Apple blaming San Bernardino County, FBI for iPhone dilemma

Apple’s contention that the FBI and the county of San Beardino could have accessed the iPhone used by the gunman in the Dec. 2 terrorist attack had they taken proper safeguards, resurfaced in a motion filed Thursday by the technology company, which is fighting a court order to assist the govement in hacking the device.

The motion, filed by attoeys for Apple on Thursday requesting that U.S. Magistrate Sheri Pym rescind her Feb. 16 order, included a declaration by Apple’s manager of user privacy, Erik Neuenschwander, who said the FBI would likely have been able to clear the passcode lock on Syed Rizwan Farook’s work-issued iPhone 5C, without Apple’s assistance, had the county’s Department of Public Health, which employed Farook as an environmental health specialist, installed a program called Mobile Device Manager, or MDM, which allows employers to clear passcode locks on mobile devices to reset forgotten passwords.

Investigators may also have been able to obtain recent data from the phone had the FBI not instructed county officials to change the iCloud password associated with the iPhone account.

iCloud is a remote server that allows data from iPhones and other Apple devices to be uploaded and stored.

The information first surfaced in the U.S. govement’s Feb. 19 motion requesting Pym to compel Apple to comply with her order after Apple CEO Tim Cook, following Pym’s Feb. 16 order, posted an open letter on the company’s website saying Apple would fight the order.

Apple has waged an aggressive public relations campaign in the weeks since Pym’s initial ruling, and has retained a dream team of attoeys to represent it in its legal battle, which could set a precedent affecting dozens, perhaps hundreds, of federal cases nationwide in which the govement is trying to gain access to iPhones and other Apple devices.

The govement’s motion notes that the owner of the iPhone — the county — reset the password to the iCloud account associated with Farook’s iPhone within hours of the massacre at the Inland Regional Center, in which Farook, 28, and his wife, Tashfeen Malik, killed 14 people with assault rifles and wounded 22 others. The Redlands couple were killed hours later in a shootout with police.

Although the govement’s motion states that while resetting the iCloud password enabled investigators to determine that the iPhone’s backup stored to iCloud ended on Oct. 19, roughly six weeks prior to the terrorist attack, Neuenschwander said in his declaration that by doing so it could have dumped any recent data, and that Apple had recommended to the FBI shortly after the shooting that the FBI coect the iPhone to a known Wi-Fi network and plugged into a power source to potentially create a new iCloud backup automatically, which may have contained the most recent data on Farook’s iPhone.

Advertisement

“If successful, that backup might have contained information between the last backup and the date of the shooting,” Neuenschwander said.

The FBI, however, believes Farook disabled the iCloud backup feature on or after Oct. 19, the last day data from the iPhone was backed up on the server. The data the FBI was able to retrieve showed Farook had been in contact with some of the victims killed in the shooting, and investigators also leaed Farook had been regularly using the iPhone after the iCloud backup feature was disabled. Those post-Oct. 19 communications Farook had on the phone are what investigators are trying to obtain and what they believe may contain critical information germane to the investigation, court records show.

As to Apple’s assertion that the problem could have simply been resolved had the county installed the MDM application to Farook’s iPhone, San Beardino County spokeman David Wert said that would not have made the device infallible.

“Any user can easily delete the MDM app and profile from their iPhone almost as easily as they can remove Candy Crush or any other app, at which point it becomes useless to the owner,” Wert said in an email Friday. “The MDM solution being discussed here is not designed to overcome a user determined to keep everyone, including the owner, out of the phone.”

The “MDM solution,” said Wert, is not designed to allow a device’s owner to take control of the device from an uncooperative user, but to protect the county’s network from trouble that might try to come in through a mobile device. It is also designed to assist in opening a cooperative user’s phone, or locking or deleting data from a lost or stolen phone, Wert said.

- - , .