Skating on Stilts

Deposing Tim Cook

To avoid helping the FBI search the San Bernardino terrorist’s phone, Apple and its CEO, Tim Cook, are going to spend weeks in court, and probably on Capitol Hill.  That means that for the first time the government will have a chance to use subpoenas and discovery to judge the truth of the claims that the famously secretive Silicon Valley company and its allies have been making.  This should be fun.

Apple's story is that helping the FBI would require an “unprecedented and unreasonably burdensome” code-writing exercise and that once the code is written, authoritarian regimes like China's will demand that Apple use the code to help them spy on their citizens.

Okay, then.  Now that narrative can be tested against the facts.  So here in the form of an open letter are some of the questions I’d ask Tim Cook if I had him under oath.

Dear Tim Cook,

In court, you’ve said that it would take two to four weeks to write the code the FBI wants, using a small team of 6-10 Apple employees.  This is too much work, your lawyers told the court, especially since it might end up helping repressive regimes surveil their own people.

What I’d like to know is just how much work you’ve already done for repressive regimes surveilling their own people:

One repressive regime in particular, actually.  China's.

1. In 2014, you moved your Chinese users’ iCloud backup to China. You didn't announce it in advance.  In fact, you didn't acknowledge the move until it was leaked, at which point you said only this: "Apple takes user security and privacy very seriously. We have added China Telecom to our list of data center providers to increase bandwidth and improve performance for our customers in mainland China. All data stored with our providers is encrypted, China Telecom does not have access to the content."

Well, that's really good news about your taking privacy and security seriously.  But your statement raises more questions than it answers.  Just because the data is encrypted and not available to the owner of the data center doesn’t mean it is not available to the Chinese government on request.  So:

• Is iCloud data stored in China available to the Chinese government upon request under Chinese law?
• Did moving the data to China make it more easily available to China by eliminating oversight from the government of the country where the data used to be stored? ("Well, duh," is an acceptable answer here.)
• Did you write a long brave public letter to your customers explaining the privacy dangers of this move and calling it a “back door” for the Chinese government?  (If so, I missed it; maybe you can provide the link?)
• Speaking of which, have you ever explained whose data is stored in China? Mine?  Jim Comey’s?  What about users in Hong Kong, Singapore, and Taiwan, or Americans who might have bought an iPhone in China?  (Maybe that was covered in your open letter to Chinese customers; but it seems to have gone astray.)
• Also, other tech companies like Google have refused to store their users’ data in China. Is that because they care more about their customers’ privacy than Apple does? (Hey, Tim, maybe you could use that as a market differentiator:  "Remember, when you buy a Chinese iPhone, you are the product.")
• Oh, and could you please compare the cost incurred by Apple in moving its iCloud storage to China for the convenience of the Chinese security apparatus to the cost of complying with that “unreasonably burdensome” FBI request? Did you spend more than two weeks and use more than six employees to move and store all that data?  (If you haven't got "Well, duh" programmed into CTRL-C yet, this might be a good time. We aren't close to done.)
• While we’re at it, how many times have Chinese authorities accessed the data that you moved? Or do they have the key to that cloud encryption you bragged about in your public statement?

2. Not long after you moved your iCloud storage to China, the government allowed Apple to start selling the iPhone 6, though only after weeks of negotiations with China over “security issues.” (Just as an aside, that was a coincidence, wasn’t it?  I mean, the Chinese government wouldn’t play hardball like that, and if they did, the Tim Cook I know would have written a bold libertarian letter to Apple customers loudly rejecting any such linkage, right? Maybe we should just subpoena your internal email on that topic to be sure, hmmnh?)

3. But the Chinese government still wasn't done with you, were they? As soon as the iPhone 6 went on sale in China, the Chinese government launched a man-in-the-middle attack on communications between new phones and Apple’s iCloud. According to human rights campaigners at greatfire.org, the Chinese government used a fake Apple certificate to steal the logon credentials and passwords of every Chinese iPhone 6 user who clicked through the warning notice to connect to the iCloud.  Apple issued a statement explaining that users shouldn’t click through such warnings.  Here’s how it begins:

"Apple is deeply committed to protecting our customers’ privacy and security. We’re aware of intermittent organized network attacks using insecure certificates to obtain user information, and we take this very seriously. These attacks don't compromise iCloud servers, and they don't impact iCloud sign in on iOS devices or Macs running OS X Yosemite using the Safari browser."

