Did Apple "goof" in taking its stance?

Rock Stars of Cryptography. Courtesy RSA Conference

During a panel at the RSA cybersecurity conference yesterday in San Francisco, Adi Shamir, a cryptographer at the Weizmann Institute of Science and co-inventor of the RSA public-key cryptographic standard that became a widely used method to send encrypted messages, sided with the FBI in the ongoing fight about whether Apple must unlock the iPhone of Syed Rizwan Farook, a shooter in the December 2015 San Bernardino attack. His comments sparked a polite but pointed debate about privacy versus security among some of the most distinguished figures in cryptography, including Ron Rivest, who collaborated with Shamir on the groundbreaking RSA work. Also taking part were Whitfield Diffie and Martin Hellman, who minutes earlier had been named recipients of the $1 million Turing Award for 1976 cryptography work that helped pave the way for secure Internet communication, and Moxie Marlinspike, who founded the company that developed the popular open-source encryption tool Signal.

The bulk of the panel argued that forcing Apple to unlock even this one phone would provide a slippery slope for both the U.S. government and foreign spy agencies to access any phone, and was unnecessary because the FBI had ample other investigative tools at its disposal. Shamir said that breaking into a single phone, in order to leave no stone unturned about the connections of a murderous terrorist, outweighed his privacy rights and the implications for other people.

“The question is where you draw the line,” Shamir said. “The FBI is asking for something very specific; it wants Apple to help open a single phone, and it's not about putting a trapdoor on millions of phones. Of course it can set a precedent, I understand that. But in this issue, it falls on the side of helping the government.”

“The path to hell starts at the backdoor.”

Ron Rivest, currently a professor at MIT, quoted Microsoft president Brad Smith, who at a speech earlier in the day had had said “the path to hell starts at the backdoor.”

“The systems we have are so fragile – having extra keys, ways in, are just asking for trouble,” said Rivest. “The good of the country calls for security. But law enforcement has many means at its disposal.”

Marlinspike said that the ability of encryption to disguise criminal behavior was not all bad. He noted that recent milestones legalizing gay marriage or marijuana usage could not have happened without people secretly conspiring to break harsh sodomy and drug laws.

“I believe that law enforcement should be difficult,” he said, and noted that the FBI already had access to the metadata associated with Farook's calls.

“And they would have iCloud backups if they hadn’t messed up,” he said.

Backups to Apple’s iCloud service are not encrypted, but a government employee reset the password for Farook’s account, allowing access dated up to October 19, weeks before the December 2 attack. By resetting access, the FBI lost the opportunity to access iCloud backup material closer to the attack.

Hellman made an appeal to more sincere efforts at cooperation between privacy advocates and the government. He noted that the government actually benefits from rigorous encryption protocols, pointing out this his initial cryptography work sparked an angry allegation from the NSA that publishing work on encryption was a crime tantamount to exporting nuclear weapons. But Vice Admiral Bobby Ray Inman, who headed the N.S.A. at the time, told Stanford Magazine that he had changed his mind about the security trade-offs of encryption, with the cyber-theft of top-secret design plans for the F-35 a glaring example.

“Law enforcement has an interest not just in getting at phones, but in preventing crimes,” stated Hellman, who said he would sign an amicus brief in support of Apple.

But Shamir was unconvinced.

“In my opinion, Apple goofed,” Shamir said.

Adi Shamir. Credit: Even Yahuda

“In my opinion, Apple goofed,” Shamir said. He said the company made a strategic error in choosing to take a privacy stand with the unsympathetic Farook case, given that the defendant was dead and participated in mass murder. He said that the second part of the “goof” entailed marketing an encrypted phone that nevertheless had a technical loophole that gives the opportunity for Apple to break in. What the FBI would like the government to do is write a new version of the iOS operating system that deactivates anti-hacking features, and then load it onto Farook’s phone.

Marlinspike noted if the government establishes a precedent by forcing Apple to install a vulnerable OS on Farook’s phone, the Feds could do also order Apple to include similarly vulnerable versions of Signal on the App Store.

But Shamir, who has previously espoused gloomy views of cybersecurity and privacy (“Most people will not demand or expect real privacy; that war is already lost”), predicted that Apple would ultimately lose its argument, in part because it bet on the wrong horse.

“Apple decided not to comply – my advice would have been to comply, and wait for a better test case,” said Shamir.

In spite of differing views of privacy, there was one point on which Shamir and the rest of the panel agreed.

“Backdoors are a terrible idea. No one supports this,” he said, to applause from the audience.