5.3 Forced Assistance to the Government to Bypass Password
Security
One interesting issue regarding password security is whether private companies like
Apple must assist the government in bypassing a mobile phone’s security system.
Two recent cases electronic communications privacy cases involve the government’s
attempt to force Apple, Inc. to help investigators to bypass the iPhone’s passcode
security. In the first case, In re Apple, Inc., a Federal District Court denied the
government’s request for a Court order that would have forced Apple to bypass the
phone’s password security. In that case, the government was trying to obtain data
from a cellphone seized in a search related to a drug investigation.
236 The second
case, In Re the Search of an Apple iPhone, the government sought to force Apple to
disable the phone’s encryption feature that automatically erases data on the phone
after a user enters an incorrect password ten consecutive times.
237 This case received
substantial publicity because the iPhone belonged to Syed Farook, a domestic
terrorist who conspired with his wife to kill fourteen individuals at a government
facility in San Bernardino, California in December 2015.
238 Although the Federal
Magistrate Judge initially granted the government’s ex parte request, Apple then
filed a motion to vacate the order and oppose the government’s motion to compel
assistance.
239 Apple argued that creating a backdoor to devices like the iPhone
would make the device vulnerable to breaches by other actors.
240 While Apple
fought the court’s order, the Justice Department hired a third party who successfully
broke into the phone rendering the issue moot.
241
6 Remedies and Sanctions
Because the United States lacks an overriding data protection law, the potential
remedies and sanctions available are located within the sector-specific legislation
described above. The primary enforcement agency is the Federal Trade Commission
236 149 F. Supp. 3d 341 (E.D.N.Y. 2016).
237 In Search of an Apple iPhone Seized During the Execution of a Search Warrant on a Black Lexus
IS300, California License Plate 35KGD203, (2016 WL 618401) (2016 U.S. Dist. LEXIS 20543)
(C.D. Cal. Feb. 16, 2016).
238 “Everything We Know So Far About the San Bernardino Shooting”, Los Angeles Times,
14 December 2015. Available online at: http://www.latimes.com/local/california/la-me-sanbernardino-shooting-terror-investigation-htmlstory.html.
239 Apple Inc.’s Mot. to Vacate Order Compelling Apple Inc. to Assist Agents in Search, and
Opposition to Government’s Motion to Compel Assistance entered February 25, 2016, Case
No. 5:16-cm-00010-SP.
240 Id.
241 Kang (2016).
Data Protection in the United States: U.S. National Report
441
Security
One interesting issue regarding password security is whether private companies like
Apple must assist the government in bypassing a mobile phone’s security system.
Two recent cases electronic communications privacy cases involve the government’s
attempt to force Apple, Inc. to help investigators to bypass the iPhone’s passcode
security. In the first case, In re Apple, Inc., a Federal District Court denied the
government’s request for a Court order that would have forced Apple to bypass the
phone’s password security. In that case, the government was trying to obtain data
from a cellphone seized in a search related to a drug investigation.
236 The second
case, In Re the Search of an Apple iPhone, the government sought to force Apple to
disable the phone’s encryption feature that automatically erases data on the phone
after a user enters an incorrect password ten consecutive times.
237 This case received
substantial publicity because the iPhone belonged to Syed Farook, a domestic
terrorist who conspired with his wife to kill fourteen individuals at a government
facility in San Bernardino, California in December 2015.
238 Although the Federal
Magistrate Judge initially granted the government’s ex parte request, Apple then
filed a motion to vacate the order and oppose the government’s motion to compel
assistance.
239 Apple argued that creating a backdoor to devices like the iPhone
would make the device vulnerable to breaches by other actors.
240 While Apple
fought the court’s order, the Justice Department hired a third party who successfully
broke into the phone rendering the issue moot.
241
6 Remedies and Sanctions
Because the United States lacks an overriding data protection law, the potential
remedies and sanctions available are located within the sector-specific legislation
described above. The primary enforcement agency is the Federal Trade Commission
236 149 F. Supp. 3d 341 (E.D.N.Y. 2016).
237 In Search of an Apple iPhone Seized During the Execution of a Search Warrant on a Black Lexus
IS300, California License Plate 35KGD203, (2016 WL 618401) (2016 U.S. Dist. LEXIS 20543)
(C.D. Cal. Feb. 16, 2016).
238 “Everything We Know So Far About the San Bernardino Shooting”, Los Angeles Times,
14 December 2015. Available online at: http://www.latimes.com/local/california/la-me-sanbernardino-shooting-terror-investigation-htmlstory.html.
239 Apple Inc.’s Mot. to Vacate Order Compelling Apple Inc. to Assist Agents in Search, and
Opposition to Government’s Motion to Compel Assistance entered February 25, 2016, Case
No. 5:16-cm-00010-SP.
240 Id.
241 Kang (2016).
Data Protection in the United States: U.S. National Report
441