FBI vs Apple
Preface
In early August 2017, Apple CEO Tim Cook declared “we obey the laws where we do business,” explaining his decision to adhere to the Chinese government’s demands to remove access to privacy enhancing applications. It was an interesting twist given the vociferous campaign that the company and its allies waged against the U.S. government last year. It’s worth taking a closer look at what really happened in the case of Apple vs. FBI and why it still matters today in the ongoing struggle between privacy and security.
Introduction
An astute observer may have predicted the battle would emerge more than 30 years ago. In 1984, Apple was a relatively new and small company trying to break into a market dominated by IBM. They threw down the gauntlet with the most famous Superbowl commercial in history, portraying Apple as the champion of the people who are oppressed in an Orwellian version of society.[1] The message that Apple’s technology empowers individual freedom continues to this day even, though the company now dwarfs its competitors.
The new plot line involved the United States government, represented by the Federal Bureau of Investigation, attempting to strong-arm Apple into becoming an unwilling accomplice in the rise of the police state the company has warned about. The issue rose to national prominence in early 2016, when following a domestic terrorist attack in California, the FBI sought to compel Apple’s assistance in accessing the attacker’s Iphone. The two sides geared up for a massive legal battle, but the matter resolved itself when the FBI found an alternative method to access the data they sought. The fanfare regarding the particular case died down, but the underlying controversy remains unsettled.
The question remains - whether or not the government can force a cell phone manufacturer to provide assistance in bypassing its own security measures to access information on the device. To find an answer, one can either conduct a detailed analysis of case law to predict an outcome, or consider the broader policy implications as augury of the result.
Because many of the legal arguments pertain to the specific controversy, the detailed review of the pleadings of last year’s case will be covered in the second part of this article. Today’s focus is on the underlying policy issues that ultimately must prevail as society decides how to adapt to the new reality of widely available strong encryption technologies that can defeat valid search warrants. Two overall contexts are considered – the classic struggle between liberty and security, and the emerging tension in the power dynamic between the nation-state and the individual based on technological developments.
At its core, the question behind the clash of the titans was what should happen when a private company’s encryption prevents the government from accessing information which it has a legal warrant to obtain. The sense of urgency put forth by many of Apple’s supporters was well founded, but for reasons opposite to their ultimate positions. Indeed, the world stands at fateful crossroads. The path must be carefully chosen and we are fortunate to have the wisdom of our nation’s founders to guide us.
For those who desire a refresher on the details of the case, please see https://ctovision.com/applevsfbi-fbivsapple-basics-explained-links-original-documents/
Legal Analysis
A detailed review of legal pleadings for the case, as presented by the parties and their amici provide insight on how future cases on unbreakable encryption will be handled. As advance warning, this discussion is oriented particularly towards lawyers and those with an interest in the intersection between law and technology.
The theme of the government’s case was that “Apple is not above the law” and compliance with the order was a far cry from being “the end of privacy.”[2] It was a result of Apple’s attempt to “design and market its products to allow technology, rather than the law, to control access to data.”[3]
Apple’s overall strategy was to paint the issue as a political question instead of a legal one and insist that Congress is the branch empowered to update laws to adapt to new technologies.[4] If Apple’s assistance had actually been required, their strongest argument may have been the lack of precedent for forcing a company to develop software.[5] While the government points to other cases, the scale and scope of the activity seem to be notably different and a judge may agree that this request goes too far. On the other hand, the evolution of technology means new types of requests are inevitable, so even if coding of this nature has not been compelled to date, it still could be upheld.
While the alternate approach to gain access to the data on the phone meant the case was no longer ripe for adjudication, the record provides a rich source of data to analyze the potential outcome. More importantly, it is almost certain that another case involving similar issues will soon arise, when a third way out does not present itself.
Round One - The FBI’s Motion to Compel and Apple’s Motion to Vacate.
The FBI’s Case.
The FBI’s case rested on two pillars. First, the search of the phone was properly authorized through a search warrant obtained within the scope of the Fourth Amendment. Second, the necessary assistance was properly compelled under the provisions of the All Writs Act because the warrant would otherwise be a meaningless ineffective document.
