Habeas Data Read online

  According to the Wall Street Journal, Cole laid out a chilling prediction: “At some future date, a child will die, and police will say they would have been able to rescue the child, or capture the killer, if only they could have looked inside a certain phone.”

  The assembled team from Apple, which included its top lawyer, Bruce Sewell, found this assertion to be inflammatory. Law enforcement had many other ways of gaining information about criminal suspects that didn’t involve busting into a seized phone—they could grab the cell phone’s location data, or seek other electronic records.

  “We can’t create a key that only the good guys can use,” Sewell told DOJ officials, echoing the key escrow discussion from a decade earlier.

  As 2014 drew to a close, there were at least a handful of publicly known instances where the government invoked the All Writs Act to compel Apple’s assistance in unlocking an iPhone or iPad. Taken together, these cases offer a preliminary road map as to how the government and Apple came to the brink of a legal battle in 2016 after San Bernardino.

  “This Court has the authority to order Apple, Inc., to use any capabilities it may have to unlock the iPhone,” Garth Hire, an assistant US attorney, wrote to the court on October 31, 2014, citing the All Writs Act. “The government is aware, and can represent, that in other cases, courts have ordered the unlocking of an iPhone under this authority…Additionally, Apple has routinely complied with such orders.”

  “This court should issue the order because doing so would enable agents to comply with this Court’s warrant commanding that the iPhone be examined for evidence identified by the warrant,” he continued. “Examination of the iPhone without Apple’s assistance, if it is possible at all, would require significant resources and may harm the iPhone. Moreover, the order is not likely to place any unreasonable burden on Apple.”

  In April 2015, a House committee heard testimony from law enforcement that Apple’s hardened stance posed a grave threat to law enforcement, and that any notion of a key escrow system was impractical.

  “Backdoors create unnecessary vulnerability to otherwise secure systems that can be exploited by bad actors,” Rep. Ted Lieu (D), a congressman with a computer science degree who represents western Los Angeles County, told Ars Technica at the time.

  Backdoors are also problematic because once one government asks for special treatment, then other governments with fewer civil liberties protections will start asking for special treatment. In addition, computer code is neutral and unthinking. It cannot tell if the person typing on a keyboard trying to access private data is the FBI Director, a hacker, or the leader of Hamas as long as that person has the cryptographic key or other unlocking code. The view that computer backdoors can only be used by “good guys” reflects a lack of understanding of basic computer technology.

  Echoing this lack of understanding, Cyrus Vance, Jr., the district attorney for Manhattan, even testified before Congress in 2015: “Criminal defendants across the nation are the principal beneficiaries of iOS 8, and the safety of all American communities is imperiled by it.”

  As 2016 rolled around, there were three failed state bills proposed in New York, California, and Louisiana that would have made strong encryption effectively illegal, but the proposals went nowhere.

  * * *

  This lengthy back-and-forth between federal law enforcement and tech companies finally came to a head in February 2016, when Apple received that first court order requiring the company to build a custom-made operating system that would bypass the passcode lockout on Farook’s iPhone.

  As federal prosecutors pushed forward at a breakneck speed, Republican presidential candidate Donald Trump weighed in from the campaign trail, with a not-entirely-accurate description of what was going on.

  “First of all, Apple ought to give [authorities] the security to that phone,” Trump told the crowd at a South Carolina rally. “What I think you ought to do is boycott Apple until they give that security number. I just thought of that—boycott Apple.”

  Later that day, Trump told Bloomberg that he would somehow pressure CEO Tim Cook into complying: “I would come down so hard on him—you have no idea—his head would be spinning all of the way back to Silicon Valley.”

  As Apple lawyers and Boutrous poured over the motion to compel, they realized that the government admitted that it may have inadvertently screwed up by disabling auto iCloud backup on the iPhone. Once they realized the government’s error, Apple officials and their attorneys invited reporters nationwide to a hastily announced conference call.

  During the Friday call, an Apple executive who was granted anonymity said the company has been diligently working with the FBI to try to aid the terrorism investigation. After days of working with the FBI, Apple proposed one final attempt to recover roughly six weeks of data that was locked on the phone.

  The idea was to force the iPhone 5c to auto-backup to Farook’s iCloud account. With a court order, Apple can and does routinely turn over iCloud data. For some reason, Farook had not backed up the phone for roughly six weeks prior to the attack. The executive said Apple does not know whether the auto-backup was disabled or enabled, but he did say that the previous iCloud backups, which were handed over to investigators, were sporadic.

  Apple suggested that the FBI take the iPhone 5c, plug it into a wall, connect it to a known Wi-Fi network, and leave it overnight. The FBI took the phone to the San Bernardino County Health Department, where Farook worked prior to the December 2, 2015, attack.

  When that attempt did not work, Apple was mystified, but soon found out that the Apple ID account password had been changed shortly after the phone was in the custody of law enforcement, possibly by someone from the county health department. With no way to enter the new password on the locked phone, even attempting an auto-backup was impossible. Had this iCloud auto-backup method actually functioned, Apple would have been easily able to assist the FBI with its investigation.

