Gartner to FBI: Stop bullying Apple and the tech industry

Gartner veep and distinguished analyst Avivah Litan has told the FBI to “stop bullying Apple and the technology industry around” with regard to that iPhone. Litan writes that San Bernardino killer Syed Farook is known to have destroyed two private phones, so is unlikely to have sloppily left evidence on his work iPhone. She …

[Steve Davies 3]

Falling on Deaf Ears perhaps?

I get the feeling that no matter what is said in support of Apple and even if you hate them you should applaud them for standing up for user privacy here, it will fall on deaf ears for those in the various TLA's inside and outside the Washington Beltway bubble.

As people start taking on board the proslect of a Trump Presidency (shudder and hillary is just about the lesser of two evils...) he will support the Feebs in their quest to get a back door into every phone sold in the USA and beyond, just in case it might be used to aid a crime somewhere on this planet and beyond.

Eventually, someone will have to raise the white flag and I really don't think (sadly) that it will be Uncle Sam that does so.

[Warm Braw]

Re: Falling on Deaf Ears perhaps?

I know. Finally Gartner say something that has widespread acceptance in the industry and noone is listening. Ah, the irony.

[Gray]

What do I think?

I think that law enforcement agencies haven't come all that far from "rubber hoses, confessions, and secret searches" mentality. The fastest way to p|ss off a cop is to say "no"; the red haze of anger prompts retaliation.

A judge recently ruled in favor of Apple; wanna bet the FBI is working full-tilt to find a way around that? Go look for alternate methods? What a laugh ... ! First they've gotta deal with those bad attitudes at Apple!

[Anonymous Coward]

Re: What do I think?

Alas that judgement was a token gesture and has no bearing on the outcome if this case, that one was filed in NY, this one in San Bernardino.

The thing I find very strange in all this is why do it in open court and not FISA? This leads me to believe it is all a show and they already have access to the phone but are trying to legitimise back doors through the back door so to speak.

[Mark 85]

Re: What do I think?

I think the FBI is pushing the issue. They have 2 cases now, with opposing viewpoints and orders. This is going to get escalated via appeal all the way to the Supreme Court. And it should be, there's some serious Constitutional questions that the FBI are messing with.

The FBI still requires a law degree as far as I know for agents so there's probably more than few internally questioning things. Or at least I'd hope they are.

[Anonymous Coward]

They have to ensure you believe your data are safe, so they can exploit them freely

Today most companies look at your data as a gold mine, so they need to make you believe your data are safe when stored on the devices and services they sell you. Otherwise, if you don't store everything there, and don't let them access your data, they lose their preciousss gold mine.

We shouldn't trust the FBI, but we shouldn't trust the companies wanting to store our data also. Especially when they don't charge you a lot for storing them. In any other case, they will access your data at will and try to extract money from them in any way they can - and don't believe they will respect your rights if not forced to do so.

Weaking regulations on what they can do with your data is what their aiming for. Sure the FBI is trying the opposite, with the same aim, access your data. We are caught in the middle - and our data will be lost and used against us anyway...

[Ole Juul]

Charlie Don't Surf

“I wish they would stop bullying Apple and the technology industry around and spend their time and energy instead on figuring out how to rise to the challenge.”

Except the FBI doesn't do that.

[Anonymous Coward]

The Age of Incompetence...

Data correlation of the type that Litan describes, would require that an investigator know where all of the available metadata originated, and to possess a practical understanding of the systems that produced and recorded said metadata. Sadly, the great majority of personnel in all fields of law enforcement lack this knowledge and understanding. Worse, many do not even know that they are lacking. Furthermore, huge amounts of raw metadata are nearly useless. Some fairly sophisticated tools are required to process and organize bulk, raw metadata. Insight and intelligence then are required to search for and identify key correlations. Spy agencies have "analysts" who draw conclusions by finding correlations within data obtained by "cloak & dagger" assets. If law enforcement entities wish to be able to draw conclusions from correlated metadata, then they will need to develop "analyst" processes, tools, and resources that can deal with bulk and diverse metadata. At present, they are collectively 25 years and billions of dollars tardy with respect to starting any such development effort.