As the facts of the case clearly showed compliance with the Fourth Amendment, the All Writs Act quickly became the central focus of the issue. The Act provides a mechanism to order third parties to assist the government in execution of warrants. Given the prominent role of the Act, the government’s description of its role is provided here in full:
The All Writs Act provides in relevant part that “all courts established by Act of Congress may issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.” 28 U.S.C. $ 1651 (a). As the Supreme Courtexplained, “[t]he All Writs Act is a residual source of authority to issue writs that are not otherwise covered by statute.” Pennsylvania Bureau of Correction v. United States Marshalls Service. 474 U.S. 34, 43 (1985). Pursuant to the All Writs Act, the Court has the power, “in aid of a valid warrant, to order a third party to provide nonburdensome technical assistance to law enforcement officers.” Plum Creek Lumber Co. v. Hutton, 608 F. 2d 1283, 1289 (9th Cir. 1979) (citing United States v. New York Telephone Co., 434 U.S. 159 (1977)). The All Writs Act permits a court, in its “sound judgment,” to issue orders necessary “to achieve the rationale ends of law” and “the ends of justice entrusted to it.” New York Telephone Co., 434 U.S. at 172-173 (citations and internal quotation marks omitted). Courts may apply the All Writs Act “flexibly in conformity with these principles. Id. at 173; accord United States v. Catoggio, 698 F. 3d 64, 67 (2d Cir. 2012) (“[C]ourts have significant flexibility in exercising their authority under the Act.”) [6]
New York Telephone is the seminal case for application of the Act. In that case, the Supreme Court provided three factors for considering when the Act could lawfully be applied to compel assistance from a third party company to assist law enforcement in executing a search warrant.[7] First, was the company “so far removed from the underlying controversy that its assistance could not be permissibly compelled.”[8] Second, would the order place an “undue burden” on the company.[9] Third, was assistance necessary to achieve the purpose of the warrant. [10]
The government argued all three factors were met. First, the company was not far removed from the matter. “Apple designed its software and the design interferes with the execution of search warrants…it manufactured and sold the phone used by an ISIL-inspired terrorist… it owns and licensed the software used to further the criminal enterprise…it retains exclusive control over the source code necessary to modify and install the software.”[11] Clearly, Apple was not “a random entity summoned off the street to offer assistance.”[12]
Second, because writing software updates and patches was a regular part of Apple’s business and they could request reasonable reimbursement expenses, it was not an unreasonable burden for them to develop code to modify the operating system. [13] The government also argued that the requested software was not unreasonably challenging to write and Apple had tacitly acknowledged its ability to do so.[14]
Importantly, the government contended that compliance with the court order in this one case did not constitute a threat to other users of Apple products. [15] They suggested Apple could take possession of the device at its own secure location, have complete control over whatever software was developed and ensure it was not released into the wild.[16] Therefore, it would not be “the equivalent of a master key, capable of opening hundreds of millions of locks.”[17]
The government insisted the burden should be measured based on the direct costs and not include more general considerations about reputation or ramifications of compliance.[18] This meant speculative policy concerns regarding possible consequences should hold little weight in the outcome. [19]
The government implied Apple’s refusal was tied to its public brand marketing strategy. FBI noted that Apple’s statement on its web page: “Our commitment to customer privacy doesn’t stop because of a government information request…Unlike our competitors, Apple cannot bypass your passcode and therefore cannot access this data. So it’s not technically feasible for us to respond to government warrants for the extraction of this data from devices in their possession running iOS8.” [20]
For the third prong of the test, the government asserted the assistance was necessary because technicians from FBI and Apple agreed they were unable to identify any other feasible methods to gain access to the device.[21] Apple’s control over the source code that created the obstacles meant no other party had the ability to assist the government in preventing their security features from obstructing the search.[22]
Finally, the government agued it was appropriate to rely on the All Writs Act in this case because “no statute addresses the procedures for requiring Apple to extract data from a passcode locked iPhone” and the “absence of a specific statute cannot be read as a decision to limit existing authority.”[23] The Communications Assistance to Law Enforcement Act (CALEA) did not apply because Apple was not a telecommunications carrier and the order concerned access to stored data instead of real-time interception and call identifying information (data “in motion”). [24] The government acknowledged the All Writs Act would not apply where a statute specifically addresses an issue, but the lack of congressional action on encryption was not a restriction here because the Supreme Court has repeatedly cautioned “Congressional inaction lacks persuasive significance.” [25]
Apple’s case
On February 16, Apple went public with a “Message to Our Customers” posted on their website. Their call to arms was answered by a star-studded list of supporters who filed amici briefs, including some of the world’s largest technology companies (e.g. AT&T, Amazon, Cisco, Facebook, Google, Intel, and Microsoft) and privacy advocate groups (e.g. EPIC, Human Rights Watch, ACLU, Center for Democracy and Technology). Dozens of law professors, cryptographers, and even the United Nations Special Rapporteur on Promotion and Protection of the Right to Freedom of Opinion and Expression supported Apple’s stance.
