Infosec researcher tells Ars new iOS update will “f-up border searches.”
According to security experts who have reviewed early developer versions of the forthcoming iOS 11, law enforcement will soon have a harder time conducting digital forensic searches of iPhones and iPads. This move is possibly to enhance Fifth Amendment protections of Apple’s users and perhaps frustrate searches at the US border.
The changes were first reported last week by Elcomsoft, a Russian software company. These changes are coming in conjunction with another privacy-minded feature that will disable Touch ID by pressing the power button five times.
Prior to this latest version of the firmware, in order for an iOS device to be “trusted” by a computer that it was physically connected to, that device had to be unlocked first via Touch ID or passcode. Next, the device would prompt the user: “Trust This Computer?” Only then could the entire device’s data could be extracted and imaged. Under iOS 11, this sequence has changed to also specifically require the passcode on the device after the “Trust This Computer?” prompt.
While the change may seem minor, the fact that the passcode will be specifically required as the final step before any data can be pulled off the phone means that law enforcement and border agents won’t have as much routine access to fully image a seized device.
When Ars e-mailed, Orin Kerr, a law professor at George Washington University, he agreed that Apple’s move may enhance Fifth Amendment protections.
“I gather the government could still search the phone manually, but it will be significantly more difficult,” he said.
Nicholas Weaver—a computer science researcher at the International Computer Science Institute in Berkeley, California, who also wrote about this issue on Lawfare—agreed.
“What it is really going to [do is] f-up border searches,” he told Ars. “And good: It changes it from ‘just dump the phone for the heck of it’ to ‘search by human while they have phone in hand.'”
Bitter border battle
When Touch ID debuted four years ago, San Francisco lawyer Marcia Hofmann raised questions about allowing one’s fingerprint to be an easy way to open up a digital device. As she noted at the time, it’s fairly well-established law that being compelled to give up a passcode (rather than a Touch ID fingerprint) is generally believed to have more legal protections under the Fifth Amendment, which protects against self-incrimination.
Back in 2012, the 11th US Circuit Court of Appeals ruled in favor of a defendant (“John Doe”) accused of possessing child pornography.
“We conclude that the decryption and production would be tantamount to testimony by Doe of his knowledge of the existence and location of potentially incriminating files; of his possession, control, and access to the encrypted portions of the drives; and of his capability to decrypt the files,” the court wrote. For now, this remains the highest court to have directly addressed the subject.
In one famous and more recent example, a former Philadelphia police officer accused of possessing child porn has been behind bars for nearly two years after refusing a court order to decrypt a hard drive believed to contain the offending files.
However, at the border, searching a digital device (or anything, really) is subject to a particular exception to the Fourth Amendment, which ordinarily requires a warrant. Due to this “border exception,” individuals can ostensibly be asked to decrypt their device. If they refuse, they could potentially be held in custody.
In the February 2017 case of a California artist who was questioned at San Francisco International Airport upon re-entry, after he finally agreed to unlock his iPhone, it was taken out of his sight for several minutes and could have been imaged without his knowledge. Under iOS 11, unless the artist, Aaron Gach, decided to actually give up the passcode (rather than type it in himself), he could at least have been reasonably confident that the phone could not be imaged without his knowledge.
More security = more better
As Ars has reported previously, Gach’s case is just one of a rapidly increasing number of border searches of digital devices. Customs and Border Protection has not provided any public explanation as to why. However, the agency maintains that such searches are exceedingly rare.
In March 2017, Robert Brisley, a CBP spokesman based in Atlanta, sent Ars a lengthy statement detailing the agency’s policy regarding such searches. That statement notes that the number of such electronic device searches remain minuscule, pointing out that, in 2016, “CBP processed more than 390 million arrivals and performed 23,877 electronic media searches. This equates to CBP performing an electronic search on 0.0061 percent of arrivals.”
“Requiring a passcode before a device can be accessed, imaged, or otherwise copied does have the potential to strengthen bulwarks against government access to individuals’ private data,” Abraham Rein, an attorney in Philadelphia who specializes in these issues, told Ars. “That said, courts have identified various ways around this Fifth Amendment protection in the compelled-decryption context, so whether this change would help in a given set of circumstances will need to be determined on a case-by-case basis.”
Riana Pfefferkorn, a legal fellow at Stanford University, agreed. She also said that this new software design choice may not specifically be about enhancing Fifth Amendment protections and trying to frustrate police efforts.
“If a passcode is now required in order to sync a device with a new machine, that has practical utility for security purposes above and beyond the context of a device seized by law enforcement (for example if a thief, or an abusive partner, gets hold of the device while it’s unlocked),” she e-mailed Ars. “Bear in mind also that if law enforcement’s goal is to obtain a backup of the device, they can already serve legal process on Apple to get Apple to turn over the last device backup that was uploaded to iCloud (if that feature is turned on). That backup may not be super recent, however (as in the Syed Farook case).”
Neither Apple nor the International Association of Chiefs of Police nor Customs and Border Protection immediately responded to Ars’ request for comment.