Hacker News new | comments | show | ask | jobs | submit login
Sundar Pichai Responds to Apple and the FBI Hacking Request (twitter.com)
146 points by cryptoz 243 days ago | hide | past | web | 108 comments | favorite



> We know that law enforcement and intelligence agencies face significant challenges in protecting the public against crime and terrorism.

Do we? Crime rate has been falling. Terrorism is a statistical bleep. The majority of "crime" is government's own invention (non-violent drug-related offenses, prostitution, civil forfeiture, arresting people because they don't pay their student loans [1] [edit: not actually true, as tzs pointed out below], cop murders).

Personally, I believe that even without any ability to access any digital communication/stored data, law enforcement wouldn't be in a worse position compared to 30 years ago.

[1] http://finance.yahoo.com/news/paul-aker-us-marshal-student-l...


The majority of crime is not government invented. The majority of prisoners in prison are not there for any of the crimes you list: http://felonvoting.procon.org/view.resource.php?resourceID=0...

Besides that, the crime rate has been falling during a period coincident with aggressive policing, more incarceration, and more legal measures (RICO) to fight organized crime. While people have alternative theories for that decrease (e.g. banning leaded gasoline), aggressive policing cannot be ruled out as a reason for the decrease in crime.

Finally, tape recordings and wire taps are the backbone of investigations of sophisticated crime. It's disingenuous to pretend that pervasive encrypted communications doesn't dramatically change the landscape law enforcement is dealing with.

I happen to think the privacy benefits of encryption outweigh the cost to law enforcement, but I think it's ridiculous to pretend like there isn't real crime out there or that encryption doesn't make it harder to fight it.


First many of those crime cartels could not exist without the banning of drugs, prostitution and gambling. The same goes for violent crimes in general. Large numbers of violent crimes are done by people involved in drug dealing or consuming. If drugs were legal you would not put so many people in these situations.

Falling crime rates is happing all over the first world. Most countries have know-where near the policy infrastructure that the US has. So thats probably not a very good expiation.

Nobody says that their is no real crime. In all the speech by the state its sounds as if we are getting rolled over by a totally new wave of terror and crime while in reality its the exact opposite. What bother so many is that they underline all their arguments with this false impression.


> First many of those crime cartels could not exist without the banning of drugs, prostitution and gambling.

That doesn't mean that it's an "invented crime." It's undeniable that drugs, gambling, and prostitution have real social costs and harms. The people are entitled to regulate commerce in their society generally, but trade in harmful things especially. When people uses organized violence to circumvent that regulation, in the pursuit of profit, that is actual crime, not invented crime.

> Large numbers of violent crimes are done by people involved in drug dealing or consuming.

You're presupposing a direction of causation here. Your average street gang does not exist because of drug dealing or consumption (and indeed, violent street gangs long predate any restrictions on drugs or alcohol). They deal in drugs because it's easy money, but arise for other reasons.


When the gov't attempted to prohibit drug use, it created the opportunity for a black market in prohibited drugs to thrive. If you can accept the following:

  * Some people are going to take drugs without regard to legality.
  * Some people are going to fill the market's need for drugs through smuggling or manufacturing.
  * The government is utterly incapable (by design, actually) of completely preventing the above.
  * Without criminalization of drugs manufacturing and sales, there would be very little or no reason for violence in the drugs trade.
Then it's fair to say that criminalizing drugs use is the cause of the violence, or at least that decriminalizing drugs use will result in a reduction in violence.

>violent street gangs long predate any restrictions on drugs or alcohol

Violent street gangs opportunistically traffic in contraband because prohibition creates a dearth of supply, driving prices high enough to support an illegal black market.


You can not expect me to support the weaking of encryption and critical infrastructure just to arrest criminals who would not exist if the state policy would not be stupid in the first place.

> It's undeniable that drugs, gambling, and prostitution have real social costs and harms.

Its also undeniable that enforcing these things has real social cost and harms. In this balance I am of the opinion that it would be far superior to have a different policy.

> You're presupposing a direction of causation here. Your average street gang does not exist because of drug dealing or consumption (and indeed, violent street gangs long predate any restrictions on drugs or alcohol). They deal in drugs because it's easy money, but arise for other reasons.

