You are viewing an archived webpage. The information on this page may be out of date. Learn about EPIC's recent work at epic.org.

Apple v. FBI

Concerning an Order Requiring Apple to Create Custom Software to Assist the FBI in Hacking a Seized iPhone

Summary

The dispute between Apple and the FBI arises out of an application that the agency filed with a federal magistrate judge in California, seeking assistance with the search of an iPhone that was seized during the investigation into the December 2015 attacks in San Bernardino, CA. The FBI was unable to access data on the locked iPhone, which was owned by the San Bernardino Health Department but used by one of the perpetrators, and requested that the Court order Apple to provide assistance in decrypting the phone. But because Apple has no way to access the encrypted data on the seized iPhone, the FBI applied for an order requiring Apple to create a custom operating system that would disable key security features on the iPhone. The Court issued an order requiring that this custom hacking tool be created and installed by Apple without unlocking or otherwise changing the data on the phone. Apple has opposed the order on the grounds that it is unlawful and unconstitutional. Apple argues that if the order is granted it will undermine the security of all Apple devices and set a dangerous precedent for future cases.

Top News

  • EPIC Signs on to Protect Encryption in the Brazilian Code of Criminal Procedure Updates: EPIC has joined other members of the Global Encryption Coalition in a letter urging Brazil to address proposed updates to the Brazilian Code of Criminal Procedure that would threaten encryption and data security in Brazil. The text as it stands could force companies using strong security protections - such as end-to-end encryption - to introduce security flaws into their systems to be used as backdoors for law enforcement. Such measures endanger users and encourage exploitation of these weaknesses. EPIC led the effort in the United States in the 1990s to support strong encryption tools and played a key role in the development of the international framework for cryptography policy that favored the deployment of strong security measures to safeguard personal information. EPIC also filed an amicus brief in Apple v. FBI in support of encryption. (Jun. 29, 2021)
  • Senate Judiciary Committee Approves EARN IT Act: The Senate Judiciary today unanimously approved the Eliminating Abusive and Rampant Neglect of Interactive Technologies (EARN IT) Act of 2020 (S. 3398) by a vote of 22-0. In a statement to the Committee on a previous version of the EARN IT Act, EPIC supported both end-to-end encryption and reform to Section 230 of the Communications Decency Act. EPIC pointed out that actual end-to-end encryption "protects users, promotes commerce, and ensures cybersecurity." The Committee today adopted an amendment from Senator Patrick Leahy that clarified that companies that provide end-to-end encryption are not subject to liability because they cannot access user communications. In an amicus brief in Herrick v. Grindr, EPIC objected to a court decision that found "online platforms bear no responsibility for the harassment and abuse their systems enable." (Jul. 2, 2020)
    • More top news »
  • Lawful Access to Encrypted Data Act Weakens Encryption, Undermines Public Safety » (Jun. 24, 2020)
    Senators Lindsey Graham, Tom Cotton, and Marsha Blackburn introduced the “Lawful Access to Encrypted Data Act” yesterday. The bill would would make it illegal for manufacturers to build systems that cannot be accessed by law enforcement. EPIC strongly opposes this measure. “The Lawful Access To Encrypted Data Act will make it easier for bad actors to access people’s communications. You cannot build a backdoor that only law enforcement can access. That’s not how encryption works,” said Alan Butler, EPIC Interim Executive Director. EPIC recently told the Senate Judiciary Committee that "now is not the time to undermine the systems that we all rely upon to secure our data and communications." EPIC cited growing problems of data breach and cyber attack. EPIC led the effort in the United States in the 1990s to support strong encryption tools and played a key role in the development of the international framework for cryptography policy that favored the deployment of strong security measures to safeguard personal information. EPIC also filed an amicus brief in Apple v. FBI in support of encryption.
  • EPIC to Congress: Strong Encryption Keeps Our Nation Secure » (Dec. 10, 2019)
