The Big Apple Backs Big Apple

Back on February 16, 2016 I reported about the big news the United States District Court for the Central District of California made by issuing an order requiring Apple to devise a means of getting around the encryption on an iPhone belong to one of the terrorists in the attacks in San Bernardino, CA. Yesterday, Judge James Orenstein of the U.S. District Court for the Eastern District of New York, issued a decision denying a motion by the Government requiring Apple to bypass the passcode security on an iPhone 5s running iOS 7. The court held that the same statute relied upon in the C.D. Cal. case, the All Writs Act, could not be invoked in this case because Congress had considered legislation that would achieve the same result, but hadn't actually passed it.

Orders under the All Writs Act have to consider three factors:

1. The closeness of Apple to the criminal act.

2. The burden to Apple of complying.

3. The necessity of imposing the burden on Apple.

Specifically with regards to the third factor, the Court considered an admission by the Government that Homeland Security had the ability to override the passcode and access and copy record records on it. The testimony of a DHS expert in another case (from 2015) was cited by the Court to point out the existence of an IP Box technology that while new and finicky, was successful at bypassing passcodes on some Apple devices. Because there was conflicting evidence about the Government's own capabilities, Judge Orenstein held that it was not necessary to order Apple to assist.

The matter the court ruled upon concerned a device belonging to a defendant charged with the drug trafficking. The opinion mentions in 70 other instances, in which Apple stated it could unlock the phone if an order was issued requiring it to do so. Apple faces a dozen pending cases in which it objects to the Goverment's request to bypass a passcode.

Judge Orenstein also states that the Communications Assistance for Law Enforcement Act (CALEA) absolves a company like Apple from providing the assistance the Government demands in the present case. For the purposes of that Act, the Court held that Apple should be classified as a information service provider and not a telecommunications carrier. The Act specifies that the former does not have the same requirement to provide assistance to government investigations that the latter does.

The encryption software does not constitute an act by Apple to thwart the Goverment from conducting is investigation. The Court distinguished Apple from telephone utilities that supplied the Government with information from pen registers. Apple is not heavily regulated and does not have a duty to serve the public. Pen registers were regularly employed by telephone companies to help detect fraud and for billing purposes. Circumventing passcodes is not something Apple would do in the normal course of its busineess. Pen registers were not difficult to install, but desigining a means to get around its encryptioin software would divert personnel, hardware and software, and the Court points out that the cumulative burden of complying with Government orders would effect Apple's normal business operations.

The European Union's Data Protection Escape Clause - Article 26(2)

In 1995 the EU issued Directive 95/46/EC which addressed the processing of personal data belonging to private individuals.

Chapter IV of the Directive concerns the transfer or personal data to 'third countries' [such as the United States], and consists of Articles 25 and 26. Article 25 provides that personal data can only be transferred to a third country if it "ensures an adequate level of protection." This level is evaluated with respect to the nature of the data, the purpose & duration of the processing of the data, and the law & security measures in the third country.

Article 26 states conditions in which personal data can be transferred to a third country even if it doesn't provide an adequate level of protection. There are six possibilities under paragraph 1 of this Article:

1. Unambiguous consent.

2. It's necessary to the performance of a contract.

3. It's necessary for the conclusion of a contract.

4. It's necessary on public interest grounds or legal claims

5. It's necessary for the vital interests of the person whose data is requested.

6. The transfer is from a register which by law provides information to the public.

Paragraph 2 of Article 26 is frequently cited in guides to electronic discovery. It allows for personal data to be transferred so long as it's determined that there are adequate safeguards for privacy protection, fundamental rights and the freedom of the individual. The safeguards can be guaranteed by contracts.

Can the Government Order Apple to Crack Your iPhone Passcode?

An order was issued today by a federal judge requiring Apple to assist with efforts to bypass the encryption on an iPhone 5C belonging to one of the terrorists who carried out the attacks in San Bernardino, CA this past December. See this article in the Washingon Post. This bit of e-discovery news in the headlines tonight is interesting for a few different reasons. One, it proves that the government, even in a high profile criminal matter that involves a national security danger, still can't find a way to hack into the iPhone - or at least one running iOS 9. Second, the news articles point out that more than ten incorrect attempts to enter the passcode for an iPhone will wipe out the data on the smartphone. Third, a magistrate judge with the California Central District Court has found a basis under the All Writs Act to demand that a company create customized malware for the specific purpose of accessing encrypted data. Lastly, some experts believe the decision may be used as a basis for future decisions allowing the government to direct phone or software companies to secretly install programs to gather private information. See the PC World article here.

The order can be view here. Note that is also requires Apple to prevent software on the device from causing additional delays between passcode attempts. It's also notable that the order specifies that ultimate responsibility for evidence preservation rests with the Government, not Apple.