Cell phone privacy played an important role in the San Bernardino attacks. On December 2, 2015, Syed Rizwan Farook and his wife, Tashfeen Malik, open fired on San Bernardino County workers at a holiday party killing 14 and injuring 22 others. The FBI wanted Apple to give them access to the perpetrator’s phone.
Apple states, “We built strong security into the iPhone because people carry so much personal information on our phones today, and there are new data breaches every week affecting individuals, companies, and governments.” Apple continued…”We feel strongly that if we were to do what the government has asked of us — to create a backdoor to our products — not only is it unlawful, but it puts the vast majority of good and law-abiding citizens, who rely on iPhone to protect their most personal and important data, at risk.”
Leading computer forensics expert Lee Neubecker, CEO & President of Enigma Forensics discusses the issues relating to cell phone privacy and the government’s desire to have a back door into your smartphone with the Data Diva, Debbie Reynolds of Debbie Reynolds Consulting. These experts have an interesting perspective.
Cell Phone Privacy: Part 2 of 4
The Video Transcript follows.
Lee Neubecker (LN): Hi, I’m back again with Debbie Reynolds. Thanks again for being on the show.
Debbie Reynolds: Thank you, Lee.
LN: So, we’re continuing with this multi-part series talking about cell phone forensics.
DR: Right.
LN: It’s specifically, this section we’re going to talk about the San Bernardino 2015 December attacker that unleashed terror, Syed Farook, and at the time when that happened, the FBI went to Apple and claimed that they needed assistance with unlocking the phone.
DR: Right, so I remember this very well. This was maddening to me, because a lot of the news reports, I don’t think any of them correctly stated how cell phones actually work, and they sort of bungled the information about the cell phone. So, a lot of the articles were trying to say that the only way they could unlock the cell phone is with Apple’s help,
LN: That wasn’t true. We knew that wasn’t true.
DR: No, you know that wasn’t true.
LN: You know, I thought when they were doing that, that they might have said that to put out misinformation so that other people who were communicating with the terrorists might have thought that they were safe. I was wondering if they might have done that on purpose so that people would keep their phones so that they could track and follow other people.
DR: I don’t know, my feeling was that you know, the FBI or whoever was making this request was trying to create a precedent to be able to have people like Apple give them, create vulnerabilities in phones so they don’t have to do this one-on-one unlock feature, but why would Apple or any other company who’s in the business to make money create a vulnerability that possibly could be the antithesis of their invention. I wouldn’t use a cell phone if I thought it was unsafe, right, or insecure.
LN: Well, I just assume they’re all insecure.
DR: Well, as secure as it can be
LN: As secure as it can be, but you know, Microsoft, Apple, they issue patches and updates for security flaws every month, so there are still bugs out there that can be exploited, but when that happened right away, I was wondering why they didn’t call Cellebrite, and ultimately, Cellebrite, Israeli firm, they’re likely the ones who actually got the contract to unlock that phone.
DR: Yeah, right, exactly.
LN: But the whole notion of having a common key that law enforcement can quickly unlock any device without any judicial intervention, it’s a little concerning.
DR: It’s very much concerning. It’s like you’re trying to boil the ocean to solve one problem.
LN: Well, then if you have one key, someone in the FBI leaves, and they take that key with them, then they go and they link it on the Dark Web, and this is the type of thing that’s happened with contractors to various cyber agencies and the government, and these keys get out there, or weapons get out there, and everyone’s getting exploited, and it takes the government a long time to report it to Microsoft, to Apple, and everyone’s getting hacked in the meantime.
DR: Well, and there are a lot of other ways to get stuff off of a phone, so I think of a phone as a gateway to other things. You know, if even you do banking on your phone, if you lose your phone, that doesn’t mean that the information’s lost. You can go to the bank, companies can serve affidavits on different entities that have other information. If a person was communicating with someone else, you may be able to crack their phone, so there are a lot of different ways to solve this problem that don’t require creating a back door for a complete product.
LN: Yeah, and you know to your point about the issue when then-director Comey, James Comey, had testified seeing that they needed help, apparently the FBI’s own remote phone specialization group hadn’t been tasked with trying to get into the phones, so they hadn’t fully explored their own capabilities before they went to ask for Apple, because like you said, they wanted to establish precedent, and they wanted to change how it worked, and I think we’ve consistently seen and heard that the FBI wants full access anytime so that they can protect people, and there are some issues with that because if it’s simply full access, it’s going to make everyone less secure.
DR: Absolutely, absolutely, so I think all of us, there was quite a bit of eye-rolling when these reports were coming out about them not being able to do the cell phone, and it was like a lower version, too, so it wasn’t like the super– With every cell phone they get more secure, the OS–
LN: You know, it’s like give me the cell phone, DR: Exactly! LN: I’ll get into it. DR: Exactly!
DR: You know, even when they were interviewing people in the press, they weren’t really interviewing the forensic people who do this for a living, so I’m like who are they talking to?
LN: All the computer forensic people I know, we talked about this. The best plausible explanation I could think of, again, that they were trying to create a false narrative so that they could break up other people who were collaborating, but in fact, the Inspector General’s report from the FBI revealed that they just hadn’t fully done everything, and it sounds like it was two-part, it was part they wanted the power and the access, but second the operational component. What happens, you know, there’s a more recent case that we’ll talk about in a later series, and the question becomes then, again, have they used that most, their own internal resources fully before they’re going to Apple?
DR: Or even have they leveraged people like Lee, who do this for a living. It was funny, because when they were, when this case was going on, I had another case at the same time, had the same cell phone, and literally I sent it out and got it cracked like within a day. I couldn’t understand what the issue was, exactly.
LN: Hey, what can I say, I’m good.
DR: Exactly!
LN: Well, tune in for our next segment, where we’ll be talking more about some privacy issues related to having a back door, and some better solutions that if, you know, if Congress and Senate if they want to pass legislation, there are some ways that we can still allow the FBI to get in without having a common back door key that doesn’t undermine security.
DR: Exactly.
LN: Thanks for watching. DR: Thank you.