    In advance of a hearing on "Encryption on Lawful Access," EPIC wrote to the Senate Judiciary Committee "now is not the time to undermine the systems that we all rely upon to secure our data and communications." EPIC cited growing problems of data breach and cyber attack. Leading computer scientists and security experts, including members of the EPIC Advisory Board, have found that proposals to add "backdoors" for law enforcement are "unworkable in practice, raise enormous legal and ethical questions, and would undo progress on security at a time when Internet vulnerabilities are causing extreme economic harm." EPIC previously filed an amicus brief in Apple v. FBI in support of robust security safeguards for cellphone users. EPIC argued that the "security features in dispute in this case were adopted to protect consumers from crime." EPIC explained that an order to compel Apple to take extraordinary measures to undo these features places at risk millions of cell phone users across the United States. EPIC President Marc Rotenberg warned of the risk of NSA-mandated backdoors in a 1990 article, "The Only Locksmith in Town."
  • EPIC, Coalition Warn Australian Bill Would Weaken Encryption » (Oct. 12, 2018)
    EPIC and a coalition of civil society organizations told the Australian Parliament that pending legislation would weaken digital security and increase the risks to human rights. The proposal is one of several that promotes weak encryption for digital services. In 2016, Apple refused a demand by the FBI to redesign iPhones to enable law enforcement access. The FBI sued Apple, and EPIC filed an amicus brief in support of Apple, arguing that the FBI's demand "places at risk millions of cell phone users across the United States." The FBI eventually dropped the case.
  • EPIC, Coalition Call for Investigation into FBI's Inflated Encryption Statistic » (Jun. 5, 2018)
    EPIC and a coalition of twenty organizations called for the Department of Justice Inspector General to investigate the FBI's "grossly inflated" statistic of encrypted devices inaccessible to law enforcement in 2017. The Washington Post reported that the FBI repeatedly stated it was locked out of 7,800 devices, but subsequent review suggested the actual number is about 1,200. The coalition wrote to the IG asking him to investigate the error, why DOJ officials used the data point after it was discovered to be incorrect, and what measures were taken to inform Congress and the public of the FBI's miscalculation. EPIC President Marc Rotenberg previously told POLITICO that the revelation was "a very serious matter" that "calls into question" the FBI's other statements about "the scope of electronic surveillance in the United States."
  • FBI Overstated Number of Encrypted Devices it Could Not Access Last Year » (May. 23, 2018)
    According to the Washington Post, the FBI "provided grossly inflated statistics to Congress and the public" about the number of encrypted cellphones inaccessible to law enforcement. The FBI stated it was locked out of 7,800 devices, but a subsequent review suggested the actual number is about 1,200. EPIC President Marc Rotenberg told POLITICO that the revelation was "a very serious matter" that "calls into question" the FBI's other statements about "the scope of electronic surveillance in the United States." According to the federal wiretap reports, in 2016 a total of 68 federal wiretaps were reported as being encrypted, of which 53 could not be decrypted. In a 2016 debate before the American Bar Association, former FBI Director James Comey said the FBI was locked out of about 650 phones. Rotenberg countered that 3.1 million phones were stolen or lost in a year and subject to misuse without strong encryption.
  • FBI Concealed Crypto Capabilities » (Mar. 28, 2018)
    An internal investigation has revealed the FBI was not transparent about its technical capabilities before suing Apple to unlock an encrypted iPhone. Department of Justice Inspector General reports that FBI personnel failed to communicate to agency leadership that the FBI was very close to opening the phone. Investigating the 2015 mass shooting San Bernardino, the FBI filed suit to force Apple to create custom technology to decrypt an iPhone. The Agency's case relied on the fact that it "cannot access" that phone's content. EPIC filed an amicus brief in Apple v. FBI arguing that the "security features in dispute in this case were adopted to protect consumers from crime."
  • EPIC, Coalition Urge Nations to Defend Strong Encryption » (Jul. 10, 2017)
    EPIC, and over 60 organizations urged the governments of Australia, Canada, New Zealand, the United Kingdom, and the United States to respect and defend strong encryption. These five nations, which make up a surveillance partnership of intelligence agencies, met recently to discuss national security and the challenge of encryption. The Coalition letter called for the rejection of "policies that would prevent or undermine the use of strong encryption." EPIC has advocated for strong encryption since its founding in 1994 and published the first comprehensive survey of encryption use around the world. EPIC also maintains a page on Privacy and Public Opinion.