The opening paragraph of Apple’s opposition was not a mere shot across the bow; it was a declaration of “total war”:
This is not a case about one isolated iPhone. Rather, this case is about the Department of Justice and the FBI seeking through the courts a dangerous power that Congress and the American people have withheld: the ability to force companies like Apple to undermine the basic security and privacy interests of hundreds of millions of individuals around the globe. The government demands that Apple create a back door to defeat the encryption on the iPhone, making its user’s most confidential and personal information vulnerable to hackers, identify thieves, hostile foreign agents, and unwarranted government surveillance. [26]
Apple’s assault continued with the assertion that “no court has ever authorized what the government now seeks, no law supports such unlimited and sweeping use of the judicial process, and the Constitution forbids it.”[27]
Apple set the stage by recalling the data breach of the federal government’s Office of Personnel and Management that affected 22 million people, as an example of the daily siege of cyber threats facing the nation.[28] They explained that starting with iOS8, additional security features had been added to protect customers from cyber attacks, but now the government sought to “roll back” those protections. [29] This was of additional concern because the government tactics “invoked terrorism” and attempted to cut off debate and analysis in ex parte proceedings behind closed court doors.[30] Apple said they believed the government wanted a “crippled and insecure product…too dangerous to build” because the process would provide “an avenue for criminals and foreign agents to access millions of iPhones.”[31]
To prove this was not just an isolated event, Apple noted there were multiple other similar applications already pending, including over a hundred each in New York and California alone. [32]The company warned that once the floodgates opened, there might be no limits on future government orders:
[W]hat is to stop the government from demanding that Apple write code to turn on the microphone in aid of government surveillance, activate the video camera, surreptitiously record conversations, or turn on location services to track the phone’s user? Nothing.[33]
To make matters worse, while the average American citizens would end up prisoners of a surveillance state described above, actual criminals and terrorists would just be driven further underground and use encryption provided by foreign companies that could not be conscripted into service.[34]
Moving beyond the hyperbole, the central point of Apple’s argument emerged that the All Writs Act is limited to being a gap-filler and the government was trying to unjustly apply it. Apple noted a holding within the controlling circuit that “squarely rejected the notion ‘the district court has such wide-ranging inherent powers that it can impose a duty on a private party when Congress has failed to impose one.”[35] Apple also noted the Supreme Court’s ruling in Pa. Bureau of Corr. V. U.S. Marshals Service, 474 U.S. 34 (1985) that the All Writs Act “ does not authorize [courts] to issue ad hoc writs whenever compliance with statutory procedures appears inconvenient or less appropriate.”[36]
Apple challenged application of the All Writs Act’s three factor test, stating the current case is nothing like the New York Telephone case and its progeny.[37] In New York Telephone, there was probable cause the company’s facilities were being used in an ongoing criminal enterprise, but here the terrorists using the iPhone had been killed two months earlier. Further, Apple is private company, not a “highly regulated public utility” with “a monopoly in an essential area of communications.”[38]
A judge would likely find these arguments fall short for two reasons. First, the iPhone capabilities would equate to a room full of computers housed by the phone company in 1977 when that case was decided, and there may indeed have been a connection to other potential planned terrorist activity on the device. Second, the All Writs Act is not limited to public utilities and it can be argued that Apple’s dominant role in the market exceeds the power the phone company monopolies once held.
Apple’s next argument was that the fact they designed, manufactured, and sold the device, and wrote and owned the software, did not make them sufficiently close to the matter because this would mean merely placing a good into the stream of commerce would implicate the All Writs Act.[39]
A judge would likely not agree with Apple’s contention that requiring their involvement would eliminate any limits on the remoteness factor. Apple denied any significance to the fact the software is licensed instead of sold, but when combined with their total control over the source code, it should be clear this company’s relationship to their products is not the same as any simple manufacturer who makes a sale and then remains connected only in terms of warranties.
Turning to the second factor, Apple claimed the burden on them would be excessive because the requested software does not exist and would require significant resources to develop. Apple defined the task to require six to ten engineers dedicating a very substantial portion of their time for two to four weeks. They would need to prepare detailed documentation for using the software, follow quality assurance and security protocols, test the software on multiple devices before deployment, and de-bug and patch fixes as necessary to ensure it worked.[40]
More importantly, Apple said doing what the government wants “destroys the security features that Apple has spent years building” and would threaten the data privacy of hundreds of millions of iPhone users around the globe.[41] Apple noted that if it complied in this case, there would be hundreds of other requests seeking the same type of support, including from foreign governments.[42] The newly created code would be at great risk from hackers, criminals, and terrorists who would seek to exploit it for nefarious purposes. Further, these technologically sophisticated bad actors would still use other encryption technologies beyond what would be bypassed.[43]
A judge would likely find all of these arguments make the flawed assumption that unlocking this one phone would result in wide scale proliferation of the ability to unlock other iPhones. Apple has clearly proven itself able to keep its source code protected and the formula for Coca Cola has remained secret for over 100 years, so there is no reason to assume that just because something is valuable it can’t be kept secure. Additionally, each future request for assistance from the United States or other governments would need to be adjudicated on the merits of the particular facts of the individual cases.
Apple argued this case could be a dangerous precedent for use of the All Writs Act in other circumstances, such as compelling a drug company to make lethal injections, newspapers planting false stories, or malicious code insertion to enable surveillance.[44]
A judge would likely find these fanciful leaps irrelevant to the proceedings at hand. Obviously, any such requests would need to be dealt with in their own rights and first need to comply with existing Constitutional norms before they could even be initiated.
Finally, in what turned out to be the death-knell for this particular case, Apple argued that the third prong of the test was not met because the government did not demonstrate the company’s assistance was necessary.[45] Apple noted they initially responded immediately and devoted substantial resources on a 24/7 basis to support the investigation. [46] Without consulting Apple, FBI changed the iCloud password associated with one of the attacker’s accounts. If that had not been done, it is possible an iCloud back-up could have been created and it wouldn’t have been necessary to unlock the phone.[47]
Apple suggested that other federal agencies with digital forensic expertise should have been consulted, especially within the intelligence community. [48] It later turned out that another company was able to help the FBI gain access to the device, so the government no longer had justification for use of the All Writs Act. This issue won’t resurface as long as there are other avenues available, but given the rapidly evolving world of cryptography, it is likely that another insurmountable barrier will soon present itself. Thus, focused attention on other aspects of the dispute, as detailed in this paper, is still well deserved.