That does not mean that these gangs would be much weaker and therefore less important if they could not make easy money. These are mutually supportive, a tight group can do well in a illegal market, and because of that it can produce benefits for its members, increasing memberships and power.


> It's undeniable that drugs, gambling, and prostitution have real social costs and harms

So does banking and the police. Or firearms and alcohol. Both are regulated, but not outlawed.


Heck so does "pursuing happiness". Skiing accidents. Bankruptcy when your art studio goes under. Smoking. Pretty much anything fun.

As a country, the USA is actually constituted to allow these things. Because, individual freedoms. And inalienable rights. I hear somebody want to crack down on something, I think "There goes somebody who forgot what it means to be American"


Being pedantic: pursuit of happiness and inalienable rights are in the Declaration of Independence, not the constitution. The right to regulate interstate commerce (and thus put restrictions on a lot of the fun things) is enumerated.


Being pedantic right back: the US Supreme Court refers to the Declaration as source material for the Constitution, to illuminate its intent.


There is a ruling where they refer to it as providing intent and color, but not law. And cases can only be decided based on law.

I don't think you can make a decision based solely on the "pursuit of happiness" phrase from the Declaration of Independence, but you could use it as a supporting argument for your claim.


Possible, but unlikely. According to a recent study, the majority of offenders are sentenced for violent offenses, and the majority of those sentenced for violent offenses have never been convicted of a drug crime.


>According to a recent study

Please post the study.


It's not exactly "recent", but http://harvardjol.com/wp-content/uploads/2015/06/HLL104_crop... is what I presume 'tptacek is talking about (it was discussed on HN before).


Its tricky to say, seems to me that prior conviction is not a very good metric. However I don't know any better way to figure this out either.


You can take the analysis further and observe, as that study did, that the set of people incarcerated for violent offenses is almost entirely disjoint from the set of people incarcerated for drug offenses. There is very little overlap, not just in the current prison population but over time as well.

We should end the war on drugs, of course, but we more urgently need to end what Ta-Nahisi Coates calls "the carceral state", and that will require much stiffer medicine than drug legalization.


Table 5 on page 17 http://www.bjs.gov/content/pub/pdf/p14.pdf of this report from BJS shows that half of federal prison inmates are incarcerated for drug offenses. I'd accept the notion that some of those drug offenders may have been violent, but not all of them. I suspect the violent crime statistic from ProCon rests on the habit of police and prosecutors of escalating charges for suspects where drugs are found for things that wouldn't ordinarily even be criminal (such has having a weapon in one's home).


The overwhelming majority of prisoners are in state prisons, where something like 17% of inmates are incarcerated for drug offenses. The majority of inmates are in fact incarcerated for violent crimes.


Yeah, I used the federal statistics because it's easier to find the data. Rayiner made a reasonable point about the difference in federal vs state inmates.

>where something like 17% of inmates are incarcerated for drug offenses.

I hope you don't mind if I use a single state, I know these thing will vary by state. The top drug crimes in Texas are different degrees of possession and manufacturing and distribution, and you're right, it's about 17%

>The majority of inmates are in fact incarcerated for violent crimes.

There are other crimes that aren't violent and aren't drug offenses, those appear to be about 43% (60% when you include drug offenses), and the violent ones about 40%, not a majority. Do you have a source for your "majority of inmates are in fact incarcerated for violent crimes" claim? The statistics I used are by offense, not by offender. I'm not sure how that will change if the statistics are broken down by offender.

https://www.texastribune.org/library/data/texas-prisons/crim...


Having a weapon during a drug deal is a sentencing enhancement, not a different crime. There are non-violent weapons crimes (e.g. felon in possession), but those fall under the "public order" category (see footnote c).

And remember, the vast majority of violent crimes do not fall within federal jurisdiction, so it's unsurprising that a disproportionate number of federal prisoners are in for drug crimes or other non-violent crimes (e.g. white collar crimes). But most prisoners are in state rather than federal prison.


In fairness, one could consider the "public order" "crimes" listed there to also be inventions of the state. Are legislative or prosecutorial inventiveness implicated in the increase of those from 1.9% to 13.8% of the total in less than 40 years? Over a period during which violent crime dropped precipitously, they had to do something to justify the constant construction of new prisons.