  • DOJ Requests $21.6 million to Tackle Encryption » (Jun. 13, 2017)
    During a Senate Appropriations budget hearing today, Deputy Attorney General Rosenstein said that the use of unbreakable encryption "severely impairs our ability to conduct investigations." The Department of Justice is requesting $21.6 million to "counter the treat of Going Dark." Last year, EPIC filed an amicus brief in Apple v. FBI in support of encryption. EPIC argued that the "security features in dispute in this case were adopted to protect consumers from crime." EPIC explained that an order to compel Apple to take extraordinary measures to undo these features places at risk millions of cell phone users across the United States.
  • Congressional Working Group Releases Encryption Report » (Dec. 20, 2016)
    The Congressional Encryption Working Group has released a year-end report. Two Congressional Committees formed the working group following the FBI’s demand that Apple weaken cell phone security to provide access to encrypted data on an iPhone. The report, endorsed by both Republican and Democratic members of Congress, finds that “any measure that weakens encryption works against the national interest.” The report also notes that encryption is a global technology, and suggests that Congress should “foster cooperation between the law enforcement community and technology companies” instead of seeking a “one-size-fits-all” solution. EPIC has advocated for strong encryption since its founding in 1994 and published the first comprehensive survey of encryption use around the world. Earlier this year, EPIC filed a “friend of the court" brief in support of Apple's challenge in the FBI iPhone case. The EPIC amicus brief explained that encryption protects the owners of the approximately three million cell phones lost or stolen each year from criminal hacking, financial fraud, and identify theft.
  • UN Report Cites Threats to Freedom of Expression » (Oct. 25, 2016)
    A top United Nations official on the freedom of expression released a report citing "severe" threats to freedom of expression worldwide. The report flagged governments cracking down on encryption, blocking websites, suspending communications services, and over-classifying information as key concerns. EPIC described the importance of strong encryption in an amicus brief earlier this year and regularly litigates Freedom of Information Act cases to improve transparency about government surveillance. A new EPIC publication — The Privacy Law Sourcebook 2016 — provides an overview of legal instruments for privacy protection, as well as information about privacy agencies, organizations, and publications.
  • Wiretaps Increase Sharply in 2015, No Evidence of Government Surveillance "Going Dark" » (Jul. 1, 2016)
    In 2015, combined state and federal wiretap applications increased 16% from 3,555 to 4,148. But while government surveillance applications went up dramatically, the number of cases where investigators encountered encryption dropped significantly. Encryption was encountered in only 13 cases in 2015. The number of state wiretaps in which encryption was encountered decreased from 22 in 2014 to 7 in 2015. Law enforcement claims of "going dark” continue to be undermined by surveillance reports. EPIC has repeatedly cited the Wiretap Reports as a model of transparency for government surveillance activities and maintains comprehensive charts about the reports. The reports reveal, for example, that drug offenses were the most prevalent type of criminal offense investigated using wiretaps: 79 percent of all applications for intercepts (3,292 wiretaps) in 2015 cited illegal drugs as the most serious offense under investigation.
  • President Obama: In Digital Age, People Have New Set of Privacy Expectations » (Apr. 8, 2016)
    In remarks at the University of Chicago Law School yesterday, President Obama named privacy as one of the constitutional issues that will be increasingly salient in the years to come. "In a society in which so much of your life is digitized, people have a whole new set of privacy expectations that are understandable,” said the President. Obama said the encryption debate was “just the tip of the iceberg of what we’re going to have to figure out.” In its brief in Apple v. FBI, EPIC recently argued that cell phone encryption was adopted to protect consumers from crime. EPIC routinely files amicus briefs in cases that raise novel privacy and civil liberties issues.
  • New Congressional Report Explores Legal Issues Regarding Compelled Decryption » (Mar. 8, 2016)
