Diplo’s webinar on the Apple-FBI case, on 17 March (watch the recording), evolved into a Socratic dialogue on the core concepts and underlying assumptions of the case. The lively debate inspired us to create a series of posts that argue the main dilemmas, played out by three fictitious characters, Privarius, Securium, and Commercias. The first starts with the main facts.
The Apple-FBI case triggered so many questions for which we do not have ‘correct’ or clear answers. Responses often trigger new questions. Join us in the debate with your comments and questions.
Securium: Everyone is talking about it! The 16 February ruling, by a US federal judge in Riverside, California, which ordered Apple to assist the FBI in unlocking an iPhone, triggered a global debate. The iPhone is not just any phone: it belongs to one of the attackers who killed 14 people in San Bernardino in December 2015.
Commercias: A global debate indeed. Especially after Apple’s strong reaction. Declaring opposition to the order, Apple is arguing that by complying with the request, it would only create a dangerous precedent and would seriously undermine the privacy and security of its users. Other technology companies (such as Microsoft, Amazon, Google Facebook, and Twitter), as well as civil rights activists, have expressed support for Apple.
Privarius: Activists are also involved in this debate. The ruling, and the eventual outcome, can have very serious implications and repercussions. Encryption is a strong safeguard, and companies should not be made to weaken the security of their own products. Decryption should not be allowed.
Securium: Is it for companies to decide? US President Barack Obama has already objected to the creation of undecryptable black boxes, stating the need for a balance between security and privacy that would enable law enforcement authorities to continue doing their job. The outcome of this case is still unclear.
Commercias: Unclear indeed. Today’s court hearing was postponed, as the FBI said it may have found a way to unlock the phone without Apple's assistance…
Privarius: This particular case may be nearing an end, but the main issues remain open. For example, how can there possibly be a balance between privacy and security if phones are rendered decryptable? After the Snowden revelations, it became clear that we can no longer completely rely on government agencies in ensuring our privacy, which is now in the hands of technology companies.
Commercias: Even the UN High Commissioner for Human Rights issued a statement, asking the US authorities to proceed with caution, as the case 'could have extremely damaging implications for the human rights of many millions of people, including their physical and financial security’. The UN Special Rapporteur for freedom of expression also asked for caution, noting that the FBI request risks violating the International Covenant on Civil and Political Rights.
Securium: Whatever the outcomes will be, one thing is clear: even if a solution may have been found today, this does not solve the main dilemmas. So let’s see what the issues at stake are, starting with security...
The next post - published next Thursday, 24th March - tackles the security aspect.
II. Apple vs FBI: It’s just one phone - or is it?
Commercias: ...If Apple were to help the FBI unlock this one phone, in adherence to the court order, other courts in the USA and elsewhere are likely to issue similar requests for future cases.
Securium: Isn’t this farfetched? The FBI’s requests are about one single iPhone: ‘... The Court’s order is modest. It applies to a single iPhone, and it allows Apple to decide the least burdensome means of complying. As Apple well knows, the Order does not compel it to unlock other iPhones or to give the government a universal “master key” or “back door”.’
Commercias: The order may not be referring to other phones, but if we take a look around us, we can see, for example, that the Manhattan district attorney has already indicated that there are currently 175 iPhones which investigators could not unlock, and he further confirmed that he would want access to all phones which are part of a criminal investigation, should the government prevail in the San Bernardino case. Apple is very likely to be compelled to use this technique to unlock iPhones in police custody all over America and beyond. Apple's attorneys reported a list of nine other cases involving 12 different iPhones of different models that law-enforcement authorities had asked Apple to help crack, and none of them involved terrorism. We cannot run this risk.
Privarius: Apple needs to create new software to open this phone, and this software could potentially unlock any iPhone. There is no guarantee that the FBI will not use this software - or master key - again, and if it falls into the wrong hands, the software can be misused by third parties. One case will be followed by another and there won’t be an end.
Securium: We should focus on the case at hand. The order is a targeted one ‘that will produce a narrow, targeted piece of software capable of running on just one iPhone, in the security of Apple’s corporate headquarters. That iPhone belongs to the County of San Bernardino, which has consented to its being searched.’ We must also not forget that the phone was used by a terrorist who took innocent lives. Crucial information surrounding the case may be stored on this device. With this fact in mind, the court order is pretty reasonable!
Commercias: No, the fact that the court issued an order doesn’t necessarily mean it is reasonable. The fact is that Apple has been assisting the FBI in cases before this as well as in this one particularly - it has provided the backup of the phone stored within the iCloud (though, unfortunately, the last backup doesn’t contain the most recent files from the day of the shooting). The Internet industry has always been cooperative when court orders were issued (even without the court order, as we learned from Snowden). This time, what the court is requesting has crossed the line.
Securium: There are no red lines when it comes to protecting users and citizens worldwide.
Commercias: There are. The company has been asked to decrease its security level - which by the way is its corporate advantage - which helps keep users secure. If the court forces Apple to make a patch, this would reduce the security level of its system. And although the FBI has asked Apple to unlock only one iPhone, this might not be possible without affecting the privacy of all other iPhones, making them less secure in the process. Besides, do you really think that the FBI won’t use this ‘back door’? Once the privacy door is open, it will never be closed.