[Vic]

Re: The Age of Incompetence...

Spy agencies have "analysts" who draw conclusions by finding correlations within data

So does the FBI.

Vic.

[MadLogician]

Re: The Age of Incompetence...

In both the US and UK law enforcement intelligence analysts have been working on such systems for more than the 25 years you mention. I've worked on some of these myself. Some of this work isn't even classified.

[Anonymous Coward]

FBI to Gartner: Shut up and hand over your lunch money, dweeb!

[Velv]

Completely missed the point. It is not THAT phone which is of the slightest interest to the FBI or anyone else in the investigatory world.

They need a case sufficiently emotive to achieve public support. "We'll be able to stop terrorists". They know there is no useful information on THAT phone, and will already have used the carrier data to its full ends. But they need to justify accessing THAT phone so they can access OTHER phones in the future.

</TinFoilHat>

[DryBones]

You're not paranoid if they really are out to get you...

[allthecoolshortnamesweretaken]

I think

that a 'lesser' evil is still an evil.

[Comic Book Guy]

Theoretically, there should be a way to get to that data without all the song and dance that's gone on. Or, I could be barking up the wrong tree. Or just barking. Try this train of thought:

Assumption 1: The main reason the FBI are pressuring Apple for a custom OS is that they locked themselves out when they reset the iCloud password. This action meant that the phone and the cloud were out of sync.

Assumption 2: Apple has backups. Contained somewhere in these backups is a copy of this specific account in its previous state, with the old password. Yes, I do understand that this record is encrypted.

Assumption 3: That encryption is irrelevent. IF Apple can restore that record to an alternate server, on an isolated network, running its own DNS, with its own WiFi, the only thing needed is for the phone to connect (automatically) to that network, see the old iCloud password, and sync. This may need to be in a shielded room, but I'm sure the FBI (and probably Apple) have several of those.

Change the restored copy's password again, and you have access to the iCloud backup.

Ok... have at it... if I'm wrong, I would like to know why, but please be gentle. :)

[Anonymous Coward]

Assumption 0: that if the iCloud password hadn't been changed, the phone was still configured to sync to iCloud. It apparently hadn't synced to iCloud for a few weeks prior, but it isn't clear why that is - was the sync to iCloud disabled? Was the phone turned off? Was the phone in a location where it didn't have access to a known wifi network? Had the phone not been used so there was nothing new to sync?

Not sure about assumption 2 either. Currently iCloud data is stored on AWS. I'm sure Amazon gives their customers the option of backing up AWS, but iCloud already is a backup so why would Apple want a backup of a backup?

[Vic]

Assumption 1: The main reason the FBI are pressuring Apple for a custom OS is that they locked themselves out when they reset the iCloud password

Assumption 1 is incorrect. There is almost no probability of there being any useful data on this phone anyway. The main[1] reason the FBI are pushing Apple here is that they want to set a legal precedent[2] that they can snap their fingers and pforce Apple to write custom unlock firmware whenever they want.

Apple has backups. Contained somewhere in these backups is a copy of this specific account in its previous state

Apple has backups. They're not bang up-to-date[3], but very close.

Apple has already given the FBI all that data.

This case has nothing to do with that phone - it's irrelevant. This is all about a power grab.

Vic.

[1] Only?

[2] I know they keep saying that this will not set a precedent - that's what's known in technical circles as "a lie".

[3] The phone had not updated its backups in a little while, so there is a little transient data that has not been handed over. That would not have been the case if the FBI hadn't forced a password change so that the phone no longer has access to its backup...

[Comic Book Guy]

You're probably right about their motives.

However...

[3] was at the heart of my assumptions. You're right - the phone had not updated its backups prior to the password reset.

Why? We don't know. There are several possible reasons, but we don't know which one is the right reason. That means that there is a chance that a new backup could be triggered, under the right circumstances.

What we DO know is that the password for the cloud and the password on the phone are now out of sync.