Regardless of the outcome of the three facto test, Apple argued the All Writs Act was not lawful because CALEA was on point and therefore precluded its use.[49] Apple explained that CALEA specifies there is no obligation for a company to assist the government in decryption of communications when the company does not retain a copy of the decryption key.[50] Further, there is no requirement for “information service providers” such as Apple to provide this type of support, and Apple contends Congress intentionally made this exclusion. [51] Lastly, under CALEA the government cannot dictate specific equipment designs or software configurations to providers of electronic communication services or manufactures of telecommunications equipment. Apple contended it is a provider of “electronic communication services” and therefore would be governed by this rule.[52]
Apple argued that the executive branch’s decision to abandon efforts to update CALEA in 2015, sent a strong signal, along with current proposals in Congress that would prohibit forcing private companies like Apple to compromise data security.[53]
Moving beyond whether or not the All Writs Act was applicable, Apple also argued the order would violate the First Amendment by compelling speech and viewpoint discrimination because computer code is treated as speech.[54] The Supreme Court has ruled such action can only be upheld if narrowly tailored to obtain a compelling state interest and Apple asserted that standard was not met here.[55] Apple recognized the importance of investigating and prosecuting terrorists, but maintained that in this case there was only “speculation that this iPhone might contain potentially relevant information.” [56] Apple suggested that based on the ISIL’s familiarity with secure communications, it was likely there were additional layers of encryption that would continue to frustrate the government even if Apple helped.[57] Additionally, Apple noted that producing the new software would effectively be forcing the company to advance a viewpoint contrary to their stated position on the subject.[58]
Lastly, Apple argued that the due process clause of the Fifth Amendment protected them against being arbitrarily deprived of liberty and forced to act by the government.[59] The government obtained the initial order without notice to Apple and without allowing Apple an opportunity to be heard.[60]
Round Two – The Counter-arguments and The Amici briefs.
The government reply tried to emphasize the specific facts of this one case, while accusing Apple of obfuscation: “…Apple attacked the All Writs Act as archaic, the Court’s order as leading to a “police state,” and the FBI’s investigation as shoddy, while extolling itself as the primary guardian of American’s privacy.”[61] They highlighted Apple’s concession of being technically capable of compliance and the absurd notion that a couple of man-months of labor would be burdensome for a company of 100,000 employees and hundreds of billions in annual income.[62] The order itself would apply to a single device and raised no Fourth Amendment privacy concerns regarding the content sought.[63]
To counter Apple’s efforts to characterize the All Writs Act as “an obscure law dredged up by the government to achieve unprecedented power,” the government argued the Act was “a vital part of legal system regularly invoked in a variety of contexts.”[64] It was enacted by the First Congress as part of the Judiciary Act of 1789 and is a foundational law that pre-dates the Bill of Rights. In 1948, the Supreme Court described it as “a legislatively approved source of procedural instruments designed to achieve the rationale ends of law.”[65] The government contended that Act was specifically intended to give courts ability to adapt to new problems, such as the one presented by Apple, to ensure justice is done.[66]
The government noted many of Apple’s arguments were raised in the New York Telephone case and dismissed by the Supreme Court 40 years ago.[67] Significantly, the Act is self-limiting because it can only be invoked in aid of a court’s existing jurisdiction and the three-factor analysis eliminates concerns that random citizens will be forcibly deputized.[68]
In terms of the applicability of the Act being precluded by CALEA, the government argued again that Congressional inaction lacks persuasive significance because the proposed changes were neither enacted nor rejected, but simply not acted upon.[69] All Writs Act is controlling unless a statute specifically addresses the particular issue at hand, and in order to occupy the field “Congress must legislate so intricately as to leave no gap to fill.”[70]
The government argued CALEA analysis must be performed on individual components, instead of the entity as a whole, when an entity provides multiple kinds of services. CALEA addresses various categories but “with regard to the development and control of the iOS Apple is not a provider of wire or electronic communication services, but a software developer and licensor.”[71] Apple’s FaceTime and iMessagemay qualify as electronic communication services, but the court’s order did not pertain to those aspects.[72] Finally, Apple is not an “equipment manufacturer” as defined in CALEA since that term means transmission and switching equipment, not end-user phones.
