Tim Cook Reveals What Privacy Advocacy Really Is

[SteelCrysis]

Even more:

Even if the Court ordered Apple to provide the government with Apple’s cryptographic keys and source code, Apple itself has implied that the government could not disable the requisite features because it “would have insufficient knowledge of Apple’s software and design protocols to be effective.” (Neuenschwander Decl. ¶ 23.)

Rather than acknowledge this point, Apple instead blames the San Bernardino County Department of Public Health and the FBI. Apple argues that the FBI could have gained access to some of the information via a forced backup to Farook’s iCloud account, but since the FBI changed the iCloud password to gain quick access to what was stored in previous backups in the immediate aftermath of the San Bernardino shooting, this path was blocked. (Opp. 11.) That is both untrue and irrelevant. For several reasons, a forced iCloud backup would not have been successful even if the password had remained unchanged. Farook’s iPhone was found powered off. (Supp. Pluhar Decl. ¶ 2.) Subsequent testing has revealed that once powered off, an iPhone will not back itself up to an iCloud account unless and until it has been unlocked at least once by use of the passcode. (Perino Decl. ¶¶ 6.d, 37-39.) Moreover, the evidence on Farook’s iCloud account suggests that he had already changed his iCloud password himself on October 22, 2015—shortly after the last backup—and that the auto-backup feature was disabled. (Pluhar Decl. ¶ 8; Supp. Pluhar Decl. ¶ 9.)

A forced backup of Farook’s iPhone was never going to be successful, and the decision to obtain whatever iCloud evidence was immediately available via the password change was the reasoned decision of experienced FBI agents investigating a deadly terrorist conspiracy. Moreover, even if—contrary to how Apple built and designed it—Farook’s iPhone could have been forced to sync to Apple’s iCloud network, that would not be an adequate substitute to unlocking and searching the phone itself. Both the FBI’s testing and Apple’s security documentation show that entire categories of evidence—including device-level data such as the “keyboard cache” (which records recent keystrokes)—reside only on the iPhone and not on an iCloud backup, and that some of the backup data would still have been encrypted. (Supp. Pluhar Decl. ¶ 10.) But that data remains on the iPhone. Thus, even with a full set of backups, the government still would have needed to search the phone itself in order to leave no stone unturned in this important investigation.

Most importantly, even assuming counterfactually that something could have been recovered through a forced iCloud backup, there have been no backups since October 19, 2015, and Apple concedes there is no way to force a backup now. Thus, the only way to recover any subsequent data—whether subject to backup or otherwise—is to unlock Farook’s iPhone. And for the FBI to do that, Apple must remove the barriers it put on that phone.