    "Encryption: Selected Legal Issues," a new report from the Congressional Research Service, explores two important legal questions that arise from government requests for compelled decryption: the Fifth Amendment right agains self-incrimination and the scope of the All Writs Act, the federal statute at issue in Apple v. FBI. EPIC filed a "friend of the court" brief, joined by eight other consumer privacy organizations, in support of Apple's challenge in the FBI iPhone case, pointing to the increased risk of cell phone theft and financial fraud that would result from compelled encryption.
  • EPIC Files Brief in Support of Apple and Consumers in FBI iPhone Case » (Mar. 3, 2016)
    Today EPIC filed a "friend of the court" brief, joined by eight other consumer privacy organizations, in support of Apple's challenge in the FBI iPhone case. In Apple v. FBI, EPIC argued that the "security features in dispute in this case were adopted to protect consumers from crime." EPIC explained that an order to compel Apple to take extraordinary measures to undo these features places at risk millions of cell phone users across the United States. EPIC routinely files amicus briefs in cases that raise novel privacy and civil liberties issues. EPIC has filed two briefs in the United States Supreme Court in the past year in cases concerning consumer privacy and also the Fourth Amendment.
  • Bill to Establish Digital Security Commission Introduced in House » (Mar. 2, 2016)
    Rep. Lieu (D-CA) has cosponsored bipartisan legislation to create a Digital Security Commission that will explore how law enforcement should pursue investigations without undermining constitutional privacy protections or American competitiveness. Rep. Lieu emphasized, "strong national security and a strong economy requires strong encryption." The legislation comes as Apple opposes a court order to compromise iPhone security to allow government access. Congressman Lieu called upon "the FBI and DOJ to withdraw their coercive demands of Apple and allow the democratic process to work." In 2015, EPIC gave the Champion of Freedom Award to Apple CEO, Tim Cook, for his work protecting privacy and promoting encryption.
  • NY District Court Denies Government Demand to Unlock iPhone » (Feb. 29, 2016)
    Magistrate Judge Orenstein denied a government request under the All Writs Act to force Apple to unlock an iPhone. Judge Orenstein stated "the government's construction of the [All Writs Act] produces absurd results in application." The ruling comes the day before a Congressional hearing to address recent efforts to force Apple to decrypt iPhones. Apple is opposing a court order in another case that would require the company to make changes to the iPhone to enable government access. In 2015, EPIC gave the Champion of Freedom Award to Apple CEO, Tim Cook, for his work protecting privacy and promoting encryption.
  • Apple Opposes FBI Decryption Order » (Feb. 25, 2016)
    Today Apple filed a "motion to vacate" a court order that would require the company to make changes to the iPhone to enable law enforcement access to personal information. In its brief, Apple asserts that this case is about "the ability to force companies like Apple to undermine the basic security and privacy interests of hundreds of millions of individuals around the globe." Apple argued that the FBI's requested court order violates the First and Fifth Amendments. Consumer Reports found that more than 3.1 million cellphones were stolen in 2013, and noted that "efforts by the telecom industry to reduce thefts don't seem to be helping matters." In 2015, EPIC gave the Champion of Freedom Award to Apple CEO, Tim Cook, for his work protecting privacy and promoting encryption.
  • Writers Side with Apple in Encryption Fight with FBI » (Feb. 24, 2016)
    In a letter to the Attorney General, leading writers and artists protested the FBI's "efforts to force Apple to create software that could effectively enable the U.S. government to unlock any iPhone." The letter from the PEN America Center highlights how "intrusions on privacy damage creative expression and free speech." EPIC has long supported strong encryption as key to the future of privacy and security. EPIC recently gave the 2015 Champion of Freedom Award to Apple CEO Tim Cook for his work in promoting encryption and protecting privacy and security. The 2016 EPIC Awards dinner will be held on June 6th in Washington, DC.
  • Apple Opposes FBI Decryption Order » (Feb. 17, 2016)
    Apple has opposed a court order that would require the company to make changes to the iPhone to enable law enforcement access to personal information. The order followed an FBI application under the All Writs Act, a law from 1789. Apple CEO Tim Cook wrote in response that the government's action "would undermine the very freedoms and liberty our government is meant to protect." In 2015, EPIC gave the Champion of Freedom Award to Mr. Cook for his work protecting privacy and promoting encryption. The EPIC 2016 Awards dinner will be held June 6 in Washington, DC.
