enforcement agencies for data stored on its computer servers. Such data is unencrypted and access is possible without a customer's passcode.

In 2016, when the standoff between Apple and the government was at its most acrimonious, Cook said Congress should pass a law to decide the boundaries between public safety and technological security. In court filings, Apple even identified an applicable law, the Communications Assistance for Law Enforcement Act.

On Monday, Barr said the Trump administration had revived talks with Congress to come up with such a law.

Written by: Jack Nicas and Katie Benner
© 2020 THE NEW YORK TIMES