Apple and the FBI are now fighting the iPhone backdoor war on both coasts.
Last week, Magistrate Judge James Orenstein denied the Department of Justice’s request to compel Apple to bypass the passcode of a seized iPhone. Now the DOJ has asked a district court judge to review Orenstein’s decision. Meanwhile, both the DOJ and Apple are preparing for a hearing in California on March 22, over whether or not the technology company should be compelled to build a backdoor for the San Bernardino shooter’s iPhone—a backdoor that, Apple says, would affect all iPhones.
This New York case—involving a low-level meth dealer and an out-of-date iPhone—only resembles the San Bernardino iPhone fight in two respects. One: there’s an iPhone. Two: the government is relying on the All Writs Act—a 1789 statute that gives courts the general authority to issues orders not specified by the law—to compel Apple to extract data from the phone.
Unlike the iPhone in the San Bernardino case, the iPhone in the New York case is a pre-iOS 8 phone, meaning that Apple can assist law enforcement without undermining the security of iPhones everywhere. The immediate stakes in New York are low. If the government gets its way, Apple would be forced to take a few hours of its time to crack the phone of a meth dealer. If Apple wins, the government will have to satisfy itself with the fact that the phone’s owner has, well, already pled guilty. Whatever is on that phone is probably not that exciting.
But because the legal reasoning in both cases is so similar, this seemingly low-stakes case in New York is now part of a high-profile struggle between Apple and the government over the fate of the company’s technology. And even though the DOJ takes care to present the New York case as a “routine application” that neither forces decryption nor seeks to build a backdoor, the government’s brief is full of dangerous arguments with implications for not only the San Bernardino case, but for the future of digital privacy far down the line.
The government frames the iPhone’s design capabilities as “obstruction” of a search warrant, and uses the iOS software licensing agreement to argue that Apple is vulnerable to an order under the All Writs Act. And after that, the DOJ argues that the court cannot deny the order for fear of opening the “floodgates,” and is not entitled to speculate about future harms down the line. In other words, after making arguments that have big-picture implications, the government says the big picture is irrelevant.
Both DOJ and Apple are fighting an unprecedented battle using novel arguments. The big picture is everything.
The thing is, when the DOJ characterizes the New York case as “routine,” it isn't off-base. Even if Apple now objects to the DOJ’s arguments in New York, the simple fact is that Apple has, in the past, readily complied with similar orders. And this is because the phone in the San Bernardino case, and the phone in the New York case, are running two different versions of iOS that—for privacy purposes—might as well be night and day.
A Tale of Two iPhones
In the New York case, the DEA got a warrant to search the iPhone of Jun Feng (also known as “Kevin”), who later pled to conspiring to distribute methamphetamine. But Feng says he forgot the passcode to the phone, so the government turned to Apple for help.
Apple has a history of helping law enforcement, especially with the particular issue here—so much so that it provides the government with a FAQ on “Extracting Data from Passcode Locked iOS Devices.”
The DOJ’s brief cites three separate instances—two child exploitation cases and one narcotics trafficking case—in which Apple bypassed the passcode of an iPhone and extracted data for law enforcement. And in fact, says the Department of Justice, “the government is not aware of any instances prior to this case in which Apple objected to such an order; indeed, Apple routinely complied with such orders.”
The burden on Apple in the New York case is much less than the burden on them in the San Bernardino case. According to the DOJ, an Apple data extract specialist told them that upon receipt of the court order, “we can schedule the extraction date within a 1-2 week time frame.” The actual extraction, says the DOJ, could be done “in as little as one day.” In a hearing before Magistrate Judge Orenstein, an attorney for Apple said that it would take “several hours.”
Compare this to the request in the San Bernardino case, where Apple says that fulfilling the government’s demands would take six to ten engineers somewhere between two and four weeks.
From either a technical or a pragmatic perspective, these two cases are nothing like each other. The San Bernardino iPhone (a 5c running iOS 9) is part of a later generation of phones with security settings that are so strong that that law enforcement has decried Apple for allowing criminals to “go dark”—that is, to become unsurveillable. The New York iPhone (a 5s running iOS 7), on the other hand, is running an outdated operating system without the same level of security.
Even though the phones are different, the cases turn on the same legal reasoning: the government claims that under the All Writs Act, it can compel Apple to help them to break their own phones.
Magistrate Judge Orenstein’s opinion in the New York case fleshes out the primary argument that Apple is using in its San Bernardino case: that the All Writs Act can’t be used to force Apple to assist the government, because another law, the Communications Assistance for Law Enforcement Act (CALEA) is a “comprehensive statutory scheme” that excludes the use of the All Writs Act in this area.
In other words, if Congress wanted the FBI to be able to force Apple to help them, they would have written it into CALEA. Since Congress didn’t, the FBI is out of luck.
An Outdated Law
The government disagrees with this characterization of CALEA, saying, “this piecemeal legislation indicates Congress’s incremental approach to legislating in this area, rather than Congress’s intent to comprehensively legislate.”