Well, phew!  What a relief.  You're committed to privacy and security (still!), and there's something intermittent happening but it doesn't compromise and it doesn't impact.  Somehow, though,  the statement never gets around to mentioning the Chinese government’s role in the attacks or the terrible precedent of letting a government use fake certificates as a “back door.”  Did that get left on the cutting room floor?  Just for comparison purposes, here's how your letter to customers about the FBI court order begins:

The United States government has demanded that Apple take an unprecedented step which threatens the security of our customers. We oppose this order, which has implications far beyond the legal case at hand.

So, pretty much the same, huh, except for all the righteous thunder and finger pointing and threatening and demanding and opposing.  Maybe your internal emails about that incident, and the edits the statement went through on its way to publication would help us understand why an indiscriminate attack on all iPhone users in China didn’t require that you give China’s Minister of Public Security the full Jim Comey treatment.

4. Actually, that wasn’t Apple’s first compromise with China’s security agencies, was it? The Apple 4S, introduced two years earlier, was modified for sale in China: Apple added a special chip that supported a very special Chinese version of wifi, called WAPI. WAPI, it turns out, has its own, different brand of encryption.  How different?  Who knows? The Chinese government refused to reveal which encryption algorithms it was adding to WAPI, claiming that they must remain state secrets.

Outside of Apple, WAPI didn't earn much enthusiasm in tech circles.  When China tried to make WAPI a standard, engineers revolted, arguing that “almost no commercial market will trust or accept unknown ciphers.”  Others said plainly that “without WAPI being fully published for examination, there's no way to determine the strength and integrity of the protocol--including whether backdoors are part of the standard.”  The United States government fought against WAPI, and China eventually agreed to abandon its efforts to make this suspect protocol a national or international standard.

But you built it in anyway.  (Good old Apple! you've been defying the US government on security issues for years, haven't you? And not even asking for any credit!)

• So, maybe you can explain why a secret encryption system that everyone suspects of having a real back door is good enough for Apple’s customers in China? Also, when the FBI wants a court order, you apparently have no difficulty calling it a back door.  So what exactly did you call the back door in WAPI?  (I’m still looking for the link to your courageous letter to Chinese customers on that topic.)
• Was Jim Comey’s problem that he didn’t ask you to adopt a secret NSA encryption algorithm that you could build into all your phones here? (There's still time to fix that!)
• Oh, and maybe you could compare the two to four weeks of effort that the FBI wants from a small team of Apple employees to the amount of effort that Apple spent writing code to support the Chinese government’s secret WAPI encryption chip for Apple's Chinese products.
• And could you also explain why you seem to think the Chinese are waiting with bated breath to find out what precedent Judge Pym will set on the FBI's request to defeat a single security feature on a single phone? 'Cause if they've already gotten you to install a fully backdoored WAPI encryption system on every Chinese iPhone, what do the Chinese need with the code you plan to write for the FBI if and when the President actually declares martial law and occupies Cupertino?
• Finally, for extra credit, can you confirm or rebut claims that the mysterious WAPI chips you built into the iPhone have been designed to receive signals on undisclosed frequencies, and that this opens up the possibility that they are being used by the Chinese government to carry out surreptitious two-way communications with any Chinese iPhone of interest as soon as it is turned on?  (I mean, you're such privacy-loving techies and all. I'm sure you devoted as much engineer time to getting to the bottom of that as you did to your briefs opposing the FBI.  Being as how they're your phones and all.)

Anyway, all the best, and many thanks, Tim.

I’m really, really looking forward to your testimony.