If there was a way to get them back in sync - i.e. find a backup of the account details and restore it - the phone MIGHT perform another backup to the cloud. Apple can almost certainly tell when the latest backup occurred, so they will be able to tell if the phone does another one, after the old password has been restored to the cloud.. Change the password again, and you've got the latest data.

As far as the "backup of a backup" question goes, I'm not convinced that holds true. The actual data/files/etc backed up to the cloud - yes, I can see that argument to an extent.

The account settings, on the other hand, are far more important. In a hypothetical case where Apple were hacked and a lot of customers accounts deleted, I can't see them wanting to be in a position whereby they had to get all those customers to contact them and re-verify their identities. If there are no backups of that data, then they're not the company they appear to be.

I would be very surprised if A) they didn't treat device contents and account data separately, and B) they had no backups of the account data. But, I suppose, anything's possible.

[Anonymous Coward]

Wrong device

If only they were going after the gun device that killed people as hard as they are going at the phone device owned by the guy.

[Anonymous Coward]

Good news on the Apple vs. FBI/DEA legal front!

A New York federal magistrate rejected the government's attempt to place an obligation on Apple to crack an iPhone in a drug dealing case. The judge stated that the government's interpretation of the now-famous All Writs Act was overreaching, lacked statutory basis and imposed an undue burden on both Apple's free speech and property rights. A very similar, if not identical, case to the San Bernadino terrorist iPhone case.

https://theintercept.com/2016/02/29/apple-wins-major-court-victory-in-its-battle-against-fbi-in-a-case-similar-to-san-bernardino/

[Anonymous Coward]

This is the same FBI that didn't secure the couple's apartment as a crime scene, leaving TV news crews - and anyone else - to sift through shredded documents there?

And mishandled the phone in the first place?

I can see why they want someone else to do their job - they just aren't up to it.

[Jin]

A backdoor is already there.

iPhone and many other smart devices already have valid backdoors, namely, a fingerprint scanner or a set of camera and software for capturing faces, irises and other body features, which can be collected from the unyielding, sleeping, unconscious and dead people. .

If Apple wants to claim that they are conscious of privacy and security, they could tell consumers to turn off the biometric functions. If the authority wants to have those backdoors open, they could tell consumers to keep them turned on all the times. And, security-conscious consumers could certainly refrain from turning them on.

[Anonymous Coward]

Re: A backdoor is already there.

We have already seen the decision here in the US that says a suspect CAN be compelled to unlock a device that is protected by biometrics, but a suspect cannot be compelled to reveal a password to unlock a device. The difference being that biometrics are not considered to be testimonial communication, whereas a password that only exists in the mind of the suspect IS testimonial communication. The Fifth Amendment protects a suspect from being compelled to reveal said password.

[Peter Simpson 1]

Private Data

I heard the FBI director this morning on the radio getting all worked up that "these manufacturers" were unilaterally creating places inaccessible to law enforcement, without first asking "the American people" if that was okay with them.

Mr. Director: NOWHERE in the Constitution does it say that law enforcement has a legal right to read all my data. You are allowed to obtain it under court order, but it's not required to be readable. To lay the blame on the device manufacturers for this is to ignore the fact that they wouldn't be offering the product if there wasn't a market.

I, for one, appreciate that my data (and everyone else's) may be made inaccessible to law enforcement. YOU may not like this, but there's no law against it. And that's a Good Thing.

[Anonymous Coward]

Err...is this a joke?

A Gartner "Analyst" commenting on an on-going criminal investigation? LOL

I wondered where our subscription fee was going. I can see the letter back now

Dear Ms Litan,

Thank you for you insight into the ongoing investigation. We here at the Federal Bureau of Investigation for this United States never though of contacting a telecommunications company about a telecommunications device, and we surely appreciate you clarifying what we do and don't know about the case, we were getting ever so confused. We also were pleased to hear that you had a friend in the intelligence community, as we ourselves have no intelligence contacts whatsoever. Perhaps if we weren't following Gartner's "fail fast, fail often" advice that you gave to us over the last few years we would be going a little better.

Again, thanks for the help.