
Apple May Use a First Amendment Defense in That FBI Case. And It Just Might Work - corneliusjac
http://www.wired.com/2016/02/apple-may-use-first-amendment-defense-fbi-case-just-might-work/
======
exelius
IMO the US intelligence apparatus likely already has Apple's publisher keys
(we know they had Microsoft's at one point for Stuxnet, so this is entirely
plausible). The FBI is far less advanced than the NSA/CIA on computer
crime/crypto, likely to the point the NSA/CIA would not share information with
them for fear of its existence being leaked through an overzealous
investigation of a mass shooter who almost certainly never interacted with
anyone in ISIS of any importance.

This is probably a gambit by the FBI to get access to this type of data for
their other criminal investigations. If it is publicly known that the FBI has
a way to break iPhones, they can lean on the NSA/CIA to provide more effective
methods (without breaking cover of the existence of those methods.)

IMO a better tactic is the one the NSA has taken: let the industry build it,
and we will hack it. This is just better tradecraft because it lulls targets
into a false sense of security. Look at the engineering behind Stuxnet and the
Equation Group viruses - these guys are obviously in another league from the
FBI (and likely even from Apple). Given the gap in skills and mission, I don't
blame them for not trusting the FBI.

~~~
lawnchair_larry
You have some details mixed up there. Stuxnet did not use any domestic
certificates. You're likely thinking of Flame, which still did not involve
stealing keys or certificates, but rather exploiting a flaw relating to how
certificates were issued to the general public.

~~~
exelius
Well, just remember that when you're dealing with clandestine agencies like
CIA/NSA, they can probably either turn or place an asset in one of Apple's
security teams and get access that way. Their evidence collection methods
don't have to hold up in court.

~~~
TACIXAT
Well, you should edit your post so it is accurate.

------
studentrob
So, signing the code constitutes Apple saying this code is safe to run. But
Apple doesn't think this code is safe to run. The argument will be that
forcing them to sign the modified code is compelled speech. Interesting.

Is there any reason Apple can't use more than one argument in its defense?

According to USA vs. New York Telephone, "unreasonable burdens may not be
imposed". I think Apple will bear quite a burden if it must force its
engineers to implement this code. It will be telling them to reverse their
work and go against company values. Also, the public is going to know the
outcome of this case. If Apple doesn't come out cheering, we will all know its
security features have been weakened, which will impact sales.

~~~
PascalsMugger
> go against company value

I wonder how it would go down if they said it was against their religion, a la
Hobby Lobby.

~~~
khedoros
Hobby Lobby's argument (and the supreme court decision in their favor)
involved the element of being "closely held". Apple would need to have over
50% of its stock owned by 5 or fewer individuals to satisfy that requirement.

------
twoodfin
This is a good reminder that "Corporations aren't people!" is something of a
know-nothing argument, and also didn't suddenly spring into relevance with
_Citizens United_.

 _Of course_ Apple can invoke the First Amendment just like you or I could to
avoid compelled speech. They may win or lose that argument, but it's not going
to be thrown out just because they're a corporation.

~~~
Zigurd
Or you can look at it this way: Since we've gone down that road, let's squeeze
as much good out of a bad decision as we can. By any means necessary.

~~~
jeffdavis
I feel that the anger about the citizens united decision is misdirected.

People speak and act. The fact that they do so on behalf of a corporation is
not of primary importance.

By saying that there's "corporate speech" and "personal speech", and that the
latter is protected and the former not, is essentially the same reasoning that
allows corporations to commit crimes with no personal crimes taking place.

------
zimbatm
What if Apple was in the business of safes and built a really strong to crack
safe. There would be 10 attempts to open it or all the content would catch on
fire. Is it unheard of that the government would seek the help of that kind of
company in similar cases ?

The argument that the newly-developed technique could be stolen by unwanted
adversaries is the same. In both cases the government has to get hold of the
physical object to crack the (digital) safe.

~~~
rm_-rf_slash
No safe contains as much value to a person as a phone does. A phone contains
everything. Everything. All your texts, all your browsing data, all your apps
and the things you record in them, safe from the world behind a passcode.

To apply your argument, your safe is a Narnia portal that brings you access to
every facet of someone's life, all to track down the contents that fit on a
few pieces of paper.