                                                 Yours truly,

                                                                                                                         Stewart Baker

Episode 102: NSA's General Counsel speaks

What is the most surprising discovery a law firm partner makes when he jumps to the National Security Agency?  I direct that and other questions at Glenn Gerstell, who has just finished six months in the job as General Counsel at the National Security Agency.

In the news roundup, we begin, of course, with the fight between Apple and the Justice Department.  I open the discussion by reminding the audience that the war on terror cannot be a war on one of the world’s great religions and insisting that Apple remains a religion of peace.  Michael Vatis describes the Justice Department’s latest filing, and we trade for deep discovery, not only at the FBI but also at Apple.

CFIUS has released its annual report – only eighteen months late – and the report shows continuing tough review standards from the Committee,Stephen Heifetz reports.  There is no sign yet that Chinese acquisitions will experience a smoother ride in future.

Michael and I report on Google’s new effort to accommodate European data censors by geolocating users of google.com.

Finally, the judiciary is allowing defense lawyers to take a close look at the code used by the FBI to capture data about users of a child porn site seized by the Bureau.

As always, the Cyberlaw Podcast welcomes feedback.  Send an e-mail to[email protected] or leave a message at +1 202 862 5785.

Download the 102^nd episode (mp3).

Subscribe to the Cyberlaw Podcast here. We are also now on iTunes and Pocket Casts!

Episode 101 -- Live before an inebriated audience!

The Second Annual Triple Entente Beer Summit again filled the Washington Firehouse loft with an audience at least as knowledgeable as the panel, which consisted of Ben Wittes, Shane Harris,Stewart Baker, Tamara Cofman Wittes, and Alan Cohn.  The Triple Entente Beer Summit brings together members of the Lawfare, Rational Security, and the Steptoe Cyberlaw podcasts.

The topic of the day was the confrontation between Apple and the Justice Department over gaining access to the iPhone used by one of the terrorists responsible for the mass killing in San Bernardino, California.  Suffice it to say that the podcast was not sponsored by Apple, nor will it be any time prior to the heat death of the universe.

We also dig into the Nitro Zeus story, claiming that in 2009 the United States prepared a massive cyberattack on Iran as an alternative to kinetic action in the event that nuclear talks failed and Iran began a nuclear breakout.

Finally, the panel explores the administration’s rekindled enthusiasm for CVE – countering violent extremism.  We provide a definitive answer to the question, “Do we need more GS-14s tweeting on terrorism?”  And Tamara Wittes challenges us to find the difference between late Obama and late Bush in the messaging department.

Then the audience takes over, greatly raising the tone of the podcast with a series of thoughtful questions for the panel.

It was a fine evening, and we look forward to another reunion soon.

As always, send your questions and suggestions for interview candidates to [email protected] or leave a message at +1 202 862 5785.

Download the 101^st episode (mp3).

Subscribe to the Cyberlaw Podcast here. We are also now on iTunes and Pocket Casts!

Or is Apple happy to enable a backdoor as long as it makes money from it?

My earlier post on whether Apple's iPhone can be used legally in the financial industry produced some useful quick responses via Twitter.  

The short answer seems to be that the iPhone probably can't be legally used for communicating with financial industry customers without modification, either of the operating system or of the apps that are used.  That is, the app and/or the operating system has to allow corporate management access to the contents of the phone, or at least to the "corporate" apps on the phone.

What's interesting is that Apple seems to have modified its operating system to provide corporate purchasers exactly that.  Apple offers something called MDM, or mobile device management.  Talking to corporate managers, Apple brags, a bit obscurely, that "because corporate accounts, apps, and content installed via MDM can be managed by iOS, IT has the ability to remove or upgrade them without impacting personal data." (Emphasis added.)  I think that means that the company can go into the iPhones of its employees and read the contents of their communications whenever it wants.

MDM isn't exactly the most communicative name for the access Apple has created.  The company has been insisting a bit counterintuitively that a Justice Department request that it disable a peripheral security feature on a single phone is "a backdoor."  If so, what should we call MDM, which enables access to every account, app, and piece of content installed on an iPhone?  A front door?

Actually, I suspect Apple calls it a marketing opportunity.  

