Tim Cook Reveals What Privacy Advocacy Really Is

[SteelCrysis]

http://www.cnbc.com/2016/03/10/justice-d...spute.html
Apple got demolished. Bunch of hypocrites and liars.

Apple speculates that if it submits to a lawful order to assist with a constitutional, warranted search of a consenting customer’s phone in America, Apple will have no choice but to help totalitarian regimes suppress dissidents around the globe, and “hackers, criminals, and foreign agents” will have access to the data on millions of iPhones. (Opp. 1-2, 28.) This putative public burden, Apple argues, is a basis to relieve it from the Order. Apple’s fears are overblown for reasons both factual and legal.

To begin with, many of the most compelling examples of cybercrime that Apple describes involve not breaches of physical-device security, but rather breaches of network security. That is the “the daily siege” of “hackers, cyber-criminals, and foreign agents” with which the government and victims contend. (Opp. 1.) Nothing in the Court’s Order affects Apple’s network security. Rather, the features at issue concern only access to a physical device. Thus, for the government even to benefit from the software set forth in the Order, it first had to recover Farook’s iPhone itself. (Perino Decl. ¶¶ 6.c, 31-36.) That fact alone eliminates much of Apple’s worry. Next, contrary to Apple’s stated fears, there is no reason to think that the code Apple writes in compliance with the Order will ever leave Apple’s possession. Nothing in the Order requires Apple to provide that code to the government or to explain to the government how it works. And Apple has shown it is amply capable of protecting code that could compromise its security. For example, Apple currently protects (1) the source code to iOS and other core Apple software and (2) Apple’s electronic signature, which as described above allows software to be run on Apple hardware. (Hanna Decl. Ex. DD at 62-64 (code and signature are “the most confidential trade secrets [Apple] has”).) Those—which the government has not requested—are the keys to the kingdom. If Apple can guard them, it can guard this.

Even if “criminals, terrorists, and hackers” somehow infiltrated Apple and stole the software necessary to unlock Farook’s iPhone (Opp. 25), the only thing that software could be used to do is unlock Farook’s iPhone. (Perino Decl. ¶¶ 6.a, 18-24.) Far from  being a master key, the software simply disarms a booby trap affixed to one door: Farook’s. The software “will be coded by Apple with a unique identifier of the phone so that the [software] would only load and execute on the SUBJECT DEVICE [i.e., Farook’s iPhone].” (Order ¶ 3.) This phone-specific limitation was not dreamed up by the government, but instead employs Apple’s well-publicized security paradigm. A “unique ID (ECID)” associated with each physical iPhone is incorporated into the  phone’s operating system. (Perino Decl. ¶ 20; Hanna Decl. Ex. K at 6.) “Adding the ECID ‘personalizes’ the authorization for the requesting device.” ( Id .) Apple has designed its phones so that every operating system must pair with the phone’s ECID. (Perino Decl. ¶¶ 18-24; Hanna Decl. Ex. K at 6 (describing how the Apple server “adds the ECID” before it “signs” the iOS to be used for the upgrade).) The operating system and ECID must correspond for the operating system to work. The ordered software would rely upon the same limitation.

Apple implies that the code could be modified to run on other phones, but a second Apple security layer prevents that from happening: Apple devices will only run software that is electronically “signed” by Apple. (Hanna Decl. Ex. K at 6 (“only Apple-signed code can be installed on a device”).) “Signing” the software described in the Order will not release Apple’s signature to the government or anyone else—Apple signs all publicly available iOS software, but that does not disclose the signature itself. (Perino Decl. ¶¶ 9, 13-17, 24, 28.) And if the code were modified to run on a phone with a different ECID, it would lack a valid digital signature. Without that signature, the code would not run at all on any iOS phone with intact security. ( Id.) Thus, it is simply not  plausible that Apple’s complying with the Order would cripple iPhone security. Similarly misleading is Apple’s argument that the Order will force Apple to  provide access to data to foreign governments. As a legal matter, the Order does not—could not—compel Apple to follow or disregard the laws of foreign countries. The  pressure of foreign law on Apple flows from its decision to do business in foreign countries, not from the Order. Apple suggests that, as a practical matter, it will cease to resist foreign governments’ efforts to obtain information on iPhone users if this Court rules against it. It offers no evidence for this proposition, and the evidence in the public record raises questions whether it is even resisting foreign governments now. For example, according to Apple’s own data, China demanded information from Apple regarding over 4,000 iPhones in the first half of 2015, and Apple produced data 74% of the time. (Wilkison Decl. Ex. 8 at 3.) Apple appears to have made special accommodations in China as well: for example, moving Chinese user data to Chinese government servers, and installing a different WiFi protocol for Chinese iPhones. (See Wilkison Decl. Ex. 9 (reporting that in August 2014, Apple moved Chinese users’ iCloud data onto state-owned servers); Ex. 10 (reporting that Apple produced a modified iPhone for sale in mainland China that used a “WAPI” WiFi standard as required by the Chinese government); Ex. 11 (reporting Apple was the first Western company to have its  products use WAPI and “[t]hus, [Apple] is presumably sharing confidential information with the [Chinese] government”).) Such accommodations provide Apple with access to a huge, and growing, market. (Wilkison Decl. Ex. 12.) This Court’s Order changes neither the carrots nor the sticks that foreign governments can use on Apple. Thus, it does not follow that if America forgoes Apple’s assistance in this terrorism investigation, Apple will refuse to comply with the demands of foreign governments. Nor does it follow that if the Court stands by its Order, Apple must yield to foreign demands, made in different circumstances without the safeguards of American law.