The Federal Bureau of Investigation is once again asking Apple to help unlock the iPhone of a potential terrorist.
The FBI is looking to crack two iPhones that they believe were owned by Mohammed Saeed Alshamrani, the Saudi-born suspect in the shooting attack that killed three people in December at the Naval Air Station in Pensacola, Fla.
Both phones are password-protected, and agents are trying “to ‘guess’ the relevant passcodes but so far have been unsuccessful,” according to a letter sent to Apple’s general counsel, obtained by NBC News.
Alshamrani was killed during the attack and is believed to have been acting alone, but the letter explained that the FBI wants to search the phone “out of an abundance of caution.” The Bureau has not yet offered a definitive statement on whether or not the attack should be seen as an act of terrorism, and the phone contents could help clarify his motives and any ties to outside organizations or groups.
The letter goes on to detail the FBI’s efforts so far to open the phones, including soliciting help from other federal agencies, turning to third-party vendors and even asking experts from other countries’ intelligence and law-enforcement communities.
For Apple’s part, “We have the greatest respect for law enforcement and have always worked cooperatively to help in their investigations,” the computing giant said in a statement. “When the FBI requested information from us relating to this case a month ago, we gave them all of the data in our possession and we will continue to support them with the data we have available.”
The statement does not indicate whether Apple will in fact assist in unlocking the phones, which the FBI said are being held in the crime lab at Quantico, Va.
Deja-Vu Privacy Implications
The FBI has been in this situation before, when it wanted to open the locked phone of Syed Farook in 2015. Farook was one of two men who carried out a shooting attack on a city meeting in San Bernardino, Calif. in 2015; though he died in a shootout that same day, the Justice Department asked for Apple’s help to access the phone’s contents on the grounds that the case was a potential case of terrorism with national security implications. The issue was that the iPhone 5C was locked with a four-digit passcode—after 10 incorrect guesses, the phone would be wiped.
Apple however refused to help, and ultimately the DoJ took the vendor to court over the issue. That resulted in a court order demanding that Apple assist in cracking the phone by providing a one-time firmware update, customized for that one device, that would bypass the auto-erase function protecting the phone. That in turn would allow the FBI to brute-force the passcode.
Apple however argued that this set a dangerous precedent whereby the FBI could demand a backdoor into any person’s device.
“The implications of the government’s demands are chilling. If the government can use the All Writs Act to make it easier to unlock your iPhone, it would have the power to reach into anyone’s device to capture their data,” Apple CEO Tim Cook said in a court filing at the time. “The government could extend this breach of privacy and demand that Apple build surveillance software to intercept your messages, access your health records or financial data, track your location, or even access your phone’s microphone or camera without your knowledge.”
Before the court case could come to its final conclusion, the FBI withdrew its request and announced that it had unlocked the iPhone with an unnamed third party’s help. FBI Director James Comey said at the time that the FBI had purchased a “tool” to hack the phone that cost more than $1.3 million. Some news sources identified the third party as Israeli company Cellebrite, but the Washington Post reported that the Bureau had in fact purchased a zero-day exploit from “professional hackers” to get the work done.
In another incident, Apple was ordered to unlock an iPhone 5S in a drug case in the United States District Court for the Eastern District of New York in Brooklyn, which it challenged. Ultimately, a magistrate judge in the case denied the government’s request, saying that its legal argument – involving the 18th-Century All Writs Act – was flimsy at best.
“The implications of the government’s position are so far-reaching – both in terms of what it would allow today and what it implies about Congressional intent in 1789 – as to produce impermissibly absurd results,” he wrote in the opinion.
Concerned about mobile security? Check out our free Threatpost webinar, Top 8 Best Practices for Mobile App Security, on Jan. 22 at 2 p.m. ET. Poorly secured apps can lead to malware, data breaches and legal/regulatory trouble. Join our experts to discuss the secrets of building a secure mobile strategy, one app at a time. Click here to register.
