The ongoing debate surrounding digital privacy and national security is set to erupt into a high-profile legal battle between Apple and the federal government. In an order issued on February 16th, a federal judge ruled that Apple must create new software that would bypass security features on the iPhone used by San Bernadino shooter, Syed Riswan Farook. Apple CEO Tim Cook has announced that he will contest the order, arguing that it represents an overreach by the federal government and an unjustified intrusion into the privacy of Apple’s customers.
Apple’s Encryption System
In September 2014, Apple introduced new encryption software to the iPhone operating system, largely in response to increased digital privacy concerns following revelations from former NSA contractor, Edward Snowden. Models of the iPhone 5c onwards allow users to activate a security feature that permanently encrypts the data on their phone after ten failed attempts to enter the passcode. When data is permanently encrypted, it is no longer accessible and effectively useless. This self-encryption feature makes it virtually impossible to break into a phone using a “brute-force attack”—a trial and error method of decryption where a computer program attempts tens of millions of combinations—without risking deletion of the data.
However, while the iPhone data is encrypted, the software that runs the phone is not. This means that it is possible to create a hacked version of the operating system and install it on a phone without consent of the phone’s owner and without entering the passcode. If Apple were to write a version of the iPhone software without the self-encrypting feature and install it on a device, it would be possible to unlock the phone using brute force to guess the passcode.
The Recent Court Order
On February 16th, federal magistrate judge Sheri Pym issued an order compelling Apple to build a version of the iPhone software without the self-encrypting feature. She also ordered Apple to disable another security feature that adds a delay after multiple incorrect passcode entries. Since a four-digit passcode has only approximately 10,000 possible combinations, the altered software would allow a powerful computer to unlock Farook’s phone relatively quickly.
In issuing the order, the court cited a 227-year old law called the “All Writs Act.” The act, originally part of the Judiciary Act of 1789 and signed by President George Washington himself, essentially allows federal judges to issue “writs,” or court orders, on certain matters about which Congress has been silent. It has been described as a “gap filler” for issues that Congress has not addressed. At one point in history, writs were relatively common, but now courts tend to use them only in extraordinary circumstances where no other laws apply to the situation at hand. In this case, the lack of legislation regarding encryption allows the government to invoke the Act. The entire text of the Act reads as follows:
(1) The Supreme Court and all courts established by Act of Congress may issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.
(2) An alternative writ or rule nisi may be issued by a justice or judge of a court which has jurisdiction.
The All Writs Act has been used to justify various government actions compelling telephone companies to install wiretaps, phone companies to produce call records, and to obtain CCTV footage, handwriting exemplars, and DNA samples. To support its application to the federal court, the government primarily relied on a 1977 Supreme Court decision, United States v. New York Telephone Company, in which a telephone company was required to comply with a gambling investigation by implementing a pen register and trap and trace device, before Congress had passed a law that specifically authorized pen registers by court order.
On the same day the order was issued, Apple CEO Tim Cook published an open letter to the company’s customers calling the order a “dangerous precedent.” He wrote that Apple would contest the order in court, stating that “while we believe the FBI’s intentions are good, it would be wrong for the government to force us to build a backdoor into our products. And ultimately, we fear that this demand would undermine the very freedoms and liberty our government is meant to protect.”
While the government argues that the new software would only be used on the Farook phone, Apple emphasizes in its letter that the technology could be used over and over again on any number of devices. Cook states that creating the software would “undermine decades of security advancements that protect [Apple] customers –including tens of millions of American citizens—from sophisticated hackers and cybercriminals.”
What happens next?
On Tuesday, Apple’s legal chief Bruce Sewell and FBI director James Comey both testified at a U.S. Congressional Hearing on encryption issues. Members of the Judiciary Committee called the hearing in order to learn more from both sides of the dispute.
Apple has also filed an official motion to vacate the federal court’s order. The filing states that “this is not a case about one isolated iPhone” and that the FBI seeks a “dangerous power” that would undermine the security and privacy interest of hundreds of millions of people. Apple also argues that the All Writs Act does not give the government “unlimited and sweeping use of the judicial process” and that the FBI’s demand for a new software would violate its First and Fifth Amendment rights, as it is the equivalent of compelled speech and is contrary to Apple’s core principles. Lastly, it points to the Communications Assistance for Law Enforcement Act as evidence that Congress limited the assistance companies must provide to law enforcement.
The civil liberties implications of this case are huge. Washington and Silicon Valley have been embroiled in an ongoing encryption/backdoor debate for the last two years, and this is one of several pending cases regarding similar privacy and security concerns. A ruling in DOJ’s favor may direct the law to a point where every digital interaction is theoretically within the reach of the federal government. Other tech companies have recognized this possibility and backed Apple in recent weeks. Apple has also expressed the concern that if it can be compelled to create software for the U.S. government, there is a possibility that it would have to do the same for other governments as well. On the other hand, a favorable ruling for Apple could set substantial limits on the ability of the government to erode digital privacy in the name of national security and public safety.
Having submitted its official opposition, Apple must now wait to hear back from the courts. If its motion to vacate is denied by the district court, Cook has pledged to take the fight all the way to the Supreme Court.