  Two days later, FBI Director James Comey weighed in, in a lengthy public statement.

  “The particular legal issue is actually quite narrow,” he wrote. “The relief we seek is limited and its value increasingly obsolete because the technology continues to evolve.” Here, Comey used the Going Dark language so pervasive among law enforcement. His point was that even if Apple helped the DOJ for the San Bernardino case, Apple would soon outdo themselves with new kinds of security in new generations of iPhones.

  “We simply want the chance, with a search warrant, to try to guess the terrorist’s passcode without the phone essentially self-destructing and without it taking a decade to guess correctly,” Comey said. “That’s it.”

  The following day, February 22, Apple CEO Tim Cook wrote an e-mail to employees that was quickly released to the public, arguing that what the government was asking was a step too far.

  “Yes, it is certainly possible to create an entirely new operating system to undermine our security features as the government wants,” he sad. “But it’s something we believe is too dangerous to do.”

  * * *

  While all of this was going on, there was another important ruling by one of the judges that comprised the Magistrates’ Revolt.

  On February 29, 2016, Judge Orenstein ruled that Apple did not have to unlock a seized iPhone 5s running iOS 7. This case didn’t involve the creation of new software, but was merely a task that Apple could perform with little effort—it had done so numerous times previously. Prosecutors in New York, like in San Bernardino, had argued that the All Writs Act gave it such authority.

  The New York case began back in October 2015, when Judge Orenstein invited Apple to tell the court why it believed the government could not compel it to unlock a seized phone. At the time, bringing Apple into a case like this was new.

  Nine days later, defendant Jun Feng pleaded guilty to one count of conspiracy to distribute and possession with intent to distribute methamphetamine. Judge Orenstein then asked prosecutors why the issue of Apple’s compliance was
still relevant given the guilty plea. In the government’s own filing, dated October 30, 2015, prosecutors said that the investigation was not over and that it still needed data from Feng’s phone. (Later, a district court judge overruled Orenstein, but eventually authorities got the passcode from someone else.)

  Orenstein’s conclusion largely echoed what Apple’s attorneys had argued. “Finally, given the government’s boundless interpretation of the All Writs Act, it is hard to conceive of any limits on the orders the government could obtain in the future,” he wrote. “For example, if Apple can be forced to write code in this case to bypass security features and create new accessibility, what is to stop the government from demanding that Apple write code to turn on the microphone in aid of government surveillance, activate the video camera, surreptitiously record conversations, or turn on location services to track the phone’s user? Nothing.”

  Days later, on March 1, 2016, both Comey and Apple’s top lawyer, Bruce Sewell, testified before Congress. This was, again, extremely unusual. On March 11, President Barack Obama weighed in as well, speaking at the South by Southwest tech conference in Austin, Texas. “I suspect the answer will come down to how can we make sure the encryption is as strong as possible, the key as strong as possible, it’s accessible by the smallest number of people possible, for a subset of issues that we agree are important,” Obama said. “How we design that is not something I have the expertise to do.”

  For Boutrous, in a lifelong legal career, the way this case was unfolding was unprecedented.

  “I never had a case where I had the president, the attorney general, the director of the FBI, all weighing in,” he said. “They were all participating in the debate about what the right results would be in an ongoing case that was unfolding so rapidly.”

  Meanwhile, Boutrous was shuttling between Cupertino and Los Angeles. He was participating in mock hearings and preparing his arguments.

  On Thursday, March 17, prosecutors told Boutrous and Apple’s lawyers that they wanted the upcoming hearing to not just be procedural, but rather an evidentiary hearing with in-person testimony. If that had happened, Apple’s rank-and-file experts would not only have to discuss their abilities to obey the governments orders, but Apple would have the ability to question government officials, and find out how far they had or hadn’t gone already.

  “They want to call live witnesses, including our engineers,” Boutrous said. “One of the core things we wanted to examine was: ‘What did you really do to see if you could access this phone? Did you consult with NSA or intelligence agencies?’ ”

  The ante was raised even further.

  “Suddenly we’re preparing for a mini trial,” he added.

  The days continued, and Apple had dominated his time like no other case of that period.

  Finally, the day before the hearing arrived, March 21. Boutrous had been rehearsing his arguments yet again in a moot court with a phalanx of lawyers in a fifty-fourth floor conference room near his office. Every chair was taken. People had stacks of papers and laptops in front of them. They were neck-deep in the All Writs Act.

  Boutrous decided to take a break and get something from his office. He walked past his secretary, Irma Guerra, but she caught his attention.

  “Eileen Decker, the US attorney is on the phone,” Guerra told him.

  Again, this was strange—usually it wouldn’t have been the top prosecutor in the nation’s largest US Attorney’s Office outside of Washington, DC, making such a call, but rather, his or her deputy.

  Boutrous strolled over, glanced down at Disney Hall out his window, and took the call.

  Decker was cordial, even-keeled, and somewhat apologetic.

  “I would never do this unless it was absolutely necessary and this is in complete good faith, but we believe, we just received [information] that we may be able to access the information on our own,” she said.

