In addition, toll records for the subject device establish that Farook communicated with Malik using the subject device between July and November 2015, but this information is not found in the backup iCloud data. Accordingly, there may be critical communications and data prior to and around the time of the shooting that thus far has not been accessed, may reside solely on the subject device, and cannot be accessed by any other means known to either the government or Apple.
Wait, they think there could be data on the phone that isn’t in the iCloud backup?
Yes, the February 19 filing says that—they have service records from Verizon that show communications occurred, but those aren’t in the iCloud backup.
The problem with that argument? There’s no way to selectively back up to iCloud—it’s all or nothing. So if communications from July, August, September, and October are not in the October 19 iCloud backup, it would be pretty surprising to find them on the phone. One logical explanation is that they were deleted by Farook before October 19.
What’s with this story about the iCloud password being changed, and who’s to blame?
It’s kind of a mess. First, the February 19 filing mentioned that the owner (again, that’s San Bernardino County) reset the password for the Apple ID tied to the iPhone—Farook’s iCloud password, in other words. “The owner…was able to reset the password remotely, but that had the effect of eliminating the possibility of an auto-backup.”
So that kind of read like the FBI thought the county had screwed up, but then the next day, February 20, the county’s Twitter account tweeted that the FBI had instructed the county to do so.
The County was working cooperatively with the FBI when it reset the iCloud password at the FBI’s request.— CountyWire (@CountyWire) February 20, 2016
The FBI released a statement on February 21 to Ars Technica admitting that yes, it had ordered the password reset. But the FBI still maintains that the iCloud backup wouldn’t have everything the investigators would get if they could just get into the phone, which is why the court order was issued in the first place.
The New York case, and why iOS version matters
Farook’s iPhone is running iOS 9, and passcode-based encryption was added in iOS 8. But if Farook’s iPhone was running iOS 7, Apple would still help?
Apple has published a set of Legal Process Guidelines (PDF) that outline the process for law enforcement to request assistance from Apple, as well as what information Apple can provide.
They read in part:
For all devices running iOS 8.0 and later versions, Apple will not perform iOS data extractions as data extraction tools are no longer effective. The files to be extracted are protected by an encryption key that is tied to the user’s passcode, which Apple does not possess. For iOS devices running iOS versions earlier than iOS 8.0, upon receipt of a valid search warrant issued upon a showing of probable cause, Apple can extract certain categories of active data from passcode-locked iOS devices.
However, the government’s February 19 court filing states in a footnote, “Apple has informed another court that it now objects to providing such assistance.”
What other court is Apple objecting to?
Why doesn’t Apple want to help in New York?
In a response filed in the New York case, Apple argues that “social awareness of issues relating to privacy and security, and the authority of government to access data is at an all-time high. And public expectations about the obligation of companies like Apple to minimize government access within the bounds of the law have changed dramatically.” So the time is right to reexamine the authority given to the government by the All Writs Act, Apple is arguing.
It sounds like, from that filing, that Apple just wants out of the iPhone-data-extraction business. The filing explains how starting with iOS 8 Apple doesn’t have the technical ability to do what it once did, and that iOS 7 devices like this one “are becoming rare as they compromise less than 10 percent of the devices in the U.S.” Apple doesn’t want to take its engineers’ time doing the extraction or testifying in court about it, even though the company would be able to claim expenses.
After all, as the final reason argues, you can’t claim expenses for damage to the brand. “Forcing Apple to extract data in this case, absent clear legal authority to do so, could threaten the trust between Apple and its customers and substantially tarnish the Apple brand. This reputational harm could have a longer term economic impact beyond the mere cost of performing the single extraction at issue.”
The legal fight: What happens next?
What’s the deal with the All Writs Act, which Apple is objecting to?
Both this new order and the New York case use the All Writs Act of 1789. In fact, in the case going on in the Eastern District of New York, Apple is arguing that extracting data from a drug dealer’s iPhone 5s running iOS 7 is overly burdensome on manpower and resources, as well as an overly wide application of the All Writs Act. Matthew Panzarino at TechCrunch has a great explanation, and you can also read Apple’s filing questioning the AWA.
According to the Feburary 19 filing in the California case, “The All Writs Act provides in relevant part that ‘all courts established by Act of Congress may issues all writs necessary or appropriate in aid of their respective jurisdictons and agreeable to the usages and principles of law.’” It’s kind of a catch-all, in other words: “As the Supreme Court explained, ‘the All Writs Act is a residual source of authority to issue writs that are not otherwise covered by statute.’”
The tests are whether the third party “is not so far removed from the underlying controversy that its assistance could not be permissably compelled,” that the order “does not place an undue burden” on the third party, and that the assistance is “necessary to achieve the purposes of the warrant.” In the February 19 filing, the government argues that Apple fails all three tests and thus should be ordered to comply.
What happens if Apple refuses?
If the February 16 order from Judge Pym stands after Apple’s appeal—the next hearing is scheduled for March 22—the company could elevate it through the courts, eventually all the way up to the Supreme Court.
This case could prompt legislation in Congress too, according to California Senator Dianne Feinstein speaking on PBS NewsHour. Tim Cook and FBI Director James Comey have both been invited to appear before the bipartisan House Energy and Commerce Committee.