It turns out Apple is happy to create a back door for its phones if that expands its market.

Who would have guessed?

Three further points:

1. Apple does make an effort to segregate the user's own data from the backdoored corporate enclave it creates with MDM.  Whether that really works under stress is an open question.
2. San Bernardino County probably could have enabled MDM on the iPhones it bought, but didn't.  Obviously that was a mistake, though very few enterprises can be expected to anticipate a need for access to the phone after its user commits mass murder.
3. MDM doesn't entirely solve the problem of allowing iPhone use at work in financial institutions.  If a user simply uses his own phone and his own apps, MDM is no help.  It looks as though the employer has to rely on "the honor system" (h/t @Susan_Hennessey) or some other imperfect mechanism ("Bans on cell phone use on trading floor, email scanning for references to other apps," h/t @muchty) to prevent that obvious end-run on the regulation.

UPDATE:  I changed "Apple offers" MDM to "Apple enables" MDM, because of ambiguity about how much of the MDM capability is created, rather than enabled, by Apple.

Has Apple made iPhones illegal in the financial industry?

Apple's refusal to help the government unlock the San Bernardino shooter's iPhone may have some surprising consequences. Remember, Apple is defying not only the Justice Department but also the wishes of the iPhone's owner.  That's because the iPhone in question is actually owned by the San Bernardino County Department of Public Health, which issued it to Syed Farook to use at work.

As a practical matter, Apple's technical and legal position elevates Farook's privacy over the interests of the iPhone's real owner.  This may well be consistent with Apple's corporate marketing strategy, which seems to be making the iPhone so sexy that employees will simply demand that companies buy it for them.  But the San Bernardino case is a wakeup call for companies who think that, because they are the customers, Apple owes them some allegiance.  

Nope.  Instead, Apple's technical and legal war with the United States government is turning its corporate customers into collateral damage.  

As that lesson sinks in, enterprise purchases of iPhones may take a hit.  Indeed, in the financial industry, the fallout could be worse.  Given Apple's decision to privilege users' privacy above all else, it may well be unlawful for banks and brokerages to let their employees use iPhones at work.  

Why?  Because, in the financial industry, allowing yourself to be locked out of your employees' communications isn't just a bad idea, it's a violation of federal law.  Since 2007, financial industry regulators have made clear that "FINRA expects a firm to have supervisory policies and procedures to monitor all electronic communications technology used by the firm and its associated persons to conduct the firm’s business." (Emphasis in original.) In 2014, financial institutions were fined under this policy for failing to capture all of their employees' text messages.

There are probably ways to solve this problem technologically, if the employees cooperate.  Their iPhones or their apps can be modified so that text messages are routed through servers where the encryption is stripped and the messages stored.  But what if an employee instead chats with customers using his iPhone and an off-the-shelf messaging app that features end-to-end encryption?  Then, I suspect, the only way to recover those messages is to get access to the iPhone itself, something Apple is trying its best to make impossible.

Maybe there's another way for the industry to justify the use of iPhones after the San Bernardino controversy. I'd welcome further comment from those closer to the industry.  

One thing is for sure, though.  The consequences of Apple's stand for corporate communications hasn't yet received enough attention. 

Episode 100: Does "intelligence under law" only work if the President breaks the law from time to time?

 

We devote episode 100 to “section 702” intelligence – the highly productive counterterrorism program that collects data on foreigners from data stored on US servers.   What’s remarkable about the program is its roots:  President Bush’s decision to ignore the clear language of FISA and implement collection without judicial approval.  That decision has now been ratified by Congress – and will be ratified again in 2017 when the authority for it ends.  But what does it say about the future of intelligence under law that our most productive innovation in intelligence only came about because the law was broken?  Our guest for the episode, David Kris, thinks that President Bush might have been able to persuade Congress to approve the program in 2001 if he’d asked.  David may be right; he is a former Assistant Attorney General for National Security, the coauthor of the premier sourcebook on intelligence under law, "National Security Investigations & Prosecutions,” and the General Counsel of Intellectual Ventures.  But what I find surprising is how little attention has been paid to the question.  How about it?  Is George Bush to FISA what Abraham Lincoln was to habeas corpus?