Equating smartphones with physical safes is ridiculous.

~~~
zimbatm
Certainly that's an issue with the scope of the warrant. Similarly to the
judge only giving access to the car or the living room. I agree that
smartphones are blurring the distinction between the brain and the physical
world and the day where devices exist to read our thoughts we will have to
make a decision if that is off-limit or not.

------
jofo25
If code is speech, does this mean anyone can write code to perform any kind of
task (nefarious or otherwise) and be protected by the First Amendment? It
seems difficult to parse that someone could write some code that for example,
to break someone's pacemaker or life support machine and that person would be
protected by free speech.

Maybe in that scenario, it would be the author who writes that code who would
be protected but the person who executes the deadly code who is breaking the
law?

~~~
IceyEC
Not all speech is protected:

Holmes's famous phrase means that not all forms of speech are protected. For
example, the First Amendment does not protect obscenity, child pornography,
true threats, fighting words, incitement to imminent lawless action, criminal
solicitation or defamation.[1]

[1]: [http://1forall.us/teach-the-first-amendment/the-first-
amendm...](http://1forall.us/teach-the-first-amendment/the-first-
amendment/#a3)

~~~
dragonwriter
"Holmes famous phrase" was an emotional argument irrelevant to the facts of
the case it was offered in, unsupported by the case law then or now, in one of
the most repugnant, anti-free-speech decisions in history, which allowed
criminal punishment for pure political speech (and which has since been
overturned.)

~~~
pdabbadabba
I agree with you about _Schenck_ , but I'm not sure what this has to do with
the broader point at hand. Whatever you might think about _Schenck_ , it is
indisputably correct under American law that there are significant categories
of speech that can be either proscribed or compelled. _Schenck_ is just one of
very many cases that demonstrate this.

------
rrauenza
What prevents the FBI from issuing a subpoena for the signing keys and
patching the existing binary?

~~~
Zigurd
There is no law enabling them to do that. However, once the all writs is used
to compel code creation, it surely will not stop there.

~~~
rrauenza
...I still don't understand why not:

[https://en.m.wikipedia.org/wiki/Key_disclosure_law#United_St...](https://en.m.wikipedia.org/wiki/Key_disclosure_law#United_States)

I have also been wondering if this is the wrong iPhone to take a stand on
since it is owned by the employer, not the dead terrorist -- and the employer
wants it unlocked.

But I guess this is more about forcing a company to manufacture an ad hoc
backdoor than protecting the privacy of the owner of the device (my
understanding is that if your employer owns the device, there is no privacy.)

------
nsxwolf
How much work can the government require you to do in order to comply with a
warrant? There must be limits. When does it become involuntary servitude?
Obviously not when we're talking about handing over something in your
possession, but how much code can they make you write?

~~~
rayiner
Courts are entitled to reasonable cooperation from third parties to facilitate
the administration of justice. Turning over documents, showing up for third-
party depositions, testifying in front of a grand jury, drilling into a safe
deposit box, etc. In Anglo-American law, that idea predates even the
Constitution.

But at some point, cooperation goes beyond reasonable into the area of
"unreasonable burden." As a practical matter, the test tends to be one of
economics. How much does it _cost_ to comply, and is that cost a reasonable
one given the party being compelled?

------
Twisell
And there is one more thing...

If Apple is finally compelled to write this backdoor code, and that backdoor
code is used against a lawful customer, what happen if this customer then trie
to sue Apple?

Will the DOJ be sued as well as they might be fully responsible? And could
Apple sue DOJ as well for irremediable arm against his product safety?

------
jasonlaramburu
Would it be a reasonable compromise for the FBI to turn the phone over to
Apple, allow Apple to access the data using whatever method it deems
necessary, transfer whatever data is recovered to the FBI and then destroy the
phone along with any custom FW Apple had to develop in the process?

~~~
carbocation
One of the strengths of Apple's arguments is that they do not have software
that the government is trying to compel them to provide. The government
compelling the creative act of making this software is not something that has
occurred under the All Writs Act previously, as far as I am aware, so this
would set precedent.

Once the software is already created, it is, at worst, just a question of
getting the timing right for the next request in order to make such an order
(to provide software to assist in the unlocking of phones) merely ordinary.

