http://www.apple.com/customer-letter/

Rather unprecedented for a technology company, the last time Apple made a public statement like this was on their Maps application. That said I think they will win a lot of plaudits for taking a stand, I have no doubt the rest of Silicon Valley and joe public will support them in great measure.

Thoughts?

Should Britain force tech companies to do a similar thing?

I'm in two minds. I think forensics teams should be able to get access to a device, just like the police getting access to an office/home of someone arrested.

I don't think anyone should be given access 'over the air' so to speak.

What concerns me is that many people who are so keen on security actually don't have anything that any agency would be bothered about, yet some people do and we're protecting them to appease those who just want to stick it to the man.

But then the reverse could be argued that the security and privacy of the many is taken away at the expense of the few?

Apple makes a very sound point, should it enable a backdoor loophole what is to stop that being abused by more trivial situations in divorce cases when one person is suspect of cheating.

Personally I don't have an issue with the communications bill the Tories are trying to pass at the moment, its not perfect but it does update the law and allow communications to be monitored legally. I do not believe Tech companies should be forced to create a backdoor into their products at the whim of state authorities, it would set a precedent where by other companies like Google or Samsung would be forced to do the same.

What is even more ironic though, some parts of the DOD in America allow low level security clearance on iPhones, should Apple succomb to demands from the FBI then they can kiss goodbye to that relationship. The Apple situation is essentially a test case, I have no doubt the rest of Silicon Valley will be pooling resources soon enough should this go further.

The thing in this case I think, is that its a government agency going rogue and trying to using a rather mundane and out of date piece of legislation. It isn't the government directly who have been pushing for this, funnily enough all the presidential candidates have offered a more nuanced opinion, which shows how delicate this matter can be.

Props to Apple for making this public knowledge, didn't expect anything like that from this company.

But I do agree there should be a way for the authorities to access what they need, but only under these circumstances, and as the articles mentions, it's difficult to "police" that (no pun intended )

Surely the NSA must be able to access these devices?
I do wonder if all this is about the FBI and related parties trying to set a legal precedent (which can then be used for other cases) rather than actually needing Apple to be able to access this specific device.

My main concern if Apple's hand is forced here is what then stops other (more dodgy) governments wanting the same? Do you really want China or Russia having the ability to hack into anyones iPhone? (personally I don't even want the US or the UK governments being able to do that but for those who are happy for our governments to do it you have to realise it won't stay within our governments).

I also find it interesting that the court order is quite specifically about removing the number of attempts limits (is it 3 before you can't try again and 10 and the device wipes?) to allow them to brute force the passcode. It is a pretty weird specific suggestion. If they genuinely just wanted access to the device why not make the court order specific to giving the FBI access?

Yes, it is quite puzzling, especially as Apple have a master key. And apparantly they said yes in 70 other situations.

Like above, I am sort of wondering if it is the terrorism aspect of it that is the problem, in that, whilst it is OK nicking standard criminals, terrorism crosses international boundaries.

http://www.zerohedge.com/news/2016-0...-feds-70-times

It is too puzzling to be that, so from the prior post, maybe it is because the FBI seem to want unfettled access to all devices.

I suspect Apple and others are standing firm to make sure they don't get a backlash from social media that harms its reputation and finances, by having their devices perceived as not 'secure'.

And criminals need ways to communicate, so perhaps Apple, Google etc don't want to lose that market either!

That's providing of course criminals actually buy phones instead of theiving them.

That article is confusing because it says that Apple acknowledged that it could extract data from an iPhone running iOS 7, but it also says that the iPhone in this case is running iOS 9. It also says that Apple could extract unencrypted data, which suggests that Apple may not be able to extract encrypted data.

This is how i thought it worked. basically the only person who can unlock the data is you with a fingerprint or pin. Apple even warn when setting it, that forgetting the pin would be a bad idea because Apple can't unlock it even if they wanted to.
It uses 256 bit AES based on your pin so I can't see how they could.

It's an iPhone 5C which does not have any of the hardware protections that later devices have.

The FBI wants Apple to make a special version of iOS that eliminates the delay between failed passcode attempts - on a 5C this is apparently done by the operating system, on newer phones the "secure enclave" on the CPU is doing it.

By eliminating the protection, the FBI would be able to try all potential passcodes quickly and (eventually) get in to the phone

It's likely possible for Apple to do this, but they don't want to.

Apple doesn't have a "master key", though. They can make software updates that change certain behaviours but they can't just plug it in and unlock somneone's phone with their special powers. At least, this is their public stance - and what they're telling the courts and FBI.

As for the "70 times", I'd guess some of these occured under a different CEO and before Apple changed its position on security. Remember that at one time, the iPhone had no encryption - and in fact it was criticised because it lied to email servers and device management systems - it would say the device has encryption enabled when it did not. Apple has obviously taken huge steps forward since then, with its phones likely to be more secure than most Android devices

No, I think it was mainly about unlocking the phone, something that has likely not changed.

The Guardian article on the dispute between the FBI and Apple says

"In September 2014, Apple introduced new encryption into its iPhone operating system that would make it mathematically impossible for the company to unlock them for investigators. This was a departure from the past, when investigators could get access to a device if they sent it to Apple headquarters with a search warrant...