The public order category includes drunk driving and weapons offenses (mostly, felon-in-possession). Those are not inventions of the state. The public is entitled to control the possession and operation of dangerous instrumentalities that create risk of harm to others.


Harming people or property is criminal, and has been in most societies, even when automobiles or firearms are used to cause harm. OTOH "drunk driving" and "weapon possession" and indeed any "risk"-based "crime" are the epitome of invention. (The criminality of weapon possession has a long and sordid history, but not in those polities that civilized nations would care to emulate.) If all felons are so fucking dangerous, why aren't they in prison? Of course, the vast majority aren't actually dangerous, but it's still fun to deprive them of Constitutional rights! [EDIT:] The main reason why "convicts with guns" has been on the rise is probably that the number of convicts is on the rise, period.

One notes when examining the timeframe of the graph you linked that MADD was formed in 1980. That explains the legislative inventiveness; nothing drives policy like fat stacks of nonprofit cash! Take a trip to any courthouse anywhere, and you'll witness the racket that MADD, prosecutors, and municipalities have engineered to employ lawyers by depriving the poor of the mobility that would make their lives easier.

So thanks for the info; clearly the answer to my question is "yes".


It's a very narrow interpretation of democracy that doesn't give people the right to mitigate risky conduct and requires them to wait for actual harm in order to react. It's also one without a sensible limiting principle: can't require safety inspections for aircraft, gotta wait for a bunch of people to fall out of the sky first!

> nothing drives policy like fat stacks of nonprofit cash

Oh yes, that well funded concerned mother lobby. Fucking it up for sociopathic assholes since 1980.


> right to mitigate risky conduct and requires them to wait for actual harm in order to react.

Isn't that the way the judicial system typically works even when it is obviously broken? Isn't this the reason we have things like weird laws that are "unenforceable", because as a matter of policy we tend to wait for actual harm to occur before we expend effort to address it?

>can't require safety inspections for aircraft, gotta wait for a bunch of people to fall out of the sky first!

That's actually the way the FAA came into existence. The Wright brothers didn't have to send $5.00 to the FAA for a permit, or submit to safety inspections, or anything like that. Nor did anyone else, for a long time WRT the early aircraft industry in the US. https://en.wikipedia.org/wiki/Federal_Aviation_Administratio...

>Oh yes, that well funded concerned mother lobby. Fucking it up for sociopathic assholes since 1980.

There's the appeal to emotion common to arguments in favor of harsher sentencing for DUI offenders. It appears to be the case however that more and bigger sticks aren't really reducing the number of sociopathic assholes driving drunk.


You've happened upon one of the main criticisms of democracy, addressed notably in Zakaria's The Future of Freedom. But I don't say that it's invalid for the people's representatives to unjustly oppress the lawbreakers we're discussing here. I only say that they shouldn't! You can dress it up in irrelevant appeals to democracy, but we're still locking up more people than any other society that has ever existed in history, and that's wrong.

...can't require safety inspections for aircraft, gotta wait for a bunch of people to fall out of the sky first!

Don't tell any enterprising nonprofit interest-group enthusiasts, but we have "special" and "experimental" airworthiness certificates, which amount to basically that. Of course, those certificates don't cover aircraft which are naturally subject to the regulation of the state.

Oh yes, that well funded concerned mother lobby.

In fiscal year 2012-3, they spent $34,327,399, of which they spent 64.4% on actual programs. Nationally, 9 out of 10 charities spend a higher percentage. [0]

Fucking it up for sociopathic assholes since 1980.

As I have observed every one of the five or six days I've spent in various courthouses over the last five years (and as any practicing lawyer with a conscience surely has observed much more often), these laws do far more to harm the poor than they do to make the roads safe. Perhaps you've heard about protests in Ferguson, MO? Predatory policing and prosecution was one of the main focuses of that.

[0] http://www.charitynavigator.org/index.cfm?bay=search.summary...


It may have been changed, but the headline of the linked article (as of approx. 8:30AM EST) is literally "U.S. Marshals didn't really arrest a man for missed student loan payments". Failure to appear (the reason he was arrested) has long been accepted as a reason for a judge to issue an arrest warrant.

> According to a statement from the U.S. Marshals Service, Aker repeatedly refused to show up in court after being contacted several times. The agency said Aker told them by phone he would not appear in court to answer the summons. Disobeying a court order is a criminal offense. Within a few months, the judge issued a warrant for his arrest, which the U.S. Marshals carried out. So, yes, Aker was arrested, but not just because he owed a little student loan debt. He was arrested for disobeying a court order.


>According to a statement from the U.S. Marshals Service, Aker repeatedly refused to show up in court after being contacted several times.

If some one called my home on the telephone and said "I'm a US Marshal, send money to pay for a 20 year old debt." or something to that effect, I'd probably interrupt the caller to tell them to put me on their Do Not Call list and then immediately hang up the phone before they ever got the chance to explain half of it. I've received much more creative attempts than that to scam me out of money over the telephone, and I'm sure that I'm not alone in that respect. I get calls from scammers all of the time, and in related news the IRS has recently warned people that scammers are calling and using that exact same pattern but pretending to be collecting an IRS debt instead of student loans. Therefore there is zero chance that I would take a telephone call like that seriously since there is zero way to authenticate the caller. We don't know whether other the marshals tried anything other than the telephone to contact Aker, but I've seen no comment from them to indicate that is the case. Assuming they've only contacted him by telephone then the proposition is that we must all obey anyone who calls us on the phone and claims to be a government agent.


That's not how people are served court summons. It's usually done in person after the carrier confirms your identity by name.


I know and I found it odd that they only mentioned contacting Aker by telephone. It sounds strange, and probably isn't the whole story, but that's what my local (Houston area) station's news coverage indicated.


I doubt they only contacted him by phone; instead, that phone call was likely the only response he gave.


Your list of government-invented crime includes not paying student loans [1], but the article you cite for that is an article about how someone's arrest was not for not paying student loans and how many other articles misreported it as being for not paying student loans (it was for failure to appear in court).

[1] Well, actually, what you said was that arresting people because they don't pay their student loans is a crime, not that not paying student loans is a crime, but I'm assuming that was just an error of phrasing.


Yeah, I was wrong, he was arrested for not appearing in court (although it's not clear that he actually received the summons to appear in court). This was blatant spreading of FUD on my part. Props to you for actually reading the sources others post, and I am ashamed of myself and will try be more like you and read articles fully, not only skim them, in the future.


Twitter doesn't seem like an appropriate medium for a response to this issue from a CEO of a major tech company.

Hello! This isn't a picture of the burger you had for lunch or a pithy remark fest, it's the most important thing affecting your users today.

Take some time and write a god damn letter with your company's stance.


Are we (HN), the intended demographic though?

I personally get twitchy whenever I see a facebook or twitter link, but I also know that the times are changing, so I withhold my angry rants.


But if we don't rant, they won't know we don't think it's appropriate and stop.


Weird that it wasn't on Google+.


Twitter is for corporates to make announcements. Facebook is for people to socialize and get in touch. Linkedin is for professionals to collaborate. Google Plus is just a general purpose communication platform. HN and Reddit are for hackers and power users to discuss things.

Personally, I think Reddit/HN when combined with imgur.com serves all purposes in the world, there is no need for the other bloated stuff. But unfortunately, non-techies are going to be non-techies, they will never understand what is minimalism and elegance, may God help them see the light of truth, amen.


I don't think it's some kind of technical barrier that prevents 'non-techies' from using reddit & imgur, it's the incredibly toxic culture


Most non-Reddit users I know say they've tried looking at it, but just could not figure out the layout. Anecdotally, it took me a while to understand the layout/navigation.

Now that's not to say that once people do figure out how to navigate, they're turned off by the culture. However, I do think the UI has something to do with more people not joining.


I think the biggest plus of Reddit is its simplicity and minimalism with regards to content. For people for whom the written word is enough to understand and work with things, Reddit is an ideal platform. In case of the other platforms, the platform has to reach out to the user by including stuff like flashy animations, banners, embedded images, ajax, etc. which is always slow and unnecessary.


I am one of those people who feel the reddit UI sucks and needs a make over. I really appreciate simplicity and minimalism but I don't feel reddit gets it right. For example, HN is extremely minimal, but it's also extremely clean. It's very intuitive.