  The veteran lawyer hung up the phone and didn’t miss a beat. He walked confidently back into the conference room, where his colleagues were waiting, and announced with a grin: “I’ve got some news!”

  He explained what had happened. His colleagues were stunned, but a few chuckled that the government had pushed so far, only to back away.

  “If you start a war, you say: ‘This is the most important thing!’ and you push us to the brink, and then say: ‘Well, maybe we don’t need to do this,’ ” he said.

  “I was so ready to get in there and make the argument, because I just felt in my bones, Apple is correct here. It’s not something the courts are authorized to do, it’s wrong and it could have terrible consequences for our world if this were to go forward.”

  About a month later, FBI Director James Comey was asked at a London conference how much the FBI paid for the technique that enabled the agency to get into Farook’s iPhone.

  “A lot. More than I will make in the remainder of this job, which is seven years and four months for sure,” Comey said, according to Reuters. “But it was, in my view, worth it.”

  As of January 2015, Comey made $183,300 per year—and assuming no raises or bonuses, he was set to make $1.34 million during his remaining tenure. This suggests the agency paid more than $1.3 million to get inside.

  For now, New York Telephone remains good law: the government can compel companies to provide assistance, so long as it is not overly burdensome. The question of where that line is remains unresolved. How far can the government go in forcing a person or a corporation to assist isn’t clear at all. Still, the fact that the government was able to effectively buy its way into Farook’s phone suggests that Apple’s help wasn’t necessary at all, undercutting its previous legal arguments. Plus, neither the DOJ nor the FBI has said what, if anything, was gleaned from the iPhone—presumably if any of Farook’s data had been useful, authorities likely would have said something by now.

  In November 2017, the issue came up again, in the wake of a mass shooting in Sutherland Springs, Texas. There, after a gunman killed 26 people, including himself, the FBI said that it was unable to get into an iPhone found near the shooter’s body.

  “I’m not going to describe what phone it is because I don’t want to tell every bad guy out there what phone to buy, to harass our efforts on trying to find justice here,” FBI Special Agent Christopher Combs said at a press conference at the time.

  CHAPTER THREE

  How One Mugger’s Calls Helped Create the NSA’s Post-9/11 Phone Metadata Surveillance Program

  By virtually ignoring data communications and the new computer technology, the statute makes it possible for law-enforcement agencies to treat this important form of information transfer as if it were nothing more than a telephone conversation.

  —ARTHUR MILLER

  THE ASSAULT ON PRIVACY (1970)

  October 1, 2013

  Baltimore, Maryland

  It was just another quiet Tuesday at home when a startling call from a reporter arrived on Stephen Sachs’ phone. The reporter was with an outlet that Sachs had never heard of—Wired—and he was asking about a Supreme Court case, Smith v. Maryland, from decades ago. The career lawyer had practically forgotten about it.

  “Hey honey, you may remember the first case I argued at the Supreme Court?” he called to his wife from across the house.

  Sachs explained to his wife that the reporter, David Kravets, knew what Sachs initially did not: that the Foreign Intelligence Surveillance Court (FISC) had been secretly relying on Smith, which began as a late-night robbery in Baltimore in 1975, to justify a massive surveillance program at the National Security Agency (NSA). While all legal theories build on case law, the idea that a local purse-snatcher and days’ worth of his phone records should allow years’ worth of every American’s phone records to be collected is orders of magnitude beyond what most lawyers or judges could imagine at the time.

  After having spent decades as a federal and state prosecutor, and an attorney in private practice, Sachs’ recent years have been largely quiet. He spends m
ost of his time attending to family life, following the Baltimore Orioles, planning vacations, and periodically working on his own memoirs of a lifetime of public service and legal work. His home is on a quiet, leafy cul-de-sac in the northern part of Baltimore.

  Sachs served as an assistant US attorney from 1961 until 1964, US attorney for the District of Maryland from 1967 until 1970, and as attorney general from 1979 until 1987, when he lost a gubernatorial election. (His ground-floor bathroom is filled with political cartoons and framed memorabilia from the 1988 campaign.) After that, he entered private practice, until he retired in 1999. More recently, in 2008, he was named by Governor Martin O’Malley to head a statewide commission to examine the Maryland State Police’s use of surveillance against local protestors and activists.

  In the wake of Edward Snowden, the FISC—whose hearings, opinions, and even dockets had nearly always been secret—had unusually decided to release a judicial opinion justifying the NSA’s Section 215 program. This program, which began in late 2001 and ended in 2015, allowed the NSA to routinely capture all telephone metadata—all incoming and outgoing calls—of all Americans for years on end. (The new version allows the metadata to simply be held by the telecoms and accessed by the government with a court order, a distinction that former NSA head General Michael Hayden found to be trivial.)

  Sachs was surprised, to say the least.

  The 1979 Smith decision “was a routine robbery case,” he told Kravets. “The circumstances are radically different today. There wasn’t anything remotely [like] a massive surveillance of citizens’ phone calls or communications. To extend it to what we now know as massive surveillance, in my personal view, is a bridge too far. It certainly wasn’t contemplated by those involved in Smith.”