"Since then, FBI director James Comey has been trying to figure out a way around the software as he and Apple’s Cook have traded barbs publicly and privately."

I read that as meaning that it's now much harder to unlock an iPhone, if you don't know the passcode, than it was with iOS 7. The gist of the article is that since iPhone security was brought up to its current level, the FBI has been looking for a good reason to challenge Apple in court, and this case was chosen because the terrorist nature of the crime was more likely to influence the court to rule in the FBI's favour.

Actually you would find Android is more secure by virtue of the fact you can sandbox work related apps and run them in a secure layer. Apple's devices don't have that ability natively, they really have bumped up their security, just not enough for DOD contracts or high level security clearance.

I think those are device-specific features though - like Samsung's Knox or the Blackberry equivalent in the Priv. Hence "most Android devices".

iDevices are good enough for the DOD - http://www.zdnet.com/article/iphones...rtifies-cloud/

Thats just C.T.A and good PR.

As I said low level security work, stuff that isn't classified. The DOD still relies on Blackberrys for most of the high security stuff. Blackberry also has a security suite that can be installed on any android device, "secured by blackberry", able to run sandboxed within a secure layer.

They seem to be talking about fingerprint encryption. Here it is a 4 digit unlock code to access the device, from where you would be able to see the data.

I really cannot see them not being able to set the device for infinite passcode attempts, thus bypassing a 4 digit code in minutes.

http://www.technobuffalo.com/2015/09...pass-passcode/
And I always assumed upteen flaws are there/introduced for bypassing such.

http://www.theguardian.com/technolog...t-order-iphone

'The FBI accused Apple of prioritizing its public relations strategy over a terrorism investigation on Friday'

'The government on Friday took off its gloves.

It accused Apple of “numerous mischaracterizations” of the government’s request and “an incorrect understanding” of the law underlying the Justice Department argument.

The government has asked Apple to write and digitally sign software that would make it easier for investigators to guess the passcode for an iPhone 5C used by Syed Farook, one of the shooters in the December attack in San Bernardino, California, that left 14 people dead.

Apple said that forcing it to do so would undermine trust in the security of its company’s products. The government, in effect, would be forcing it to hack one of its phones through the automatic update process consumers use monthly

An Apple spokesman didn’t immediately return a request for comment on the filing.'

The whole situation is worrying. I don't mean to go over board however what messege is this giving out to criminals especially pedophiles? Go buy an IOS device ?

Yes it's right for people to feel there data is secure however as a society we have accept on some level that there is genuine need here and will be in near future and this level of security is hindering and potentially allowing millions of criminals to walk free from justice.

Just ask yourselves if this was the only way to catch serial sex attacker, that affected your family how would you feel ?

I sympathize with both sides here. If there were a case where we should consider forcing Apple it would be this one, but at the same time it still comes close to an acceptable description of civil rights.

This is true, I can offer my perspective having worked in Civil Service security focusing formally on IT for a short term.

On the UK Government's scale of IL1-6 (being phased out) Blackberries are still very often used from IL3 and up because they offer a cheap way to meet the strict GCHQ/CESG guidelines.

The whole system is being reformed so that Official is replacing levels 1-3/4 which is up to about Confidential on the old system. The government is basically saying that departments operating than that should use similar security to a large enterprise. Anything up from that will be Secret/Top Secret for which I doubt many public network physical devices will be allowed. In fact looking at the guidelines Top Secret requires the use of a "bespoke architecture" for ICT Services. I do wonder how much use is made of the C&W managed Government network for stuff like that.

Right, but even if you install that security suite, you won't get the level of security promised by an actual Blackberry OS device. Just as you won't if you install any competing solution onto a generic Android phone.

With their Priv they've put in special effort to ensure that the hardware is part of the security system, similar to Apple's attempts with the iPhone or Samsung's Knox. None of them would likely be approved as Obama's personal phone - he'd probably get a BBOS phone instead. If he went Android they'd probably get the NSA to sort out a specially hardened version

Don't forget that not every US government employee is looking at super top secret stuff on their phone - Knox/iOS/Blackberry (Android) will be perfectly fine for the rank and file

I can understand the concerns the 3 letter agencies have, and it makes sense where there are cloud services where there's no real expectation of security and it's kept unencrypted at the other end anyway in order for the services to work (which is why I don't mind using Google's services despite their stance in favour of handing over data to law enforcement if there's a court order). The connection from you to Google is secure, so it greatly minimises the risk of the bad guys getting hold of it, but there's still the datacenter at the other end if you need to be investigated for some kind of evil deeds.

The problem is, with a device like an iPhone that you carry around with you, pay for things with and keep a lot of private things on, it is quite important for it to be secure. And all your security is in one place, it's all in that one little device. If you build in a backdoor then it's a backdoor for everyone who finds it. That includes criminals. There isn't really such a thing as "can you build in a vulnerability that only the good guys can use please".

The other issue is once they can do this, that's it they can do it and it's the new norm. If the government turns bad (which may seem far fetched but it's something that's happened to numerous previously thriving countries throughout history) they can then end up abusing that power. Let's say we or the US ended up like Russia and homosexuality is criminalised again for example, if things got really nasty this could be used to round all those up for "correction" / jail / castration / execution depending on how evil they get. It's all hypothetical of course, but based on a history of governments going corrupt and making other bad decisions.