Securium: It is speculation. Let us not be abstract. Why would other phones be endangered?
Commercias: Technically speaking, Apple would need to create a software patch to its iOS, and install it in this particular phone. It is likely this could also be done within Apple’s headquarters, with the FBI accessing only this particular phone (even remotely) and without the chance to reach out to the particular software patch. However, since the phone needs to be handed over to investigators, there is a possibility of it being reverse-engineered. In addition, misuses and abuses cannot be fully controlled once the firmware is out.
Privarius: But let’s say, Apple creates a software patch to unlock the phone: authorities may still submit requests for hundreds of other phones to be unlocked, and requests could possibly come from other jurisdictions. In this case, Apple would need to have its teams constantly available. Moreover, future versions of the iOS would also need to have an updated patch. Ultimately, Apple might find it easier and cheaper to simply develop a real backdoor in its products, or to give up on the stronger security-by-design approach.
Securium: On the other hand, if Apple wins this court case - if the case is resumed - it can create a new precedent.
Privarius:... and a major win for privacy!
III. Apple vs FBI: A case for encryption
Commercias: ...A win for Apple - among other issues - is also a win for privacy...
Privarius: The question is, can Apple damage privacy by claiming to protect it? In making extreme claims, they could be pushing the pendulum too far, and risk provoking a counter-reaction by endangering privacy protection. As President Obama recently said at a South by Southwest (SXSW) conference, ‘after something really bad happens, the politics of this will swing and it will become sloppy and rushed and it will go through Congress in ways that are dangerous and not thought through.’
Commercias: On the other hand, we may say that it was the FBI who was, in fact, pushing too much. Apple and similar companies have cooperated by giving investigators all the data they have about the suspects; yet the FBI is asking them to go an extra step, and in the process, weaken the products’ encryption. The fact is that the FBI has already acquired large amounts of evidence about this case thanks to digital forensics and the support of the Internet industry (including Apple). Today, a user’s digital communications is not only saved on his/her phone, but is stored in the cloud by service providers such as Facebook or Google, which readily cooperate with the FBI to provide the data its investigators need.
Privarius: This also raises several questions: Was there really such a need to break into the phone? Does this justify setting a precedent? Is the benefit of this request proportional to its consequences?
Commercias: Furthermore, security experts such as the former US anti-terror chief claim that the FBI could have turned to the NSA for help, since this case may be related to terrorism; it is likely that the NSA has advanced techniques that can break the code. This can lead us to conclude that there might not have been a real need for the FBI to push Apple; yet the FBI chose a case linked to terrorism to push its limits and try to set a precedent.
Privarius: One positive aspect, if you may, is that as a result, encryption technology is flourishing. There are dozens of unbreakable encryption applications online, readily available mostly for free. There are complete solutions, integrating hardware, OS, and software. More importantly, hardware development has led to the creation of motherboard chips, such as Intel’s SGX, that incorporates encryption within a silicon wafer; this chip will soon become a common feature in products, with little possibility (if any) for anyone to unlock it with the use of any software or hardware patch. The outcome will affect how users choose their products, and may lead them to switch to other products with tighter encryption, or to install their own encryption software. This will leave law enforcement with even less control.
Commercias: But even with less control, law enforcement agencies may still be able to carry out their investigations without breaking encrypted communications - such as by using metadata, digital forensics, offline means, etc - right?
Privarius: Yes, they can. While there is little evidence on the usefulness of meta-data (zero success according to NSA) or access to encryption materials in preventing terrorist attacks (prior to the Paris attack, terrorists used unencrypted SMS), most criminal cases now require digital forensics as a critical part of the investigations. I would however distinguish between surveillance for national security purposes and to combat terrorism, from digital forensics for combatting crime (and not only cybercrime).
Commercias: True. Law enforcement has many digital forensics tools available at their disposal. I would add geolocation, data from telecom companies, and access to service providers’ cloud storage through court orders and other legal means. Besides, recent research (such as that by the Berkman Center) foresees that cyberspace is unlikely to ‘go dark’, for many reasons, and there will still be many sources for digital evidence without the need to break into encrypted spaces. Which would mean that Apple can retain its strong stand over privacy. …
IV. Apple vs FBI: A matter of trust
Commercias: In the past few days we saw how the situation took a surprising U-turn when the FBI announced it may have found a way to unlock the phone without Apple's assistance. In a way, it seems that Apple has managed to stand its ground so far.
Securium: Let’s face it though, has Apple really been advocating for the rights of its users, or is this more of a business strategy through which it has tried to regain the users’ trust?
Privarius: While it looks like Apple is in fact supporting privacy, we must not forget that companies are primarily driven by commercial interests. Many - including the FBI - have argued that Apple’s position is more about its business model than the protection of human rights.
Commercias: Even if companies have commercial interests, they can still work hard to protect human rights, including privacy.
Privarius: True. But can we expect businesses to always serve the good cause? Will the protection of human rights always fit into their model, and what if profits drive them to support other causes?
Commercias: It is also a matter of trust. If we look at the Internet business model, we realise how important users’ trust is. Arguably, obeying the court order may lead to diminished trust in Apple, and could provide a market advantage to other products offering strong built-in encryption solutions.
Privarius: So perhaps, if we had to identify Apple’s position in the triangular model, we might say that Apple is both a vendor (selling tech products), and an intermediary (storing users’ data).
Commercias: Indeed. This is probably why Apple took such a strong position in challenging the authorities. Apple’s business model could be seen a somewhat more diverse than, for example, that of Google, Facebook and Twitter, which depend heavily on data. The data-driven Internet industry is quite vulnerable to major policy ‘earthquakes’, such as the Snowden revelations, or the ongoing Apple/FBI controversy. Microsoft is another company that challenged the US authorities (court case on authority over data in Ireland). Just like Apple, Microsoft has a more diverse business model than typical Internet industry companies.
Privarius: And yet, if Apple loses this case, it will further erode the users’ trust in companies too, and not just the security sector. As Edward Snowden tweeted recently: 'The @FBI is creating a world where citizens rely on #Apple to defend their rights, rather than the other way around.'
Securium: As a result, users will try to find their own ways to protect themselves - through alternative and niche products, online software, etc. In such an environment, only the more skillful citizens will be more protected, while less skillful users will be additionally endangered by criminals and terrorists, which are becoming more and more tech-savvy. We should rather aim to have a minimum level of security for everyone, and to achieve this, end users should not be left to protect themselves through the use of cipher protection….
Privarius: And yet, if governments cannot protect the security and human rights of its citizens - which is the basis of any social contract - citizens should be allowed to protect themselves.
Commercias: Exactly… In real-life, by using guns; in cyberspace by using cipher protection. This is interesting: gun lobbyists and cipher-enthusiasts may share an underlying logic for their actions.
Privarius: The analogy with guns is incorrect; encryption protects, it doesn’t cause damage to others. Connected devices - computers, smartphones, tablets - can do both. Encryption prevents criminals from misusing users’ computers (90% of attacks are based on social engineering, using access to private data to fine-tune and adjust the attacks for phishing or spear-phishing). Encryption also strengthens the security of protocols and online communications in general, making attacks such as ‘man in the middle’ attacks much harder. Not to mention that encryption can save lives - as the UN Commissioner for Human Rights rightly mentioned - lives of activists, journalists, and whistleblowers around the world. Rather than reducing the levels of cybercrime by weakening encryption, the security community needs to look into how encryption can contribute to a more secure Internet...
Securium: Or maybe, we should let the courts decide on the next steps. ...
V. Apple vs FBI: Towards an Internet social contract?
Securium: Until last week, everyone was thinking that if Apple won this court case it would create a new precedent. For the time being, it seems like the case has been resolved, since the US Department of Justice has just declared it is now able to unlock the iPhone thanks to the assistance of a third party.
Privarius: Although it seems the case is settled, the main dilemmas have not yet been resolved. Whether this will happen immediately, or in the near future, society may eventually need to make some hard choices regarding privacy and security, among others, and gradually create new models of consensus. [Read the editorial, on page 3, of Issue 8 of the Geneva Digital Watch newsletter]
Commercias: Even if the recent developments have shown that the government did manage to unlock the phone, a new social contract could tackle one of the essential arguments in the debate: whether devices should be impermeable, or ‘undecryptable’. This may be the only way to keep them safe from intrusion from both criminals and authorities.
Securium: It is not the only way. Let us take a hypothetical situation: assuming that unlocking a mobile phone is essential to preventing a nuclear attack and saving many lives, would you argue that the privacy of a mobile phone user is more important that the survival of innocent people?
Privarius: Well, it is an abstract and unrealistic situation.
Securium: We can argue at length as to whether this is possible or probable. The point is that the principle of undecryptability of mobile devices creates an important implicit decision: that of placing privacy above other human rights or security considerations...
Privarius: I still do not think this is a dangerous risk; on the other hand, allowing access to this specific mobile and setting a dangerous precedent is a very concrete risk. If Apple gives in now, how can it resist future demands from the USA and abroad?
Securium: In the USA, had the case gone forward, it would have been decided either by the courts (setting a precedent) or by Congress. Either way, the US legislative framework would have been determinative. The democratic system preserves security by allowing judicial authorities to issue orders that weaken privacy protections. President Obama was right in objecting to the creation of undecryptable black boxes. It is, after all, what happens in the offline world, when law enforcement agencies obtain the right to enter private property as part of investigations, for example.
Privarius: The difference is that online or data searches can be automated, and it is easy to imagine searches being implemented without due process. It is simply not the same as physically knocking on 100 doors.
Commercias: More importantly, if Apple or any other company had to create a patch to break into a phone, what is the likelihood that criminals would not try to gain access or exploit any vulnerabilities? Equally important is the fact that the legal basis for FBI’s request and the Court order is uncertain and has been widely disputed - which proves that there is no political or social agreement, as yet, on how to deal with this and similar cases that may come up...