Aside from some arcana, what you are proposing is equivalent to the FBI's
position, which I think many here disagree with.

~~~
jasonlaramburu
Not exactly. My understanding is that the FBI wishes for the phone in question
to remain within FBI custody at all times, which makes it more likely that any
custom FW Apple develops could be leaked or replicated. What I propose
(obviously a compromise) is for everything (FW creation, brute force attack,
download of data) to occur within Apple's custody, network, and for Apple to
then destroy the phone. Apple would not even need to disclose publicly how
they accessed the data on the phone.

------
13thLetter
This makes me want to cry -- not the FBI overreach, but the "This, And
Clickbait" sentence structure. Don't they teach how to write headlines any
more in journalism school?

------
lisper
While I would love to see this argument succeed, I doubt it will. Free speech
already has limits on both the affirmative and negative sides. Shouting fire
in a crowded theatre is not protected, nor is remaining silent if the
government decides to label you an "enemy combatant". So I'm not optimistic
that Apple's argument will succeed. The fear of drugs, pedophilia and
terrorism seems to trump the First Amendment -- and the Fourth, and the Fifth,
and the eighth, andthe Forteenth -- pretty reliably nowadays.

Alas.

~~~
rayiner
You're mixing together quite a few different things. You can't use speech to
incite a physical reaction/panic/riot. That crosses the line from simply
communicating to taking action. And the right to not speak is protected by the
5th amendment. If you're an "enemy combatant," you're sitting in somewhere in
Iraq or Afghanistan, and the 5th amendment doesn't apply because the person
isn't a U.S. citizen and they're not on U.S. soil.

~~~
lisper
> the right to not speak is protected by the 5th amendment

No, it's not. The right not to _incriminate yourself_ is protected by the 5th
amendment. People are subpoenaed and forced to speak all the time. That's why
Apple isn't making _that_ argument. (They do have a 5th amendment argument
too, but it's not based on self-incrimination.)

> If you're an "enemy combatant," you're sitting in somewhere in Iraq or
> Afghanistan

It has never been put to the test (because the scenario is pretty unrealistic)
but do you really think that if a U.S. citizen on U.S. soil made a credible
claim to have planted a nuke somewhere in NYC, that the government would not
mount an argument that the Constitution allows them to waterboard that person
to get them to reveal the location of the bomb? And that they might win?

------
er0k
I am not a lawyer, but how about a 13th amendment defense?

------
johansch
Don't click Wired links if you don't want to pay them. They have an ad-
blocker-blocker that kicks in after you have read half of the article or so -
and you get no clear warning before this.

~~~
pljns
Disable Javascript ;-)

~~~
dmm
Also when people say "Disable javascript" they don't mean go into Preferences
and disable javascript. They probably mean install noscript which allows you
to blacklist-by-default and enable js with a button click when needed.

~~~
dsp1234
In Chrome you can have javascript disabled by default, then whitelist all of
the javascript on individual hosts (it does execute all of the javascript on
the page, as compared to noscript).

Then on each host, Chrome starts off with no javascript, and there is an icon
in the URL bar to enable it. Thus I can enable all javascript for trusted
hosts. And in regular mode, that change is permanent, so I'm not bothered

Additionally, open up an incognito, and allow javascript for a host, and that
decision is only valid as long as the incognito window is open.

So the workflow is:

1.) Always surf with javascript disabled

2.) Permanently allow all trusted hosts

3.) When needed, temporarily allow a host via incognito (ex: blogspot sites)

This does not require any additional extensions.

------
swehner
This argument sounds so hokey. Similar to the non-exectation-of-privacy-when-
using-tor argument,
[https://news.ycombinator.com/item?id=11166991](https://news.ycombinator.com/item?id=11166991)
The US legal system appears as a special case

~~~
exelius
It has to be - our legal system is based on rule of law. You often see lawyers
go after First Amendment defenses because the First Amendment is legally part
of the constitution, and thus overrides any and all other laws. Of course, a
judge has to agree with the argument - and considering when the Bill of Rights
was written, that argument is likely going to be a bit roundabout given the
progress we've made in ~250 years.

~~~
swehner
Not sure what you're saying, what has to be?

~~~
exelius
Any modern argument based on laws written 250 years ago is going to
necessarily be roundabout. If the problem was straightforward, there would
probably be established case law addressing it.

~~~
swehner
Why do you say "a judge has to agree with the argument" \-- surely they don't
need to agree with hokey arguments.

------
throwaway1756
All this is reminding me not a little of the original crypto wars when
Zimmerman was up against the feds in the headlines semmingly every other day.

In the end publishing the source code as a literal, printed book and exporting
it from the USA as printed material (Free Speech!) then OCRing the contents in
whatever country they wanted to get it to only now we already have a precedent
for code is speech and those extra steps might not be necessary.

