ALTHOUGH THE FEDERAL government recently backed down on its efforts to compel tech companies to install backdoors on their electronic devices, it doesn’t mean the government has given up on getting access to protected phones and other devices.
A ruling unsealed by a federal magistrate judge in New York last week has shone a light on a 200-year-old legal remedy prosecutors have dusted off in an attempt to force companies like Apple to unlock its customers’ devices. Last year, a District Court in California ordered Apple to unlock an iPhone for investigators. Similarly, the District Court in Manhattan ordered an unnamed phone manufacturer to do the same.
But last week a federal magistrate in New York declined to fall in step with the government’s demand to access an Apple device(.pdf) seized by investigators, fanning the flames of a national debate that has been playing out in the media and in the halls of the executive branch with no resolution to date.
Magistrate Judge James Orenstein, in the Eastern District of New York, didn’t reject the request outright, but instead asked Apple to respond this week about whether it would even be technically possible to disable the security lock on the device in question. He also asked Apple if doing so would be unduly burdensome for the company. This may be a moot point if it turns out the device in question is not, as the Washington Post reported this weekend, an iPhone running an older version of iOS, which has built-in capabilities for Apple to unlock it, as opposed to the new iOS 8, which locks even Apple out of devices.
But by burdensome, Orenstein didn’t just mean how much effort Apple would have to expend to unlock the device. He also meant how significant of a cost the company might bear in the marketplace for capitulating to government demands to unlock its customers’ devices.
Apple may have concluded that failing to provide its customers with privacy protection ‘would have long-term costs’ on its business prospects.
This raises interesting new issues around surveillance that have only come into play in the wake of the Edward Snowden revelations and the public’s changing views about government surveillance.
Few details around the New York case are known, since all documents, except the magistrate’s response to the government’s motion to compel, are sealed in the case. But that documented response reveals that the government invoked the All Writs Act to make its case to compel Apple to unlock an unspecified device. The All Writs Act is a part of the 1789 Judiciary Act, which was established centuries ago to give federal courts the power to issue writs when appropriate to compel third parties to help execute another court order—for example, a search warrant. The writs aren’t intended to be an end-run around existing statutes but simply to give courts a tool to enforce existing statutory authorities, particularly when there might be a gap in what the statutes cover.
“The general idea is this is a supplemental authority, and it does allow them to call on third parties to help them execute a search warrant or a valid court order,” says Andrew Crocker, staff attorney with the Electronic Frontier Foundation.
The government asserted in a motion to the New York court that it had the authority, under the All Writs Act, to compel Apple to unlock a device investigators had seized. But Orenstein wasn’t so sure.
He noted that the Supreme Court has asserted that courts can’t use a writ if an existing law already covers the issue at hand. Nor can a writ be used simply when compliance with existing statutory procedures is “inconvenient or less appropriate.” The Supreme Court has also ruled that a court could issue an order to compel only as long as the order did not impose an unreasonable burden on the third party being compelled.
After examining the case at hand, Orenstein concluded that prosecutors were asking the court to give them authority that Congress has so far specifically chosen not to give them—that is, the authority to compel a company to unlock a protected device.
Lawmakers and the public, he noted, are still wrestling with the issue. The fact that no statute currently exists specifically giving courts the authority to compel a company to unlock a device can’t be interpreted as an oversight on the part of lawmakers, or a sign that the courts should step in to fill the gap left by the absence of a statute, Orenstein argued. Instead, the lack of a clear statute seems to indicate lawmakers’ ambivalence on whether such a law compelling companies is appropriate or necessary. Issuing an order to compel Apple to unlock the device would assume an intent on the part of lawmakers that isn’t there.
“[T]he question becomes whether the government seeks to fill in a statutory gap that Congress has failed to consider, or instead seeks to have the court give it authority that Congress chose not to confer,” Orenstein ponders in the document.
In fact, he notes, Sen. Ron Wyden (D-Oregon) and a bipartisan group of Congressional lawmakers introduced bills in 2015 that would specifically preclude the government from forcing a private entity like Apple to compromise data security in the way the government is seeking. Although the bills have not advanced as of yet, they signal at the very least an ambivalence and lack of consensus around granting the authority to compel that prosecutors in this case are seeking.
It’s not the first time Orenstein has pushed back against government surveillance. In 2005, in a different case involving the All Writs Act, he ruled that cell-site location data is protected under the Fourth Amendment and therefore investigators need a warrant to obtain it. Orenstein called the government’s attempt to use the All Writs Act in that case a “Hail Mary play” and denied it on grounds that granting the executive branch authority to use investigative techniques that were explicitly denied it by the legislative branch was inappropriate. A decade later, the government is using the same playbook, and Orenstein is still resisting.
To bolster its request in the current case, the government cited United States v. New York Tel. Co, a 1977 Supreme Court case in which the judges ruled that a court could use the All Writs Act to compel New York Telephone Company to install a pen register at its facilities to assist in executing a search warrant. The phone company, the court argued, was a public utility that had a duty to serve and already regularly used pen registers, therefore no burden would be placed on it to install the requested surveillance tool. The court also noted that a writ was important because there was no other method for investigators to acquire the information they needed.
Orenstein rejected this argument, however, saying it didn’t fit the present circumstances. Apple, as a private commercial entity, is not a public utility with a duty to serve and is “free to choose to promote its customers’ interest in privacy over the competing interest of law enforcement.” And Apple, unlike the New York Telephone Company, does not own the equipment the government wants to unlock. What’s more, the government can obtain the information it wants in another way—it can compel the device owner, through the court, to unlock the device instead of compelling Apple.
The government argued that Apple has unlocked phones in the past under court order, and therefore, like the New York Telephone Company, it would suffer no burden to do so under another court order.
But the deciding argument may lie in how burdensome it would be for Apple to unlock the device. Orenstein has given Apple until October 15th to respond to his question about whether it is technically feasible to unlock the device without undue burden.
If the device is indeed using an older version of software prior to iOS 8, then there would be no technological hurdle for Apple. But he seems to have left open the possibility for a different kind of burden that unlocking the device might entail—economic and market burden.
Orenstein writes that in the past the burden on a third party had been presumed to be “limited to the physical demands and immediate monetary costs of compliance.” Likewise, he notes, that the government in the current case has indicated that Apple is not likely to suffer any unreasonable burden in meeting the request.
“I am less certain,” Orenstein writes in his remarkable conclusion. “The decision to allow consumers to encrypt their devices in such a way that would be resistant to ready law enforcement access was likely one that Apple did not make in haste, or without significant consideration of the competing interests of public safety and the personal privacy and data security of its customers.”
He goes on to say that Apple may have concluded that failing to provide its customers with privacy protection “would have long-term costs” on its business prospects.
It’s possible, Crocker acknowledges, that Apple could argue that even though it has the ability to unlock the phone and in fact has done so in the past, the political environment and public support for surveillance has changed since the device was sold and by extension the economic consequences of unlocking a device have also changed. Where previously it might not have been a burden to comply, it is now.
“I don’t see why Apple couldn’t raise that argument,” says the EFF’s Crocker. “It sounds like they would get a sympathetic reading from Orenstein [if they did].”