Personally, I feel even 4chan is much cleaner than reddit (yes I know 4chan uses linear threads while reddit supports branching. Hence the HN example)


I hear this all the time, but I must never go into those areas of reddit as I never see this. The comments and feedback on the subs I subscribe to are very similar to what you might see here on HN.

I guess if one stays on the main roads and doesn't stumble into the dark alleys, he'll be ok.


Especially when it has to be broken into 5 posts


They also made a post about it.


This is the most concise summary I have found on the legal issues/possible ramifications concerning this case. The worry in this case is the troubling precedent it would set.

https://lawfareblog.com/not-slippery-slope-jump-cliff

Quotation from, Not a Slippery Slope, but a Jump off the Cliff By Nicholas Weaver.

The request to Apple is accurately paraphrased as "Create malcode designed to subvert security protections, with additional forensic protections, customized for a particular target's phone, cryptographically sign that malcode so the target's phone accepts it as legitimate, and run that customized version through the update mechanism". (I speak of malcode in the technical sense of "code designed to subvert a security protection or compromise the device", not in intent.)

The same logic behind what the FBI seeks could just as easily apply to a mandate forcing Microsoft, Google, Apple, and others to push malicious code to a device through automatic updates when the device isn't yet in law enforcement's hand. So the precedent the FBI seeks doesn't represent just "create and install malcode for this device in Law Enforcement possession" but rather "create and install malcode for this device".

Let us assume that the FBI wins in court and gains this precedent. This does indeed solve the "going dark" problem as now the FBI can go to Apple, Cisco, Microsoft, or Google with a warrant and say "push out an update to this target". Once the target's device starts running the FBI's update then encryption no longer matters, even the much stronger security present in the latest Apple devices. So as long as the FBI identifies the target's devices before arrest there is no problem with any encryption. But at what cost?


This is precisely why I think the San Bernardino case is ideal for the FBI to establish this precedent. If they actually wanted access to the device they could have served Apple a National Security Letter and had it done on the sly. But they're taking the public route on this one because of how bad Apple would look if they refused to unlock the phone of a known terrorist. That's probably why Apple had to go out of their way in the letter to say that they don't want to aid or abet terrorists in any way (something that's fairly obvious to us).


they could have served Apple a National Security Letter and had it done on the sly

NSL's don't work like that.

A national security letter (NSL) is an administrative subpoena issued by the United States federal government to gather information for national security purposes... By law, NSLs can request only non-content information, for example, transactional records and phone numbers dialed, but never the content of telephone calls or e-mails.[1]

Apple would challenge a NSL on three grounds:

1) The subject of this investigation in this is dead. The secrecy requirements are unrequired.

2) What the FBI wants here is not information, it is to force Apple to do work. That's why they've had to try the Writs act - it's a pretty unprecedented thing to try

3) The information requested is not "non-content"

I'd say Apple would have a good case on any of these grounds, and the FBI knows it.

[1] https://en.wikipedia.org/wiki/National_security_letter


Stallman sounds less and less crazy every year.


Nobody ever said the danger that he was talking about are not real. However his is still a very edge position.


RMS was openly ridiculed and scoffed at until the Snowden revelations.


It nearly happened with Hushmail, who say they would have been forced to serve a malformed Java app in order to comply with the warrant. The fact they didn't is only because they had access to the email without needing to do that.

http://www.wired.com/2007/11/encrypted-e-mai


There is full 'tweetstorm' that follows (this is 1/5), but I don't know how to link to that. Is it possible to link to a series of tweets?

2: https://twitter.com/sundarpichai/status/700104342720761856

3: https://twitter.com/sundarpichai/status/700104383762026496

4: https://twitter.com/sundarpichai/status/700104433183502336

5: https://twitter.com/sundarpichai/status/700104478360342528

Or we can read an article by The Verge: http://www.theverge.com/2016/2/17/11040266/google-ceo-sundar...

Another Edit, OT: Twitter is really, really, really hard to use. Stop worrying about onboarding new users, please make twitter usable for existing users.


Storyify does a good job of making these readable:

https://storify.com/fuzzywah/sundar-pichai-responds-to-apple...


...once you get over the learning curve.


This is a pretty lame response. Could be a troubling precedent? Really?