This is just a nice way of saying Congress is really behind the times. And the DOJ has a point: CALEA was passed in 1994. The other possibly applicable statute, the Electronic Communications Privacy Act (ECPA), was passed in 1986. There’s often talk of updating both CALEA and ECPA. And while ECPA reform really might be happening soon, that’s “soon” the way that Frank Ocean’s new album is coming out “soon.”
From the government’s perspective, then, the All Writs Act is necessary to keep up with the rapid change of technology. The problem is that what that entails.
A protester holding a poster during a February 23 rally outside Apple's 5th Avenue Apple Store in New York. Image: Pacific Press
The Government Calls Apple’s Software “Obstruction”
In the New York case, the DOJ is not seeking forced decryption or the building of a backdoor. Its lawyers are being truthful when they say that “granting the application will not affect the technological security of any Apple iPhone nor hand the government a ‘master key.’”
But at the same time, an important part of the government’s argument is that “Apple’s property […] continues to obstruct the investigation,” and that “Apple’s exclusive control over the software that can run on the phone, including its auto-erase feature, is the technological equivalent to barring the door,” thereby preventing law enforcement from executing a warrant.
In other words, one might say, Apple’s technological design is the obstruction of justice.
This has obvious implications for the FBI’s request for a backdoor in the San Bernardino case. If a design feature is obstruction, then the government has the right to dictate design. And this “obstruction” talk isn’t just a couple of flyaway lines. The claim that the iPhone’s very design is “obstructing” law enforcement is key to the government’s most important argument.
Relying on US v. New York Telephone
The All Writs Act has been around for over two hundred years, but there are only a handful of binding cases that are relevant to Apple’s situation. The DOJ’s favorite is US v. New York Telephone Co., where the government sought an order compelling a telephone company to assist law enforcement in setting up pen registers (devices that record what telephone numbers are called from a particular line).
New York Telephone Company, like Apple today, was taking a principled stance against “the danger of indiscriminate invasions of privacy.” Even if the government had a lawful order to use pen registers, surely that didn’t mean an innocent third party like New York Telephone Company could be forced to help the police surveil the company’s customers?
As it turned out, it did mean that. The Supreme Court held that this was an allowed use of the All Writs Act, and New York Telephone Company was forced to help law enforcement surveil its customers. It’s no wonder that the government loves this case, and has cited its three-factor test in both its San Bernardino brief and its brief appealing Magistrate Judge Orenstein’s decision.
There’s only one problem. There is no three-factor test in US v. New York Telephone Company.
The three-factor test that the government likes to cite is conjured up out of a jumble of justifications inside of a run-on paragraph. You could argue it’s three factors, or maybe four, or even five. The point is, NY Telephone isn’t as easy to apply as the government makes it out to be. Everyone in the Apple case is playing in uncharted waters.
But assuming, for the sake of argument, that the government’s three-part test is actually real, the factors are as follows:
·The third party (Apple) has to be not “so far removed from the underlying controversy that its assistance could not be permissibly compelled.”
·The order can’t place an unreasonable burden on the company.
·The assistance of the company must be necessary to achieve the purpose of the warrant.
It’s the first factor—the requirement that Apple be not “so far removed from the underlying controversy”—that brings up a lot of the stranger arguments from the DOJ. The phrase can be more or less boiled down to, “not totally irrelevant to the crime”—something less than innocent. But what does a phone manufacturer headquartered in Cupertino have to do with a street-level drug offense in Queens? Really not much. In Judge Orenstein’s words,
Apple had no involvement in Feng's crime, and it has taken no affirmative action to thwart the government's investigation of that crime . . . Apple lawfully sold to Feng, as it sells to millions of law-abiding individuals and entities (including the government itself), a product that can effectively secure its stored data for the protection of its owner.
In order to counter Orenstein, the DOJ has to turn to two related arguments, each being incredibly dangerous. The first—described above—is that Apple’s software “obstructs” law enforcement. The word “obstruct” is key in the NY Telephone case, used to describe the effects of New York Telephone Company’s noncompliance. In this case, Apple’s own design decisions are being described as obstructions. The privacy settings that Apple builds into phones make Apple into something other than innocent and irrelevant. “Feng used Apple’s property—the software on the phone—to commit and conceal his crimes,” wrote the Department of Justice in their brief.
And if that’s not weird enough, there’s a second, even more bizarre argument. The government claims that Apple’s own software licensing agreement makes Apple “not so far removed from the underlying controversy.” That is, because Apple licenses iOS, the government is now being thwarted by Apple’s “property,” and this too makes Apple not-irrelevant in a drug trafficking case.
FBI Director James Comey testifies before a House Judiciary Committee Hearing on Apple's denial of the FBI's request to provide a way to hack into one of the San Bernardino terrorists phones at the Capitol in Washington, USA on March 1, 2016. Image: Samuel Corum/Anadolu Agency/Getty Images
From Software Licenses to Warrants
The Department of Justice’s argument isn’t exactly meritless. Apple designed, and to some degree, still controls, the software that is making it hard to access user data. But software licenses have nothing to do with that. By using the language of intellectual property, the DOJ is opening the door to something bizarre.