Turning to the analysis of the three factors, the government claimed Apple failed to show the burden placed upon it would be undue, unreasonable, and non-compensable.[73] They pointed out writing software was not a “per se” undue burden and that Apple’s 2015 income exceeded the operating budget of the State of California and the GDP of two thirds of the nations of the world.[74] The burden was lightened because the FBI was not seeking Apple’s source code and the software to be developed would not need to be consumer ready.[75]
The government attempted to distinguish the controversy from an earlier one Apple cited as an example for restricting the reach of the All Writs Act. They argued that in that case (Plum Creek Lumber Co. v. Hutton, 608F. 2 1283 (9th Cir. 1979), the Act was not justified by the risks imposed because the government was seeking only to increase the efficiency of an investigation, where here it was a question of whether the investigation could proceed at all.[76]
In addition, the government argued it was only speculation that Apple would subsequently have to use the same technique to help totalitarian regimes suppress dissidents around the globe or that “hackers, criminals, and foreign agents” would subsequently have access to data on millions iPhones.[77] Widely publicized incidents involve breaches of network security, but the bypass method in this case would require physical access to the device.[78] Apple has proven capable of protecting its source code, and there is no reason it could not provide the same level of protection for this technique, so it would be safe to argue the code would never leave Apple’s possession.[79]
The government provided responses to Apple’s speculation there would not be any benefit to removing iPhone barriers because criminals and terrorists will encrypt their data in other ways.[80]First, the government may be able to break any additional layers of encryption if they did exist.[81] Second, even if there was some point in the future where unlocking iPhones was no longer of value due to secondary encryption, it is still valuable today.[82]
In an important analogy describing the technical aspects of this challenge, the government argued what they requested was more like disarming a booby trap affixed to one door instead of a crafting a master key that could fall into the wrong hands.[83] The requested code could be developed to leverage the unique ID associated with each iPhone and incorporated into its operating system, so that it could load and execute only on the one device.[84] With this approach, the software would lack a valid digital signature if it were modified to work on other device, so it was disingenuous to extrapolate the threat to all iPhone users.[85]
The government also challenged the impact on foreign states as part of Apple’s efforts“accumulating hypothetical future burdens.”[86] According to Apple’s own information, China demanded information on over 4,000 phones in the first half of 2015 and Apple produced data 74% of the time.[87] An internal U.S. court order does not change how foreign governments interact with Apple.[88] It would not have legal meaning in terms of whether or not Apple would need to comply with foreign government requests made under different circumstances.[89] The lawful process in America should not be confined by potential lawless oppression elsewhere.
Lastly, the government responded that their request would not violate either the First or Fifth Amendments. Even if considered compelled speech, such requirements are common in both criminal and civil justice systems, such as in grand jury and trial subpoenas, interrogatories and depositions.[90] Additionally, the software would only be seen by Apple and while coding includes expression at some level, there is some doubt that functional programming is entitled to traditional speech protections.[91] The expressive elements of Apple’s software would be unlimited, as long as it functioned.[92] Finally, the order was compelling conduct with incidental effect on speech, which had previously been ruled permissible.[93]
Given the scope of the court proceedings underway, it seemed as if little was needed to debunk the lack of due process, other than to point out there was no due process right to not develop software and “Apple was availing itself of the considerable process the legal system provides.”[94]
One of the main issues of contention between the parties was that the FBI argued the case should be decided on its facts, while Apple proposed the court address broad questions of whether the company should be required to provide the government the ability to unlock every iPhone. [95] The government asserted that the limits Apple sought were already found in the law and those authorities should be entrusted to strike the balance between each citizen’s right to privacy and all citizen’s right to safety and justice.[96] For example, in the case of Riley v California. 134 S. Ct. 2473 (2014), the Supreme Court made a careful consideration of smart phone technology and its role in society and stuck an “appropriate balance between privacy concerns and investigative needs” by requiring search warrants to access data on the devices rather than simply permitting access as part of searches incident to arrest.[97]
Apple’s Final Words
Apple continued to maintain the government had misconceived the All Writs Act and its purpose. Several additional cases were cited, but the essence of the argument on both sides was unchanged.[98] This is a matter a judge would need to decide, but they would likely find software development to be a novel but reasonable application of the Act.
In revisiting CALEA, Apple went into further detail to highlight the FaceTime, iMessage and Mail applications were electronic communications and this qualified the company as an “information service provider.”[99] The key argument remained whether CALEA could be read to directly apply, or was intended to fully occupy the field, and thus pre-empted use of the All Writs Act. Again, it would fall to a judge to make a ruling as to how strong an indicator of intent Congress had provided. Because the outcome of the ruling in favor of Apple would mean a huge increase in unexecutable warrants across the country, it is likely the judge could interpret this issue as outside the scope of CALEA. It becomes a policy issue, as covered in more detail in the other section of this article.
Apple once again ran through the three factor test of New York Telephone, providing additional case law but no notable substance that could alter the outcome.[100] Their strongest new argument was to explain that previous compelled “programming” the government cited from cases in 1979 and 1980 simply involved use of a teletypewriter or took less than a minute to complete.[101]
The remainder of Apple’s brief challenged the government on the same grounds as earlier, attempting to rebut each point raised, but leaving the reader with nothing more than a clear understanding that there are two ways to characterize the issues.
In conclusion, Apple called upon one of the foundational leaders of privacy law, citing Justice Louis Brandeis’s comments on advances of science beyond wiretapping almost 100 years ago. Brandeis warned that the “greatest dangers to liberty lurk in insidious encroachment by men of zeal, well-meaning but without understanding.”[102] While those words do indeed show a need for caution, it is hard to imagine Brandeis, who also famously remarked “sunlight is said to be the best of disinfectants,” would support a world filled with indiscriminate shielding of information from valid search warrants.