Tweeting it also seems to massively trivialise it.


Not quite as hard hitting as I would've hoped.

Gruber's take: http://daringfireball.net/linked/2016/02/17/pichai-apple-fbi


Gruber's response is lukewarm too. Pot calling the kettle black.


He's a blogger, why does his response matter? It's the response of the tech companies that matters.


Gruber has been posting about this all day, and I'm not sure I'd call his reaction lukewarm.


Shocking, Gruber dismissing something from Google.


I'm not sure I understand the distinction he's making. G will comply with "valid legal orders"; what is not "valid" about the order Apple got? Why is granting law enforcement different from hacking devices, the point of which is to gain access to data?


I believe the difference is that Apple/Google are okay with turning over user data on a case-by-case basis provided there's a proper subpoena from a judge, but not okay with building a tool for the FBI that will allow them to look at any user's data. The former is equivalent to allowing the government to open your mail and wander around your house provided that they've obtained a search warrant. The latter is equivalent to building a tool that would allow the government to open anyone's mail and wander around anyone's house without a search warrant.


I don't think Apple has been asked to build a tool, just to help unlock a single device.

I think Pichai is making a distinction between handing over data they already own (eg. a Gmail account) and data stored on user-controlled devices, which must be hacked to access.

Which is interesting, since he's essentially admitting that their push to send everything to "the cloud" makes their users less safe from governmental snooping (justified or not). Of course, we already knew that, but it's curious to see Google's own CEO say it.


Actually, this is a quite interesting distinction to consider. There is significantly more danger in hacks which can "scale" due to centralization and non-physical access compared to physical access.

In the case of cloud data, the government should be held to a higher standard of restriction, because all of the data is in one location, and requires only a single "factor", the identity of the target to collect data for. This applies to both "encrypted at rest" and "encrypted in flight" data.

But for data encrypted at rest on actual physical devices, there's an inherent '2-factor' security to the private invasion. The government must not only know the identity of the target to collect the information, they must possess the physical device as well. ("something you know" + "something you have")

This means, IMHO, there is far less danger, and far less scalability to "one off" hacks like the ones being requested to Apple. They don't scale to Snowden-level dragnets, they don't present low transaction cost barriers to acquisition.

The dangerous think for decentralized data is having an active attack on the device, or something which intercepts the data "in flight". These are scalable attacks you need to worry about. E.g. "push a key logger to every iphone software update"

Perhaps the law needs to make a distinction to warrants for 1-factor data vs 2-factor data, due to the inherent danger of 1-factor data, given that it scales easily to monitoring millions with little transaction cost.

So in this regard, I think there should be MORE push back for collection of cloud data, but individual one-offs for physical devices have a safer threat model.

I view this more like a Vault being found at the home of a murderer, and the cops asking the Vault maker to help unlock the Vault without revealing the proprietary locking mechanism, or without the cops needing to blow up the vault and potentially lose whats inside.


> I think Pichai is making a distinction between handing over data they already own (eg. a Gmail account) and data stored on user-controlled devices, which must be hacked to access.

No, Pichai is making a distinction between giving the information after a correct process and developing a backdoor to slurp the data. It has nothing to do with cloud/device differences


That's a distinction without a difference, since in practice they only need a backdoor to get data from the user's devices and not from their servers.


I don't think Apple has been asked to build a tool, just to help unlock a single device

Aside from the non-sequitur, what Apple has been asked for is a custom build of iOS.


Fine, but it's custom build locked to that particular device and which Apple can install itself, without providing it to the FBI. It's certainly not "a tool for the FBI that will allow them to look at any user's data".

https://assets.documentcloud.org/documents/2714001/SB-Shoote...


Once they made it, locked for that device, the FBI knows Apple can make it again, locked for another device. The tool is for any user's data, via a court order on Apple.


But Apple would still need to have the court orders for each user.

Some people are suggesting that Apple would create this back-doored code, and hand it to the FBI, who would then use it to access any data they want without bothering with court orders. That doesn't seem to be what the FBI are asking for.


> But Apple would still need to have the court orders for each user.

Yes, and Apple doesn't want this as a precedent. It does away with one of their go-to selling points these days: security/privacy.