My interview with David leaves Lincoln to the history books and instead focuses entirely on section 702.  David lays out the half-dozen issues likely to be addressed during the debate over reauthorization, including the risk that the legislation will attract efforts to limit overseas signals intelligence, now governed mainly by Executive Order 12333.  He then pivots to the issues he thinks Congress should grapple with but probably won’t – from the growing ambiguity of location as a proxy for US citizenship to the failure of current intelligence law to adequately extract intelligence from the technologies that have emerged since 9/11, particularly social media and advertising technology.

In the news roundup, Maury Shenk and Michael Vatis take us deep into the US-EU agreement on “Privacy Shield” – a replacement for the Safe Harbor.  The short version:  there’s many a slip twixt cup and lip, but the EU has once again taken off the table its unenforceable threat to stop transatlantic data flows.

In other news, Michael and Alan explain how HIPAA became a divorce lawyer’s dream weapon.

The Brits, meanwhile, are lapping the United States in creative use of intelligence law.  Maury and Michael explore how the UK proposes to bring the big webmail providers to heel.

I note the controversy at Berkeley over some garden-variety network monitoring, adopted in response to a serious health data breach.  University academics are appalled to discover that protecting patient privacy might limit their ability to do what they want on university networks.  HIPAA enforcers v. entitled academic lefties:  all I ask is more popcorn.

Hey, remember Norse Security, the company that went to the press to say that the FBI was all wet when it attributed the Sony attack to North Korea?  Well, Norse imploded last week, after a laid-off employee’s published criticisms were amplified by security blogger Brian Krebs.  Choicest bit from the Norse co-founder’s post:  the company’“demonstrat[es] how today’s media can be manipulated by persons to suit their purposes or personal vendettas and how facts can be misrepresented to lead an entire industry astray.”  Yep.  You know what they say:  Live by the flashy but inaccurate press report, die by the flashy but inaccurate press report.

As always, the Cyberlaw Podcast welcomes feedback.  Send an e-mail to [email protected] or leave a message at +1 202 862 5785.

Download the one hundredth episode (mp3).

Subscribe to the Cyberlaw Podcast here. We are also now on iTunes and Pocket Casts!

Episode 99: Will Israel embrace the DHS cybersecurity model?

Our guest is Amit Ashkenazi, whom I interviewed while in Israel.  Amit is Legal Advisor of The Israel National Cyber Bureau and a former general counsel to Israel’s data protection agency.  Israel is drafting its own cybersecurity act, and we discuss what if anything that country can learn from the US debate – and what the US can learn from Israel’s cybersecurity experience.  We explore the challenges Israel will face in trying to start a new cybersecurity agency, how Israel strikes the balance between security and privacy, the risks of using contractors to staff a new agency, the danger of stating agency authorities with too much specificity, and why the agency is likely to look more like DHS than the FBI.

In the news roundup, I discuss the dynamics of the Safe Harbor talks with Maury Shenk, boldly predicting that the EU will cave on the remaining issues once it’s convinced the US means business.

Jason Weinstein and I talk about the Judicial Redress Act and the gratifying Senate Judiciary Committee amendment – an amendment that the EU must have seen as a bad sign for the future if the Safe Harbor talks fail.  The Act is intended to facilitate the Justice Department’s “umbrella” agreement over data protection and law enforcement.  We conclude that it is a largely one-sided set of concessions by the United States in return for an illusory “data peace in our time.”  We nonetheless find a fine reason for the Obama administration to have accepted all these limits.

Alan Cohn and I check in on the status of DHS’s Einstein cyberdefense 
program and the reasons why GAO has criticized its progress.  And we close with a bit of “dog bites man” crypto news.

As always, the Cyberlaw Podcast welcomes feedback.  Send e-mail to [email protected] or leave a message at +1 202 862 5785.

Download the ninety-ninth episode (mp3).

Subscribe to the Cyberlaw Podcast here. We are also now on iTunes and Pocket Casts!