Amici
The government’s amici attempted to balance the theoretical concerns presented by Apple with actual costs that would ensue from non-compliance. The Federal Law Enforcement Association noted that crimes would go unsolved and criminals would go free.[103] They explained that major police departments are finding up to 50% of phones inaccessible and provided specific examples of cases of human trafficking, pedophiles, child pornography, homicide convictions and exoneration of innocent, cybercrime, and identify theft.[104] In addition, they provided a somber reminder that it is not just investigation, but also crime prevention that is hindered by inaccessible encrypted data. In November 2015, cell phone data was reportedly used to track down the ringleader of the Paris attack that killed 89 people, while he was in the process of planning another attack in Europe. [105] If the data had been hidden behind unbreakable encryption, it could not have been used to thwart this imminent threat.
The San Bernadino District Attorney (DA) addressed a different angle, arguing Apple was making de facto decision on who could be charged with a crime and giving de facto immunity to iPhone users.[106] This infringed on authority of the District Attorney to make charging and immunity decisions and impacted the due process rights of victims to have all relevant evidence admitted in a criminal proceeding.[107]
The DA aptly noted “No one has appointed or elected Apple to be the Orwellian arbiter or definer of privacy for society…” and the proposed concept of absolute privacy and immunity from search was not supported by the Constitution.[108] They noted that when a company introduces a dangerous product they are required to fix it, and when a company creates environmental damage they must clean it up. [109] In the same vein, it made sense for Apple to be required to remediate the problem they created, which did not exist in their previous operating systems.[110]
Apple’s amici continued their theme of amplifying the crisis. The proposed court order was portrayed to be “devastating for cybersecurity” and an action that would “undermine American and global trust in software security updates, with catastrophic consequences for digital security and privacy.”[111] They warned that “deliberately compromised digital security would undermine human rights around the globe.”[112]
But other than providing an impressive list of corporate names in their camp, the technology company briefs did not do much to help Apple’s case. AT&T’s brief acknowledged that “of course” the government should have access to the critical evidence in the terrorist attack, but questioned whether the All Writs Act was appropriate instead of new legislation.[113] AT&T called for a new legislative solution because “communications services have changed dramatically” and “personal data are largely controlled by device, search, operating system, application, and social media companies that barely existed when CALEA was passed.”[114]
Intel’s brief attempted to shed light on the CALEA question, but their information reinforced the impression that the decision could go either way.[115] On the other hand the brief written by “several of the most popular communications, networking, ecommerce, publishing, and commercial transaction platforms on the Internet” contended that existing statutes (Federal Wiretap Act, Stored Communications Act, Foreign Intelligence Surveillance Act, and CALEA) provided a “comprehensive regulatory scheme” that left no gaps for the All Writs Act to fill.[116] This group went so far as to warn of a “potential erosion of consumer trust” that “undermines the entire Internet and technology industry, which has been a source of dynamic innovation and job creation in the U.S. economy.”[117]
Another brief expanded on this economic doom theory by noting the “enormous burden” that would be imposed on software developers if the government had its way.[118] “Massive expenditures of time and resources” could be demanded from any company, which would be “particularly onerous on small companies…that are the ‘heart of the mobile economy.’”[119] Apparently this team forgot about the All Writs Act’s three factor test that would limit any such requests based on their imposed burdens.
The Electronic Privacy Information Center (EPIC) provided an interesting argument that avoided any discussion of the All Writs Act or constitutional protections. Instead, EPIC built a case that the short term benefit to the FBI would be outweighed by an increase in nationwide crime that would result from weakened safeguards in iPhone security.[120] Cell phones are a primary target for criminals and identity thieves and the issue is a top priority for law enforcement in most major cities.[121] For example, almost half the robberies in New York City involved cell phones. [122] Ten percent of phone thefts later lead to identity theft. Anti-theft software could save over $3 billion per year, and in fact, the Federal Communications Commission reported a sharp decline in Apple iPhone thefts following their use of new security features.[123] The security features that would be overcome by the court order are exactly the type law enforcement has been advocating for.[124]
Given EPIC’s expertise on the subject, one might find what was not contained in EPIC’s brief more telling. Citing only a single case, it was not really a legal brief at all but, just an appeal to carefully perform a cost benefit analysis. Considering the costs are hypothetical based on the assumption the single instance would translate into universal defeat of Apple’s security, their argument does not hold much weight. Of course law enforcement supports wide-spread use of the security measures to deter theft. But this does not mean those security procedures must preclude the ability to comply with a lawful search warrant.
EPIC noted that the Supreme Court found cell phones deserve special Constitutional protections because they contain so much sensitive data.[125] Unlike many of their fellow amici, perhaps EPIC realized that those protections had already afforded in this case, so they chose to present a less alarmist argument.
A group of computer security experts advanced an interesting proposition that the court order could undermine public trust in automatic software updates due to fears of future surreptitious forced enabling of government surveillance.[126] As a result, software patches would be less effective and the public less secure. They further explained that even if this one tool was intended to remain in safe hands, software inevitably has bugs that can be exploited. [127] In fact, Apple has been battling against “jailbreakers” who exploit vulnerabilities in their software for years, and this would heighten the stakes in that struggle.[128] Finally, governments with poor human rights records, such as China, Russia and Turkey would make use of the technique and the corruption and poor security practices of these regimes would further increase the risk of inadvertent release.[129]
A group of law professors provided a surprisingly one-sided view, implying the court order would discourage creativity and innovation.[130] The professors raised issues of inadequate due-process during the initial stages and expiration of the original warrant’s authority, but these are administrative technicalities based on how the case developed. The bulk of their argument was that CALEA and ECPA “cover the field” and therefore left no room for the All Writs Act. Most significantly, they pointed to a provision within CALEA that provides for expanding its coverage, but even this would be limited to only certain content (email or iMessages) so the outcome of this aspect of the controversy remains uncertain.[131] They clearly went too far when warning against “giving the government defacto control over technical design while permanently converting Apple and other private companies into state actors.”[132] This was far more than what the government sought and ignores the fact Apple and it’s like already have full time law enforcement support teams.
The Electronic Frontier Foundation argued that the court order would violate the First Amendment by placing a significant burden on Apple’s free speech rights, particularly emphasizing the significance of the software’s digital signature code.[133] The digital signature communicates authenticity and trust so that Apple’s signature is an endorsement and seal of approval, but this would be exactly the opposite of the message Apple wished to send.[134] It would be one of the most onerous examples of compelled speech - forced hypocrisy.[135] But it is also an argument that can’t go very far because the government is not forcing Apple to digitally sign the requested code. Apple’s own protocols require it, and if they truly wished to avoid a digital signature they could develop a work around that did not require it.
Another brief also focused on the First Amendment, raising the alarming premise that the court order represented a threat to independence of the free press.[136] But this brief later admitted there may be cases where the government can indeed compel a company to write software, when there is a specific compelling interest undertaken in a narrowly tailored fashion. [137]
Human Rights Watch and Privacy International noted security features such as encryption are integral to the protection of civil and human rights.[138] While this may be true in many parts of the world, the U.S. has been at the vanguard for these movements for hundreds of years without any need for reliance on such technologies. This concern is actually more oriented towards other countries, which may see a ruling against Apple as a green light to use the requested technique to “stifle expression, crush dissent, and facilitate arbitrary arrest and torture.”[139] But the fears may already be reality, because there is no reason for such countries to wait for a U.S. precedent. For example, Russia and China already have the power to compel technology companies to assist law enforcement upon request.[140]
The ACLU argued the proposed application of the All Writs Act would violate Fifth Amendment due process protections against arbitrary action of government, noting there are Constitutional limits to the assistance that law enforcement may compel from third parties.[141] The group resurfaced criticisms against “writs of assistance” from the Colonial era and warned that the security of all Apple’s users would inevitably be weakened.[142]
The Center for Democracy and Technology also relied on a “slippery slope” argument, including a concern that foreign companies would fill the breach and provide encryption not vulnerable to edicts by American law enforcement.[143] The prominence of the U.S. market in the global economy makes such a scenario unlikely, because any entity that legitimately seeks to do business in this country would need to comply with its laws, regardless of where that company is situated.
Another group argued that some companies would choose not to include robust security in their products due to the fear of potential future costs of being ordered by a court to bypass the protections.[144] This argument ignores market dynamics because there are hundreds of millions of iPhonesin use and the cases of lawful warrants to search them are almost infinitesimal - less than .001%, or one out of 100,000 (a total of roughly 1000 cases out of over 100 million users). The same group took political correctness and self-actualization to a new level by arguing the order undermined Apple’s ability to fulfill its human rights responsibilities and impinged upon Apple’s preferences “about the kind of corporation it is aspires to be.”[145]
Finally, one outlier claimed the order violated the Thirteenth Amendment which protects an individual’s right to be free from involuntary servitude.[146]
At the end of the day, none of the arguments presented by the government, Apple, or their numerous amici were legally evaluated by the court. While this analysis provides some predictions of how case law would likely be applied, the more compelling policy questions linger unresolved.
[1] http://www.businessinsider.com/apple-super-bowl-retrospective-2014-1
[2] Id. at 15.
[3] Id. at 1.
[4] Id. at 19.
[5] Id. at 27.
[6]United States Government Motion to Compel In the matter of the search of an Apple iPhone seized during the execution of a search warrant on a black Lexus IS300, California License Plate 3KGD203, C.D. Cal. (ED No. CM 16-10 (SP)), Feb 19, 2016, at 8
[7] Id. at 10.
[8] Id.
[9] Id.
[10] Id.
[11] Id. at 12.
[12] Id.
[13] Id. at 13
[14] Id. at 14.
[15] Id. at 15.
[16] Id.
[17] Id.
[18] Id. at 16.
[19] Id.
[20] (https://web.archive.org/web/20140918023950/http://www.apple.com/privacy/government-information-requests/)
[21] USG Motion to Compel at 17.
[22] Id. at 11.
[23] Id. at 22.
[24] Id..
[25] Id. at 24.
[26] Apple Inc.’s Motion to Vacate Order Compelling Assistance and Opposition to Motion to Compel, In the matter of the search of an Apple iPhone seized during the execution of a search warrant on a black Lexus IS300, California License Plate 3KGD203, C.D. Cal. (ED No. CM 16-10 (SP)), Feb 25, 2016, at 1.
[27] Id.
[28] Id. at 2.
[29] Id.
[30] Id.
[31] Id.
[32] Id. at 3.
[33] Id. at 4.
[34] Id. at 3.
[35] Id. at 14.
[36] Id.
[37] Id. at 21.
