Apple vs FBI: End of the battle, not the war [Link - CRN]

An article I wrote around the FBI trying to break into an Apple iPhone was published on CRN: http://www.channelweb.co.uk/crn-uk/opinion/2454969/apple-vs-fbi-end-of-the-battle-not-the-war

===================

The biggest story coming out of Silicon Valley over last few months has been Apple's battle with the FBI over a federal order to unlock the iPhone of the San Bernardino shooter. The recent news that the FBI has found a way to break into the phone without Apple's help brings no resolution to the issue of how far governments can go to examine private communications data such as messages and photos.

Apple's refusal to help the FBI has set in motion a wider debate about privacy and security in the digital age. Supporters of the government say that Apple has a duty to support crime fighting agencies and that Apple has cooperated in the past to unlock phones.

The issue, however, is about more than unlocking a phone. It's about ordering Apple to create a new software tool to eliminate the software it specifically created in 2014 to protect customer data. This has huge implications for the future of privacy.

Tech companies say they turn over the customer data they have when legally required to do so. But digital companies are determined to protect customers' privacy against unwarranted intrusion and many are increasingly using encryption and other safeguards that put customer data out of their reach.

Unanswered questions

Heightened terrorist threats have led to governments around the world looking at how they can renew their assault on digital encryption, and revive efforts to force companies to install backdoors in secure products.

However, digital companies are showing a steely resolve. This is a core issue that's incredibly important for customers who value privacy and the tech industry are determined to protect it.

In the latest move, many privacy advocates will have welcomed the news that Whatsapp has announced encryption by default on its messaging platform. The Facebook-owned company, which is used by over a billion people worldwide, added end-to-end encryption to its chat and call functionality, which means that messages can only be read by the intended recipients.

It is difficult to overstate the importance of this move for the security and privacy of ordinary users. In one swoop, there are now hundreds of millions of users communicating with each other using end-to-end encryption for the very first time.

Finding the right balance

For governments and law enforcement, the issue centers around this: what do you do when a company creates an encryption system that makes it impossible for court-authorised search warrants to be executed? And what is the reasonable level of assistance you should ask from that company?

Governments need to be careful that they are not being seen as attempting to collect as much data on every citizen as possible. At the height of the FBI dispute, Apple's Tim Cook talked about the possibility of a shocking future in which the company is forced to write and install a program on a suspect's phone that would help police turn on the iPhone's video camera.

It's a dangerous situation and one that not only potentially undermines consumers' trust, but also the entire tech industry and the democratic freedom we are entitled to.

What's next?

After finding its own way to access files on the San Bernardino iPhone, the US Justice Department said it no longer needs a court order to force Apple to remove safeguards against guessing that iPhone's passcode. It has become clear that this only serves to prolong the issue because we've lost the opportunity to have the courts resolve the issue of online privacy once and for all.

No-one has really won from this dispute. For Apple, the fact that the FBI actually hacked the iPhone doesn't sound good for its security credentials. For the FBI, it has lost credibility because no-one really bought the idea that it was only about one phone, and there's a feeling that it's been less than straightforward about its motivations for taking Apple to court.

The battle over encryption goes back decades and is sure to go on. There are concerns that authorities may now go after a smaller company, without the high profile and financial resources of Apple, to win a legal precedent that would bind the whole industry.

Whatever comes next, the tech industry must stand together to safeguard privacy and security in the digital age.

A matter of privacy [Link - ITProPortal]

An article I wrote around the FBI trying to break into an Apple iPhone was published on ITProPortal: http://www.itproportal.com/2016/03/24/a-matter-of-privacy/

============================

When Apple recently refused to comply with a federal court order issued by the FBI to help it break into an iPhone 5c, belonging to one of the shooters in the San Bernardino incident, a US House Judiciary Committee hearing was held.

If a ruling is made in favour of the FBI, Apple will have to weaken the encryption of its iPhone operating system, allowing the FBI to gain access to data on any iPhone. Apple’s chief executive, Tim Cook described this as the “software equivalent of cancer.”

Detrimental to future security

Apple’s argument is that if it is forced to write such software, it would open the floodgates to constantly writing spy tools for law enforcement. Cook gave the example of being forced to write and install a program on a suspect’s phone that would help police turn on the iPhone’s video camera. It would also seriously undermine Apple’s business, which has been partly built on the security of its proprietary software.

Inevitably, the iPhone would be weakened, leading to an operating system that could be carved open by those with the means and the will. It would open the sluice gate for other parties to break into iPhones and we’re not just talking hackers and online crime outfits, but also foreign intelligence agencies.

Widespread support

In a measure of just how serious the issue is, over 40 organisations are backing Apple’s case, including many tech companies. In short, Silicon Valley is on Apple’s side. There are also many tech companies who are not throwing their weight into the case but are quietly in support of Apple.

Microsoft, Facebook, Google, Dropbox and Snapchat are expected to sign on to briefs in the case, in support of Apple. Although not directly involved in the case, concerned parties can add additional weight, context, and information to an argument via a legal vehicle known as an amicus brief. Even the United Nations High Commissioner for Human Rights, Zeid Ra’ad Al Hussein has weighed in on the side of Apple.

Generally, there is a widespread feeling that if the FBI won it would be disastrous for the tech industry and the overall freedom of citizens. In the wake of the Edward Snowden revelations, there is an informed and widespread understanding that this case isn’t about a single iPhone; it’s about the future and the protection of safety and privacy.

Of course, the Apple FBI case also foreshadows what could happen in the UK, should the draft Investigatory Powers Bill be approved in its current form. This bill also wants to compel technology companies to produce products that are capable of having their encryption bypassed.

Draconian powers

In the UK, like in the US, it’s not only civil rights groups who are concerned, it’s the tech community too. As it stands, if the bill is passed, it would mean that the UK has one of the most draconian surveillance laws of any democracy, via mass surveillance powers to monitor every citizen’s browsing history.

The government seems intent on rushing the bill through with home secretary Theresa May wanting the bill on the statute books by December 2016. Three parliamentary committees have already made many criticisms about the draft bill suggesting a large number of recommendations are required to safeguard privacy. The government responded by adding ‘privacy’ into the title of the first chapter and apparently leaving the text virtually unchanged.

Impossible data searches

There are also questions as to whether the bill in its current state is actually possible to implement. Part of the bill legally requires ISPs to archive connections a device makes to the Internet and hold that data for a minimum of a year. Nobody for certain can say how much data that is but one thing is for certain, it is an enormous amount. Just think of one single video on YouTube that gets 10 million hits in the UK. That’s just one Internet link.

How much untargeted data would be collected and how do you decide what is useful and not useful?

Undermining foundations

It seems that as dust of outrage settles post-Snowden, governments and law enforcement on both sides of the Atlantic are ramping up their ambition to collect as much data on every citizen as possible, without thinking through the implications.

It’s a dangerous situation and one that, not only potentially undermines consumer’s trust, but also the entire tech industry and the democratic freedom we are entitled to. Security agencies can still do their job without resorting to mass surveillance just as the FBI could access the data in the San Bernardino iPhone should it wish to do so.

Freedom of speech is a fundamental right in Western democracies, as well as privacy, but the desire to weaken encryption actually weakens the foundations on which our societies are built.