  • Senate Judiciary Committee Holds FBI Oversight Hearing » (Dec. 10, 2015)
    The Senate Judiciary Committee held an oversight hearing with FBI Director James Comey. Following the calls of some political leaders to exclude Muslims from the United States, Senator Leahy warned leaders to not "succumb to the politics of fear and lose sight of our fundamental American values." Director Comey continued to advocate for weakened encryption to enable law enforcement access to private communications. EPIC has championed strong encryption and urged President Obama to reject proposals to weaken encryption. EPIC has also urged oversight of the FBI's Next Generation Identification program, a massive biometric database, that lacks appropriate privacy safeguards.
  • Congress to Hold Hearing on Encryption and Privacy » (Jul. 8, 2015)
    Today the Senate is holding a hearing on "Going Dark: Encryption, Technology, and the Balance Between Public Safety and Privacy." FBI Director Comey, testifying today, has advocated for broken encryption to enable law enforcement access to private communications. Despite claims of "going dark" because of new encryption technologies, law enforcement encountered encryption in only 25 wiretap cases in 2014. Of those cases, non-encrypted text was obtained in all but four cases. EPIC has advocated for strong encryption and urged President Obama to reject proposals to weaken encryption. EPIC published the first comprehensive survey of encryption use around the world. And earlier this year, EPIC gave a Champion of Freedom Award to Apple CEO Tim Cook, who warned that "Criminals are using every technology tool at their disposal to hack into people's accounts. If they know there's a key hidden somewhere, they won't stop until they find it."
  • Leading Security Experts Oppose Government Encryption Plan » (Jul. 7, 2015)
    Several members of the EPIC Advisory Board, leading experts in security technology, have warned that a government plan to weaken encryption threatens the nation's critical infrastructure and puts at risk confidential personal information. Recalling a similar report from 1997, the researchers concluded that "the damage that could be caused by law enforcement exceptional access requirements would be even greater today than it would have been 20 years ago. Recent reports from the US courts, available from EPIC, show that encryption has not been an obstacle to law enforcement investigations. A 1994 Internet petition led to the demise of "Clipper," the original government plan for escrowed encryption.
  • Slight Decrease in Wiretaps in 2014, Encryption Not a Barrier to Investigations » (Jul. 2, 2015)
    In 2014, combined state and federal wiretap applications decreased 1%, from 3,577 to 3,555. Investigators encountered encryption in only 25 cases, and were able to obtain plain text in all but four cases. This fact contradicts claims that law enforcement agencies are "going dark" as a result of new encryption technologies. Of the 3,544 arrests based on wiretaps in 2014, only 553 resulted in convictions. The annual Wiretap Report, details government surveillance and provides insight into the debate over surveillance and the use of encryption. EPIC has repeatedly cited the annual Wiretap Report as a model for greater transparency of other surveillance activities . EPIC also maintains comprehensive tables and charts on electronic surveillance.
  • UN Report Champions Encryption and Anonymity » (May. 28, 2015)
    The UN Special Rapporteur on Freedom of Expression released a report today supporting strong encryption and anonymity tools. The Rapporteur finds that, "States should not restrict encryption and anonymity, which facilitate and often enable the rights to freedom of opinion and expression." EPIC previously urged the UN to support secure, anonymous communications, stating, "In our modern age, encryption is the key technique and anonymity is the core legal right that protects the right to privacy." EPIC published the first comprehensive survey of encryption use around the world and worked in support of the OECD Cryptography Guidelines of 1997.
  • EPIC, Coalition to President: No Encryption Backdoors » (May. 20, 2015)
    EPIC and a coalition of civil society organizations and security experts urged President Obama to reject proposal to weaken encryption used in U.S. products. Administration officials, including FBI Director Comey, have advocated for broken encryption to enable law enforcement access to private communications. The letter details how weakened encryption undermines cybersecurity and economic security. EPIC previously led the effort to oppose the "Clipper Chip," the NSA's proposal for key escrow encryption that would have severely crippled the privacy and security of online communication. EPIC also recently expressed support for encryption and anonymity in a letter to a UN Rapporteur.

