How Apple will fight the DOJ in iPhone backdoor crypto case

Apple CEO Tim Cook on Tuesday evening said the US government's legal position on encryption backdoors was setting "a dangerous precedent.” That’s because, just a few hours prior, a federal judge agreed with the US Justice Department that a 1789 law compelled Apple to alter an iPhone's firmware that would allow the authorities to use a brute-force attack on an iPhone owned by one of the San Bernardino shooters.

Cook said Apple will fight the Riverside, California, magistrate judge's orders, calling it an "unprecedented use of the All Writs Act of 1789 to justify an expansion of its authority." Depending on where you line up in the cryptowars debate, Cook's characterization of the government's stance may or may not be true. But what is undeniable is that the act has certainly been used to expand the government's surveillance reach. Whether it ultimately will in the iPhone case is an open question likely to be resolved by the Supreme Court.

While the All Writs Act is not used every day, the act has been successfully invoked by the government to compel telephone companies to install wiretaps, for phone companies to hand over call records, and to obtain CCTV footage, handwriting exemplars, and DNA samples. It has even been cited to force a defendant to cough up his computer password.

What's more, it has played a part in copyright piracy cases. In a forthcoming law journal article, Annemarie Bridy, a law professor at the University of Idaho, writes that "some courts granting broad preliminary orders against non-parties in 'pirate site' cases have cited the All Writs Act as a source of authority."

The All Writs Act was originally part of the Judiciary Act of 1789, which established the Supreme Court, the lower courts, and spelled out the basic powers of the judicial branch of government. In 1990, former Justice Sandra Day O'Connor described the Judiciary Act as "probably the most important and most satisfactory Act ever passed by Congress."

On Tuesday, a federal judge agreed with the government that the act compels Apple to honor a search warrant and assist the authorities in getting access to unlock and decrypt the iPhone 5C used by Syed Rizwan Farook, who shot up an office party in a terrorist attack in nearby San Bernardino in December. The government said the information on the phone might contain "crucial evidence" like "critical communications and data."

But wait, how can that be? Congress hasn't passed a law requiring this, despite calls from government officials, like FBI Director James Comey, wanting backdoors.

That's where the All Writs Act comes in. With its British and Roman roots, the act basically allows federal judges to issue orders to do something despite Congress' silence on the matter. The act has been described as a "gap filler" for what Congress has not done. So far, 200-plus years later, Congress doesn't appear concerned the act is usurping Congress' powers.

The entire text of the law, in its current incarnation, is rather short:

(a) The Supreme Court and all courts established by Act of Congress may issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.

(b) An alternative writ or rule nisi may be issued by a justice or judge of a court which has jurisdiction.

The leading case the government cited that convinced US Magistrate Judge Sheri Pym to demand Apple's assistance was a 1977 Supreme Court decision requiring the New York Telephone Company to abide by a pen register order as part of a gambling investigation, when no such law existed.

"The court relied upon the authority of a search warrant pursuant to Rule 41 to predicate an All Writs Act order commanding a utility to implement a pen register and trap and trace device—before Congress had passed a law that specifically authorized pen registers by court order," the government told Pym in its briefing.

More recently, in 2012, a judge cited the All Writs Act to order a Colorado woman to decrypt her laptop computer so prosecutors could use the files against her in a criminal case. The case, in which the judge also found that the woman's Fifth Amendment privilege against compelled self-incrimination was not violated, ultimately settled itself without her having to cough up the password and decrypt her computer for the authorities.

The three factor test

In its application to the federal court in the San Bernardino case, the Department of Justice specifically cited the All Writs Act as its primary legal justification as to why there is precedent to force Apple’s assistance. The government primarily relies on that 1977 Supreme Court decision: United States v. New York Telephone Company. Prosecutors also cite other cases as divergent as a dispute with the US Marshals in Philadelphia, a safety flap with a Montana lumberyard, in addition to the compelled decryption case from Colorado and others.

According to the Supreme Court’s own summary in that New York Telephone Company case, the FBI suspected that there was a "gambling enterprise" at a New York City address and that "two telephones with different numbers were being used there to further the illegal activity."

The FBI then went to federal court demanding New York Telephone Company to provide "technical assistance" by leasing new lines that would enable the installation of a "pen register," a device that would record all calls in near-real time that would be coming to and from the suspect numbers. The phone company refused, arguing that the federal law concerning wiretaps did not specifically govern pen registers.

A federal judge ruled against New York Telephone, citing the All Writs Act, among other rationales. The telco then appealed to the US 2nd Circuit Court of Appeals, which reversed the lower court’s decision, and the government appealed to the Supreme Court.

In his majority opinion, Supreme Court Justice Byron White, wrote:

The Court of Appeals held that even though the District Court had ample authority to issue the pen register warrant and even assuming the applicability of the All Writs Act, the order compelling the Company to provide technical assistance constituted an abuse of discretion. Since the Court of Appeals conceded that a compelling case existed for requiring the assistance of the Company and did not point to any fact particular to this case which would warrant a finding of abuse of discretion, we interpret its holding as generally barring district courts from ordering any party to assist in the installation or operation of a pen register. It was apparently concerned that sustaining the District Court's order would authorize courts to compel third parties to render assistance without limitation regardless of the burden involved and pose a severe threat to the autonomy of third parties who for whatever reason prefer not to render such assistance. Consequently the Court of Appeals concluded that courts should not embark upon such a course without specific legislative authorization. We agree that the power of federal courts to impose duties upon third parties is not without limits; unreasonable burdens may not be imposed. We conclude, however, that the order issued here against respondent was clearly authorized by the All Writs Act and was consistent with the intent of Congress.

In the present San Bernardino case, US Attorney Eileen Decker specifically cited New York Telephone's "three factor" test. Those factors include the company’s distance, or "remove" from the case; whether the government’s request places an "undue burden" on Apple; and whether the company’s assistance was "necessary."

In her application to the court, Decker argued that Apple manufactured and sold the phone, therefore it is not removed from the case at hand.

"Apple designed, manufactured and sold the SUBJECT DEVICE, and wrote and owns the software that runs the phone which software is preventing the execution of the warrant," she wrote.

And, she continued. Asking Apple to create new software to bypass its own security measures is not burdensome, Decker argued.

Decker continued:

While the order in this case requires Apple to provide modified software, modifying an operating system—writing software code is not an unreasonable burden for a company that writes software code as part of its regular business. In fact, providers of electronic communications services and remote computing services are sometimes required to write code in order to gather information in response to subpoenas or other process.

And finally, she argued, Apple’s assistance is entirely necessary.

In this case, the ability to perform the search ordered by the user warrant on the SUBJECT DEVICE is of particular importance. The user of the phone, Farook, is believed to have caused the mass murder of a large number of his coworkers and the shooting of many others, and to have built bombs and hoarded weapons for this purpose.