Americas

  • United States

Asia

Oceania

Contributor

Many unanswered questions in Apple-FBI controversy

Opinion
Feb 23, 20163 mins
AppleMobile SecuritySecurity

iphone apple fbi passcode

A federal magistrate has issued an order granting the FBI permission to access the data on an Apple iPhone belonging Syed Rizwan Farook. He is a terrorist suspect in the San Bernadino shooting on Dec. 2, 2015, which claimed 14 lives. That should be the end of it, a simple legal document allowing a law enforcement agency to access evidence of a crime. This evidence may also lead to additional confederates or uncover further terrorist cells.

[ COUNTERPOINT: Privacy at what cost? Apple vs the US government ]

Unfortunately, the issue at hand is not as simple as the FBI or Apple would have us believe. The FBI has not asked for Apple to unlock the phone and give them the data. The FBI has asked according to a statement released by Apple to, “make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation.”

That sounds like a reasonable request until you think the implications through to their logical conclusion. The FBI has asked Apple to build an IPhone OS with the security features turned off. With a copy of this OS, the FBI would not be limited to accessing the data on just this phone, but to any phone. Should a copy of this operating system make it into the wild, into the hands of a rogue law enforcement officer or intelligence agency, it would have significant security and privacy concerns, globally.

[ ALSO ON CSO: Most Americans support the FBI over Apple, Pew study finds ]

Part of the problem with this issue is that neither side is viewing it from the other’s perspective. Apple views this request as a significant security and privacy issue with wide ranging implications for its customers and society as a whole. The FBI views this request as having limited impact and being narrow in scope. The problem for the FBI is that they are now living is a post Edward Snowden world. Governments as a whole do not have the level of trust they once enjoyed, in particular, in the US.

The FBI certainly has the resources and capability of writing the hacked IPhone OS on their own. The question becomes, “Why isn’t the FBI simply asking Apple for the data from the phone?” From Apple’s point of view, does this begin to look like a slippery legal slope down the path toward reduced security functionality of any product a law enforcement or intelligence agency might wish to access? The US government has spoken often of its desire to see the reduction of encryption capability for electronic devices in the civilian market.

If the FBI actually just wants the data, then Apple should provide them with it. If the end game for the FBI is the iPhone OS with the security features turned off or a legal precedent, then they should reconsider their options. When it comes to matters of privacy and security, I often remember the prophetic words of Benjamin Franklin, “Those who give up their liberty for more security neither deserve liberty nor security.”

Contributor

Over twenty years of experience as an information security professional, serving in executive and senior management positions, in the US and the UK. My responsibilities have included the development and implementation of global information systems security management programs aligned with NIST CSF, ISO 27001:2013, elements of the NIST 800 series and HIPAA/HITECH. Also, I have created new corporate risk programs including the formation of a board level Risk Committee. Implemented new vendor management programs to track the compliance state of our key vendors and data holders with HIPAA/HITECH and PCI DSS. Completed the requirements, testing and installation of a state of the art security information and event management (SIEM) platform with IBM’s QRadar and ArcSight. Also, completed the requirements, testing and installation of two vulnerability scanners, IBM's QVM and Nessus. Developed an information security awareness program which included annual training for all staff.

Served as Chairperson of the Communications and Public Relations Project Group of Interpol's European Working Party on Information Technology Crime, as well as advising their Wireless Applications Security Project Group. I am the former, the President of the United Kingdom and Bluegrass chapters of the Information Systems Security Association (ISSA), also editorial advisory board of the ISSA Journal. I have attended numerous courses on cybercrime and white collar crime through both the Kentucky Department of Criminal Justice Training and the National White Collar Crime Center.

It has been my honor to receive an ISSA International Fellow (2015) and the International Information Systems Security Certification Consortium, Inc. (ISC)^2, President's Award for service to the information security community (2002 and 2004, 2009).

Lastly, I hold a Master of Science in Information Security from Royal Holloway, University of London, a former senior instructor for the (ISC)^2 CISSP CBK seminar, MCSE and BS7799 Lead Auditor.

The opinions expressed in this blog are those of Richard Starnes and do not necessarily represent those of IDG Communications, Inc., its parent, subsidiary or affiliated companies.