Tim Cook's responsibility is to his company and his philosophy around "privacy" is primarily shaped by his mandate to protect the company’s perception, dominant market position and value of its stock. This is as it should be and he has done a wonderful job at it. An obvious and key component of that winning philosophy and strategy is the degree to which Apple will go to the mat in order protect sanctity of its customer’s data fromunwarranted disclosures to 3rd parties, namely the government. Way Cool companies, and there is no other Way Cooler tech juggernaut than Apple, spend hundreds of millions of dollars cultivating and tuning every aspect of their public image. Every time I think of Apple, images of Way Cool young people wearing skinny jeans comes to mind. They're bouncing around, brimming with hipness, sheikness and a carefree freedom that makes me wonder if they have student loans. The problem for Apple is that Farook Sayed and Tafsheen Malik, are not Way Cool. They are terrorists and any form of association with them is from a corporate perspective, a marketing and PR nightmare. The issues raised in the in FBI’s motion to compel assistance in data recovery drags Apple into a realm of political and legal debate that it would do well to avoid. In my humble opinion and for reasons which I will explain, the FBI's sought after assistance in cracking the password to facilitate the disclosure of Apple licensee and ISIS devotee Farook Sayed's data, is fully warranted. Mr. Cook has to understand that you can't go wrong helping G-Men get to a terrorist's data that is stored on one of Apple’s devices. He has muddled the issues of general data privacy with a legal duty as established by a court to assist in an investigation where the discovery boundaries are specified and narrow in scope. He should be focusing on the unenviable challenge of spinning how Way Cool Apple is helping to insulate America from terrorists hell bent on killing innocent American civilians.
The government is now the custodian of a specific iPhone, to be specific it's an phone iPhone 5C with the following unique characteristics, Model: A1532, PIN:21 MGFG2LL/A, SIN: FFMNQ3MTG2DJ, IMEI: 358820052301412. The phone belonged to one individual, a Farook Sayed, who in conjunction with his paramour and wife, one Tafsheen Malik, committed specific acts of terrorism on American soil. There is an obvious reason for belaboring specificity and one of them is that the FBI is not requesting blanket access to all iPhones owned by law abiding Americans. Right now, Apple is taking the lead in spinning up the Snowden NSA “data hoovering” angst that gripped the nation a few years ago, and they are doing so by virtue of turning a limited and legitimate criminal investigation into one implicating the privacy rights of all Americans. While it is true that the methods employed to bypass the iPhone security model to allow access to the data in fact potentially allow access to others phones, Apple is not being asked to do so. The order compelling Apple stipulates that the government, the FBI specifically, obtain the following from them:
Apple's reasonable technical assistance shall accomplish the following three important functions: (1) it will bypass or disable the auto-erase function whether or not it has been enabled; (2) it will enable the FBI to submit passcodes to the SUBJECT DEVICE for testing electronically via the physical device port, Bluetooth, Wi-Fi, or other protocol available on the SUBJECT DEVICE and (3) it will ensure that when the FBI submits passcodes to the SUBJECT DEVICE, software running on the device will not purposefully introduce any additional delay between passcode attempts beyond what is incurred by Apple hardware.
Apple's reasonable technical assistance may include, but is not limited to: providing the FBI with a signed iPhone Software file, recovery bundle, or other Software Image File ("SIF") that can be loaded onto the SUBJECT DEVICE. The SIF will load and run from Random Access Memory and will not modify the iOS on the actual phone, the user data partition or system partition on the device's flash memory. The SIF will be coded by Apple with a unique identifier of the phone so that the SIF would only load and execute on the SUBJECT DEVICE. The SIF will be loaded via Device Firmware Upgrade ("DFU") mode, recovery mode, or other applicable mode available to the FBI. Once active on the SUBJECT DEVICE, the SIF will accomplish the three functions specified in paragraph 2. The SIF will be loaded on the SUBJECT DEVICE at either a government facility, or alternatively, at an Apple facility; if the latter, Apple shall provide the government with remote access to the SUBJECT DEVICE through a computer allowing the government to conduct passcode recovery analysis.
Case No. ED 15 - 0451M’s motion and order are pretty specific and tailored to obtain discovery pursuant to a criminal investigation. It's not the job of the FBI to pontificate and postulate about why their actions do not constitute government overreach at this stage. Further, the issue of data privacy, while legitimately introduced by Mr. Cook, is a red herring here. Based on what I've read to date, it occurs to me that the real issue is one of a corporate organization's responsibility and legal obligation to aid a legally sanctioned law enforcement agency with their investigation when ordered by a court to do so. More specifically, the government's position is that when one of its investigative agencies has posited facts before a court to support their belief that a licensee of a corporation's proprietary technology may have used that technology in furtherance of a crime or that potential evidentiary material may be secreted within the device only accessible with the assistance of said corporation, they want help. Frankly, this position is not unreasonable.