If device security can be surreptitiously undone by an OTA upgrade, what's really the point? I'm sure the brilliant legal minds at the DoJ can come up with creative interpretations to enable the next stage, which would be to do this in bulk as a special point-release.


Once the iSpecialPhone is unlocked, can't the FBI image it and diff the hack out of the image?


Once created, what stops the Government from obtaining a copy of the modified OS and the means to sign/encrypt it for any device? Either via some top-secret "You can't tell anyone about this or you go to jail" process, or via an agent embedded in the company?


What stops them from using those mechanisms to create it in the first place?


Knowledge and skill, evidently.


That's stretching the jargon a bit. I know that's what Cook said, but it could be a one-off process without the "custom build" leaving Apple's hands. Basically, comment out the time-delay and wipe code, build, sign, and push to the device.

Really the most important part there is the "sign" step, and the fact that the FBI isn't straight-up asking for the signing keys is telling; they didn't want this request to escalate the way it has.


They don't want the signing key because that sets the wrong precedent.

The precedent they want is that All Writs can be used to force Apple into creating a backdoor.

The next step is an online attack backdoor which slurps data over LTE from a suspect's device while it is unlocked.


Well, if they aren't being asked to build a tool, then there's nothing for them to help the FBI with because the device functions as designed.

It is precisely the design of the device that the FBI wants Apple to alter using some sort of tool that Apple will make for them.


My point was just that the FBI didn't ask Apple to "build a tool for the FBI that will allow them to look at any user's data". They asked Apple to prevent some security mechanisms of that particular device from working. Whether Apple builds a tool or uses manual labour with existing tools to do so is irrelevant for the FBI.


What IS relevant for the FBI is establishing legal precedent under the Writs act for compelling them to do so.


The point that gets lost here is that it's close to impossible for Apple to build a tool that will only allow them to look at any users data. Once the tool exists it's a simple hexedit away from working on anyones phone. While the court may be asking for something single use that same court may not understand the full implications of what they are asking. Thus the need for a public discourse on the topic.


It's not an hexedit away because Apple won't have to provide it to the Feds, hence they can still demand a court order each and every time. Except for the cost, it's no different than if they had to re-build it every time.


They haven't explicitly asked for that specifically, but that would be the consequence of fulfilling the request.


The FBI claims they're willing to accept a device-locked hack, that it's fine if it is only RAM-resident, and that Apple may keep the device on their own premises so long as FBI can attempt multiple pin entries electronically without risking a wipe.

http://www.zdnet.com/article/this-is-how-the-fbi-wants-apple...


The order has been issued properly, so it is valid, but Apple et al will claim that it violates their constitutional rights. So the order can be issued but not enforced. That;s the "illegal" aspect.


Lame but not unexpected comments from a company living off their users' data - it's quasi by definition that privacy isn't something GOOG is particularly interested in at all as the lack of it is at the very core of their own creepy business model.

Each of us info-tech "professionals" downplaying this reality by falling for GOOG marketing are not merely cattle but sheep. Cool open-source projects count as successful opinion manipulation ("marketing") as well btw (Angular, Kubernetes, etc).

I admit it, I'm a sheep meeeeeehmeeeeeehmeehmeh but it might be about time to finally change that meehmeehmeh.


So Google undoubtedly know a lot about you. This knowledge also powers a large number of highly useful features.

e.g.

* Remind me that it's time to leave for my meeting. Taking traffic and preferred method of travel into account.

* Alert me about that breaking news story that I'm really interested in following.

* Tell me what the weather is going to be like when my plane lands.

All of these are things I value and they are only possible if Google knows enough things about me to answer those questions. A phone can't power it you need software running in a datacenter somewhere. People want these features which is why Google is able to make money.

Everytime this topic comes up people rant about how Google is creepy but it's disingenuous because the tradeoff is Incredibly useful features vs user privacy.

It's a perfectly valid position to want governmental protections for one's data to provide some recourse for violations of your privacy while still enabling those same useful features.


Was this a complete thought ? Also if the user posts something like this on facebook does it carry less gravitas then Twitter . Can we stop giving Twitter comments some mystical value .


Comments from Google CEO on an extremely pressing issue have value regardless of the medium where they are posted. Twitter just happens to be the place where such discussions often happen.


Is there literally no other way that the FBI could get the data off the phone?

I'm sure they could download the memory, stick it all in some kind of iOS VM and try every 4-digit PIN in no time, all without worrying that the phone would self-destruct.

Couldn't they?


No. Flash memory is encrypted with a key that is derived not only from the PIN but also an ID that is fused into the device when it is manufactured. If we exclude the possibility of a backdoor there is no way to retrieve this ID expect from the silicon itself.

Encryption keys are stored unencrypted in RAM, but only as long as the device is active. RAM loses it's content quickly when it is not refreshed every few micro seconds. Moreover the RAM in the iPhone is a package on package design which makes it hard to connect to it.


To be fair, the way Cook went to media with this is not at all an order of magnitude better than the way Pichai did.

Consider that if Cook had wanted to make the statement more official and tie his company to this stance, he could have very easily ordered investor-level press release and then linked it from the homepage for general public awareness. That would cause a much bigger shockwave.


How long would it take, given the immense computing capabilities of the government, to try every possible permutation of Apple's signing keys in order for them to be able to sign their own home-grown version of iOS? With over a billion devices at stake, isn't that what intelligence agencies would actively be targeting?


Using brute force (i.e. "immense computing capabilities") for properly sized keys is unlikely to ever be practical with classical computers. With quantum computers, many currently deployed key lengths that would be impractical to brute force with classical computers would become vulnerable to attack, but nobody is currently known to have quantum computers of sufficient power. See Wikipedia for basic details[1].

IMO, an intelligence agency would be more likely to invest in other methods (algorithm implementation weaknesses, software bugs, insider access, etc), due to the higher liklihood of sucess.

That said, it's interesting to note that the NSA is moving towards "post-quantum" cryptography[2], under the assumption that suitably powerful quantum computers will be, or have been, built. Whether the NSA already has such suitably powerful quantum computers is anybodys guess.

[1] https://en.wikipedia.org/wiki/Key_size#Brute_force_attack [2] https://www.nsa.gov/ia/programs/suiteb_cryptography/


Very interesting. I wonder how one feasibly could test "quantum resistant algorithms" without having a quantum computer to test it against.


The same way we create and vet conventional cryptography: withstanding public scrutiny of experts until we are reasonably confident that there are no major issues. Most attacks are theoretical and require only novel analysis and a new bound on computational difficulty, not a proof of concept (i.e., algorithms are abandoned by cryptographers long before attacks become feasible).

Post quantum algorithms are simply algorithms designed and analyzed against a stronger threat model. Some of the attacks and techniques are still being developed, so no one knows if new quantum algorithms will be invented tomorrow that trivialize certain problems but the same danger is present to some extent for conventional cryptography today.


I would much rather he wrote something more formal and stopped with the weak sounding 'could'.


This would have more force if G didn't have a history of siding with tech giants on moral issues. 2 CEOs ago, apple asked G to collude in a hiring scam and G replied with an emoticon.

If the device were truly secure we wouldn't be having this conversation. Alternatively, if law enforcement wanted to get into a dead guy's filing cabinet on suspicion of conspiracy murder, with a valid court order, there wouldn't be any outrage.

We're being bamboozled by a PR campaign in favor of closed-source software. If the guy was still alive apple could just push him an IOS update containing backdoors galore. This is not a secure device!


Apple complies with Chinese authorities and not US?


Maybe the Chinese authorities have broader power in China than the FBI has in the US.


Apple never complied to this type of request to Chinese authorities. Source?


Is China , you remember a communist country wrought with corruption . That most Americans businessmen feel is the cause of and solution to off of their problems .


[flagged]


Translation: I'm trying hard but I don't have the level to even start a flamebait


I really wish the restrictions can be reduced or removed so @pmarca etc can tweet more on the companies of which they are the directors of. Same for the CEOs itself, and CEOs and other executives should be allowed to tweet at board of directors and vice versa.


Google owns blogpost. Google has several blogs there. Surely it'd be a vote of confidence for him to use it?


But then nobody would read it. Go where your public is.


This is why we invented links. Something can be posted on twitter without twitter being the primary source.




Guidelines | FAQ | Support | API | Security | Lists | Bookmarklet | DMCA | Apply to YC | Contact

Search: