FBI To Apple: “Take Down That Vicious Guard-Door” And Unlock iPhone
In a House Judiciary Committee hearing on privacy, Apple and the FBI squared off again over encrypted data
In the shadow of an ongoing court battle between Apple and the FBI, members of the House Judiciary Committee met on Tuesday for a hearing on encryption, where representatives debated the merits of security measures that have so far foiled investigators in December’s San Bernardino shooting case.
The hearing featured testimony from FBI Director James Comey, Apple general counsel Bruce Sewell, Worcester Polytechnic Institute professor Susan Landau and New York County district attorney Cyrus Vance Jr.
Early in the hearing, members expressed frustration that the FBI appeared to be using its ongoing court case with Apple to make an “end run” on Congress’ prior decisions on law enforcement access to encrypted data.
Representative John Conyers, D-MI, said that it concerned him that “the FBI would ask a federal magistrate to give them the special access to secure products that this committee, this Congress and the administration have so far refused to provide,” and later added that he would be “deeply disappointed” if it was discovered that the the FBI was exploiting a national tragedy in the interest of legislative change.
In February, the FBI sought to compel Apple to provide technical assistance in accessing encrypted data from an iPhone 5c, used by one of the shooters in December’s San Bernardino terrorist attack. Such assistance, Apple has argued, would necessitate the creation of a backdoor in its software that could be exploited by law enforcement—but also criminals—again and again.
Congress has in the past rejected calls to require backdoors in encrypted communications, which Representative and committee chairman Bob Goodlatte, R-VA, argued is “best suited to resolve” this debate.
“We’re essentially asking Apple to take that vicious guard-door away, and let us pick the lock.” — James Comey
The case has prompted a groundswell of both opposition and support, with calls that Congress again examine the alleged challenges posed by encryption in more detail. At the same time, Senate Intelligence Committee members Senator Dianne Feinstein and Senator Robert Burr have argued in recent months that the time for debate has passed, and are already drafting proposed legislation to require companies to provide data for which law enforcement has obtained a search warrant.
During his testimony, Comey rejected Rep. Conyers concerns. Although Comey said Congress had a role to play in privacy legislation, he defended the FBI’s decision to take Apple to court. He also reiterated his previous statements that the FBI’s fight with Apple was not about backdoors or encryption legislation, but merely the one phone in this particular case.
“I hear folks talk about keys, backdoors, but I don’t see that this way,” Comey said. “There’s already a door on that iPhone. We’re essentially asking Apple to take that vicious guard-door away, and let us pick the lock.”
However, in a letter submitted to the committee by the American Civil Liberties Union, national political director Karin Johanson and legislative counsel Neema Singh Guliani argued that the precedent set by an order in the FBI’s favor “could be used to compel other companies to build mechanisms to hack into smart televisions, computers, or even medical devices.”
Over the course of nearly three hours, committee members grilled Comey over the FBI’s case with Apple, and the implications of the assistance the FBI has requested. Comey testified that the FBI had tried other methods of gaining access to the phone, and even sought assistance from the NSA, with no success. He also admitted that “a mistake” was made when the FBI instructed local law enforcement to reset the San Bernardino iPhone’s iCloud password, but disagreed with the suggestion that doing otherwise would have given the FBI the data it sought.
“We would still be in litigation because the experts tell me there was no way we would have gotten all the information from a backup,” Comey said.
But in particular, one question that senators returned to often was whether, if Apple created the software requested by the FBI, it would it be used again to unlock other phones.
Mr. Sewell, in his testimony, said there was no limiting principle in the San Bernardino case, so if created the program could, in theory, be used to unlock any number of phones in law enforcement’s possession. Comey, meanwhile, admitted that it would be up to a judge to decide whether Apple would be permitted to delete that tool after it had been created. He reiterated his position that the threat of such a tool falling into criminal hands was minimal, implying that the FBI is confident that Apple could secure or protect any tool it’s required to create, just as it’s good at securing its phones and data.
Mr. Vance, in his testimony, also argued with the assertion that a backdoor created for the FBI could be abused by others, suggesting “it may be an overstatement to suggest that,” and calling claims about the increased risk posed by backdoors “speculative.”
However, during her testimony during the latter half of the afternoon, academic cryptography expert Susan Landau argued that while she trusts Apple’s security measures, frequent requests that Apple authorize the installation of special software could undermine the foundation of that security. “If you’re dealing with phones that are daily being updated in order to solve law enforcement cases, you get into a routine … and then it becomes a process that’s easy [for criminals] to subvert.”
“You’re not going to like what comes out of Congress.” — Representative Jim Sensenbrenner
When asked how many phones the FBI had in its possession that they were waiting to be unlocked, Comey could only offer “a lot.” Vance, in his testimony, said that his office alone had 205 iPhones that it could not unlock, and named other districts that shared his frustrations.
Landau argued that, rather than seek court-ordered technical assistance or encryption legislation, the FBI needs an advanced team that can “develop the surveillance technologies themselves” but not ask the technology companies to weaken their security to do so. And yet, both Representatives Jim Sensenbrenner, R-WI, and Trey Gowdy, R-S.C., grilled the company’s general counsel for not offering legislative proposals or suggestions of what Apple would support, and focusing only what it doesn’t like.
Sewell maintained that, rather than have Apple craft proposals, the company would prefer a more formal Congressional debate—”an appropriate and fair hearing” with the “right stakeholders in the room.”
Rep. Sensenbrenner was unconvinced. “You’re not going to like what comes out of Congress,” he shot back. Sensenbrenner, who authored 2001’s PATRIOT Act, would know.