[38] Id. at 22.
[39] Id.
[40] Id. at 13.
[41] Id. at 23.
[42] Id. at 24.
[43] Id. at 25.
[44] Id. at 26.
[45] Id. at 29.
[46] Id. at 10.
[47] Id. at 11.
[48] Id. at 30.
[49] Id. at 16.
[50] Id. at 8.
[51] Id. at 17.
[52] Id. at 16.
[53] Id. at 9.
[54] Id. at 32.
[55] Id. at 33.
[56] Id.
[57] Id.
[58] Id.
[59] Id. at 34.
[60] Id. at 11.
[61] United States Government’s Reply in Support of Motion to Compel and Opposition to Motion to Vacate Order, In the matter of the search of an Apple iPhone seized during the execution of a search warrant on a black Lexus IS300, California License Plate 3KGD203, C.D. Cal. (ED No. CM 16-10 (SP)), March 10, 2016, at 1.
[62] Id.
[63] Id.
[64] Id. at 3.
[65] Id. at 3,4.
[66] Id. at 2.
[67] Id. at 5.
[68] Id.
[69] Id. at 8.
[70] Id. at 11.
[71] Id. at 12.
[72] Id.
[73] Id. at 17.
[74] Id. at 18, 21.
[75] Id. at 22.
[76] Id. at 20.
[77] Id. at 23.
[78] Id.
[79] Id.
[80] Id. at 24.
[81] Id..
[82] Id..
[83] Id. at 25.
[84] Id.
[85] Id.
[86] Id. at 27.
[87] Id. at 26.
[88] Id.
[89] Id.
[90] Id. at 32.
[91] Id.
[92] Id..
[93] Id..
[94] Id. at 34.
[95] Id. at 6.
[96] Id. at 35.
[97] Id. at 7.
[98] Apple Inc.’sReply to Opposition to Motion to Vacate Order, In the matter of the search of an Apple iPhone seized during the execution of a search warrant on a black Lexus IS300, California License Plate 3KGD203, C.D. Cal. (ED No. CM 16-10 (SP)), March 15, 2016, at 3-6.
[99] Id. at 11.
[100] Id. at 13.
[101] Id. at 15.
[102] Id. at 25.
[103]Brief for Federal Law Enforcement Officers Association, Association of Prosecuting Attorneys, and National Sheriffs’ Association, as Amici Curiae Supporting the United States Government (March 3, 2016), at 4.
[104] Id. at 5-9.
[105] Id. at 10.
[106] Brief for San Bernardino County District Attorney on behalf of the People of California, as Amici Curiae Supporting the United States Government (March 3, 2016), at 6.
[107] Id. at 4.
[108] Id. at 8.
[109] Id. at 11
[110] Id.
[111] Brief for American Civil Liberties Union, ACLU of Northern California, ACLU of Southern California, and ACLU of San Diego and Imperial Counties, as Amici Curiae Supporting Apple Inc., at 10.
[112] Brief for Access Now and Wickr Foundation , as Amici Curiae Supporting Apple Inc., at 2.
[113] Brief for AT&T, as Amici Curiae Supporting Apple Inc., at 1.
[114] Id. at 3.
[115] Brief for Intel, as Amici Curiae Supporting Apple Inc., at 8.
[116] Brief for Airbnb, Atlassian, Automattic, CloudFlare, eBay, GitHub, Kickstarter, LinkedIn, Mapbox, Medium, Meetup, Reddit, Square, Squarespace, Twilio, Twitter and Wickr, as Amici Curiae Supporting Apple Inc., at 4.
[117] Id. at 14.
[118] Brief for ACT/The App Association, as Amici Curiae Supporting Apple Inc., at 1.
[119] Id. at 8.
[120] Brief for Electronic Privacy Information Center (EPIC) and eight consumer privacy organizations, as Amici Curiae Supporting Apple Inc., at 5.
[121] Id. at 7.
[122] Id. at 8.
[123] Id. at 11.
[124] Id. at 10.
[125] Id. at 5.
[126] Brief for Center for Democracy & Technology, as Amici Curiae Supporting Apple Inc., at 4.
[127] Id. at 10.
[128] Id. at 11.
[129] Id. at 13
[130] Brief for 32 Law Professors, as Amici Curiae Supporting Apple Inc., at 1.
[131] Id. at 15.
[132] Id. at 24.
[133] Brief for Electronic Frontier Foundation and 46 technologists, researchers, and cryptographers, as Amici Curiae Supporting Apple Inc., at 3.
[134] Id. at 6.
[135] Id. at 10.
[136] Brief for The Media Institute, as Amici Curiae Supporting Apple Inc., at 4.
[137] Id. at 20.
[138] Brief for Privacy International and Human Rights Watch, as Amici Curiae Supporting Apple Inc., at 2.
[139] Id. at 2.
[140] Id. at 13,18.
[141] ACLU Amici Brief at 16.
[142] Id. at 19.
[143] Center for Democracy Amici Brief at 15.
[144] Brief for Access Now and Wickr Foundation , as Amici Curiae Supporting Apple Inc, at 4.
[145] Id. at 12, 13.
[146]Brief for Lavabit, as Amici Curiae Supporting Apple Inc.