The effect that the DOJ is trying to point to is Apple’s technological “walled garden.” Since Apple maintains tight control over the walled garden, how can it purport to give users autonomy through security? When does a phone belong to the user, and when does it belong to Apple? When it suits Apple, it seems.
The government’s new brief randomly cites back to a filing in a 2009 DMCA rulemaking cycle, where Apple opposed a proposed exemption for the unlocking and jailbreaking of iPhones. It’s not a very useful citation—it really just sits there as if to mock the company for its hypocrisy. There’s added irony in the fact that this exemption was proposed by the Electronic Frontier Foundation, now a staunch supporter of Apple in its fight with the DOJ.
There’s something sadly ironic about Apple’s resistance towards cellphone unlocking and jailbreaking when held up against its quest to give users enhanced privacy protections because “we believe the contents of your iPhone are none of our business.”
But irony isn’t a legal argument, and the copyright status of iOS is completely irrelevant to the All Writs Act. Furthermore, arguing otherwise automatically opens the door to a wide array of government surveillance.
Orenstein pointed out in a footnote to his own opinion that licensed software was now appearing more frequently in all kinds of consumer goods, meaning that if the government was right, any device could be used for surveillance.
“In a world in which so many devices, not just smartphones, will be connected to the Internet of Things, the government's theory that a licensing agreement allows it to compel the manufacturers of such products to help it surveil the products’ users will result in a virtually limitless expansion of the government's legal authority to surreptitiously intrude on personal privacy," he wrote.
It’s surprising that the government would continue to pursue this line of reasoning after the Orenstein opinion, since it was always one of its strangest arguments. But the DOJ hasn’t just kept with it, it's doubled down. It’s obvious how this kind of reasoning could be disastrous for digital privacy in the future. If a restrictive software license makes a tech company vulnerable to the All Writs Act, then no tech company—and no tech user—can escape.
Shorter DOJ: Please Don’t Look At the Big Picture
The DOJ calls the New York case “a routine application,” and wants to narrow the focus down to a single passcode-protected iPhone that Apple can easily break into. While it’s true that the government request in the New York case is nowhere near the magnitude of the request in the San Bernardino case, these two cases simply cannot be separated from each other. Both DOJ and Apple are fighting an unprecedented battle using novel arguments. The big picture is everything.
But the Department of Justice doesn’t want the court to look at the big picture. The DOJ, in its brief, says that “much of Judge Orenstein’s reasoning appears to be driven by a forward-looking concern for preventing future government abuse.” But rather than assuaging such concerns, the government closes its brief by saying that it’s not up to the courts to rely on “speculation about future harm.”
Indeed, instead of taking pains to assure the court that the “floodgates” won’t open, the DOJ suggests that courts aren’t allowed to consider a slippery slope argument—that is, that granting this one order will lead to or encourage the widespread use of the All Writs Act to compel technology companies to proactively aid law enforcement.
It’s a pretty awkward finish to its arguments, but of course, from the DOJ’s perspective, the floodgates have long been open. Apple didn’t protest any of its All Writs Act orders until Orenstein pushed the issue in October, and then again in the San Bernardino case in February.
Until Orenstein asked Apple in October 2015 to brief the court on whether assistance was “feasible,” Apple seems to have had no intention of fighting the DOJ over Jun Feng’s phone. If it hadn’t landed in front of Orenstein, the government’s application would have likely been rubber-stamped, and Apple would have handed the DOJ a thumb drive within that 1-2 week window it promised. No one would have taken any notice.
Once Orenstein asked Apple to chime in, Apple went ahead and fought the DOJ—but the company had to be coaxed into it, filing one brief limited to technical questions, and then filing a supplemental brief when Orenstein responded with, “In inviting Apple, Inc. to submit its views on the feasibility and burdensomeness of the government's request, I did not intend to limit its submission to those matters … I therefore respectfully invite Apple to supplement its submission by addressing the legal question before the court; namely, whether the All Writs Act empowers the court to compel Apple to provide the technical assistance the government seeks.”
This wasn’t the fight Apple was looking for. The company was biding its time, waiting for a case like San Bernardino, where the government would try to use the All Writs Act on an iPhone running iOS 8 or later—a phone built to “go dark.” And even though the facts surrounding the San Bernardino case are the worst imaginable, it’s this case that Apple is throwing its weight behind—because the phone in this case runs the right iOS.
Orenstein handed Apple a victory in New York, but it’s an awkward one. The magistrate judge wrote an opinion geared towards the San Bernardino iPhone and the future dangers of the All Writs Act, but the only iPhone he was asked to look at was an old, outdated one that Apple could have easily cracked.
Orenstein has given Apple all the right arguments, but for the wrong phone. Whether that will get his ruling overturned remains to be seen.