Background

The dispute between Apple and the FBI arises out of a warrant application that the agency filed in the U.S. District Court for the Central District of California in December 2015, following the attacks in San Bernardino. The case is captioned "In the Matter of the Search of An Apple iPhone Seized During the Execution of a Search Warrant on a Black Lexus IS300, California License Plate 35KGD203." The FBI filed an application for an order of assistance under the All Writs Act, 28 U.S.C. § 1651, on February 16, 2016. The Court granted the application the same day and issued a three page order requiring apple to "assist in enabling" the search of the phone by "providing reasonable technical assistance," which "shall accomplish the following three important functions":

  1. it will by pass or disable the auto-erase function whether or not it has been enabled;
  2. it will enable the FBI to submit passcodes to the SUBJECT DEVICE for testing electronically via the physical device port, Bluetooth, Wi-Fi, or other protocol available on the SUBJECT DEVICE;
  3. it will ensure that when the FBI submits passcodes to the SUBJECT DEVICE, software running on the device will not purposefully introduce any additional delay between passcode attempts beyond what is incurred by Apple hardware

The Court also specified that "Apple's reasonable technical assistance may include, but is not limited to: providing the FBI with a signed iPhone Software file, recovery bundle, or other Software Image File ("SIF") that can be loaded onto the SUBJECT DEVICE." This custom software would need to be able to "load and run from Random Access Memory ("RAM") and will not modify the iOS on the actual phone, the user data partition or system partition on the device's flash memory." Apple would also need to uniquely code the software to the phone at issue and provide the government with a means to "conduct passcode recovery analysis" on the device in an Apple facility or government facility.

The Court noted that Apple may seek to comply with the order "using an alternate technical means" if "it can achieve the three functions" stated in the order. The Court also noted that "Apple shall advise the government of the reasonable cost of providing this service" and that "[t]o the extent that Apple believes that compliance with this Order would be unreasonably burdensome, it may make an application" to the Court "within five business days" of the Order.

Shortly after the Court granted the FBI application and issued the order to Apple, the FBI moved to unseal the documents and notified the press of its request for Apple's assistance in the case. In response, Apple CEO Tim Cook published a letter to Apple customers, making clear that the company would oppose the order and that the order would set a "dangerous precedent." The Court subsequently issued a scheduling order, establishing deadlines for briefs in the case and setting a hearing for March 22, 2016 at 1:00pm. The FBI also filed a motion to compel compliance with the court's February 16th order.

On February 25, 2016, Apple filed its motion to vacate the Court's order, arguing that the order is unlawful and unconstitutional. Specifically, Apple argued that "[t]he All Writs Act does not provide a basis to conscript Apple to create software enabling the government to hack into iPhones" and that the Order "would violate the First Amendment and the Fifth Amendment's Due Process clause."

EPIC's Interest

Since its founding more than 20 years ago, EPIC has been an advocate for the rights of consumers to use strong encryption and the promotion of privacy enhancing technologies. This issue was at the center of the national debate 1990s after the White House introduced the Clipper Chip proposal in 1993 and the FBI led an effort to outlaw non-escrowed encryption. EPIC lead one of the first major Internet petitions in opposition to the Clipper proposal after a group of leading cryptography experts sharply criticized the Clipper Chip technology in a letter to the President. EPIC also filed amicus briefs in two important cases concerning export controls and other restrictions on the use of encryption software, Bernstein v. U.S. Department of Justice, 176 F.3d 1132 (9th Cir. 1999), vacated, 192 F.3d 1308 (9th Cir. 1999), and Karn v. U.S. State Department, 107 F.3d 923 (D.C. Cir. 1997). The district court decision in Bernstein established that code is speech and that restrictions on the dissemination of encryption software burdened the First Amendment rights of a computer researcher. Ultimately the Clipper Chip proposal and efforts to ban strong encryption were defeated.

EPIC also played a key role in the development of the international framework for cryptography and privacy policy, which led to establishment of the OECD Cryptography Guidelines in 1997. These guidelines outlined eight key principles to guide the development of international cryptography policy, including (1) the establishment of trust in cryptographic methods in order to promote the use of communications systems, (2) the right of users to choose any cryptographic method, and (3) the protection of privacy and personal data. A report by the National Academy of Sciences also found in 1996 that cryptography "is a most powerful tool for protecting information" and that "many vital national interests require the effective protection of information." EPIC also prepared a report entitled Cryptography and Liberty 2000, which outlined the state of international cryptography policy following the resolution of the key escrow and export controls debates.

Legal Documents

U.S. District Court for the Central District of California, Nos. 16-cm-00010 and 15-mj-00451

Resources

News

Share this page:

Defend Privacy. Support EPIC.
US Needs a Data Protection Agency
2020 Election Security