A password protected iPhone with information on it is analogous to a sophisticated safe with documents written in Wingdings in it. If the documents in the safe were subject to a subpoena or discovery request and the combination was irretrievably lost, it would not be unreasonable for a court to enlist the help of the manufacturer, which is typically done under the guidance and oversight of a qualified special master to open it. It would then up to the investigative agency to find a certified Wingding translator to decode the Wingding encoded document. In this case what Apple is being asked to do is suspend the function of certain IOS9 proprietary security models to expose the data - in other words open the safe. The FBI will then use brute force password decryption methods, if needed, on the iPhone data. Does this scare me? Not in the slightest. My household is fully Apple enabled. I have a primary and backup Macbook Pro and my wife and kids all have the latest Macbook Airs and iPhones. I am of the opinion that Apple’s primary concern should be related to safeguarding their proprietary technology, algorithms and methods related to their encryption/decryption technology. If Apple could have assurances that their IP would be protected from release to the public domain, then Apple could have their pie and eat it too. If my team was on the Apple crisis management and incident response team, we would shield Mr. Cook by minimizing Apple’s contribution to the public debate about data privacy by downplaying the significance of Apple's role in this matter – less is more in this instance. To do so we would use the very language in the order compelling Apple to support the FBI. We’d also make sure that there were easily implementable protective caveats in Apple's favor in the form of an iron clad protective order governing confidentiality around processes and methods used to facilitate the government's request.
If a related terrorist attack were to occur and it turns out that it could have been thwarted with help from Apple in the instant case, Mr. Cook's plate spinning act to manage the hot button issues of the market’s desire for consumer data privacy, with law enforcement needs while maintaining a Way Cool corporate culture that is above the political fray could end with a lot of shattered porcelain. The fallout from such a potential attack could cause reverberations not just in Apple's board room but create a chilling atmosphere on Capitol Hill as an already skittish America would clamor for something more to be done...and that usually means more hawkish legislation which statutorily chips away at the very thing Mr. Cook is trying to protect, privacy.
The bottom line is it's easier to quantify the knowns which include the perceptual fallout from working with the government than it is to calculate the probability that there isn't information on the iPhones in question that could lead to preventing a terrorist attack. Ultimately from a business perspective the decision Mr. Cook will make really boils down to Apple’s risk tolerance in relation to the company’s corporate goodwill. If he does accede to the court ordered directive, Apple could reassure their customers that this was a special case of Apple working to protect America; the order to compel Apple was very specific as it relates to the government's access needs for ONE device. Surely Apple's vaunted PR and marketing machine people could spin this story and surely a Judge can ensure that a protective order could be crafted to ameliorate concerns about protecting encryption/decryption IP.
Rest assured Mr. Cook, most of us won't see you as colluding with Big Brother, as consumers we're pretty fickle but not that fickle. A decision one way or the other won't change buying patterns as I love my Macs and iPhones....but know this, we live in different times and I remember the smell that lingered for years in lower Manhattan after the towers came down. A lot of us who lived and worked in NYC before and after that day do. I think you know where this licensee of Apple technology is coming from.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The motion and order have been OCR'd and can be download from the links below should you like to have a read.
@msn @aiim @wsj @arma @yahoo @google @bbc @reuters @nytimes @huffingtonpost @bloomberg
About the author: My passion is gardening (buds are sprouting) and my favorite role is that of Enterprise Discovery Solutions Architect. My group develops Information Governance Strategies and conducts e-Discovery and Litigation Readiness Gap Analyses for companies in the Energy, Pharmaceuticals/Financial Services/Insurance and High Tech verticals. On occasion we'll work with communications groups to help with messaging. We’ve got lots of experience testifying as a technical experts as well as doing data conversion from disparate complex systems to normalized formats. I am a fan of anything technical, namely the most complex e-Discovery challenges out there. Feel free to ping me from my LinkedIn profile or @
redavis@verisolutions.com with any confidential questions or comments, or if you'd prefer to call, you can ping me at Mobile 1.646.306.3833 - Office: 1.646.205.3208.
Cheers...Rich
Reclaim existing storage space on desktop PCs and servers by replacing large macro-enabled Microsoft Office files with smaller versions. Slow storage growth as new files are added. Test for yourself: files shown are available at Bruce's Mcpherson blog: