Last week, we told you that the FBI was requesting Apple's help in unlocking a pair of password-protected iPhones that belong to Mohammed Saeed Alshamrani. In what is now being considered a terrorist attack, Alshamrani allegedly killed three people last month at a Navy base in Pensacola, Florida. During a press conference held today by Attorney General William Barr, the Trump administration's top law enforcement official said that Apple has not helped the FBI crack the phones.
Pointing out the two iPhones, which appeared on a poster at Barr's side, the Attorney General said, "Finally, I want to address an issue regarding the shooter's phones. The shooter possessed two Apple iPhones, seen on posters here. Within one day of the shooting, the FBI sought and received court authorization based on probable cause to search both phones in an effort to run down all leads and figure out with whom the shooter was communicating. During the gunfight with first responders, the shooter disengaged long enough to place one of the phones on the floor and shoot a single round into the device. It also appears the other phone was damaged."
Apple moved one step ahead of the cracking machines with iOS 13
Barr continued by adding that "our experts at the FBI crime lab were able to fix both damaged phones so they are operational. However, both phones are engineered to make it virtually impossible to unlock them without the password. It is very important to know with whom and about what the shooter was communicating before he died. We have asked Apple for their help in unlocking the shooter’s iPhones. So far Apple has not given us any substantive assistance. This situation perfectly illustrates why it is critical that investigators be able to get access to digital evidence once they have obtained a court order based on probable cause. We call on Apple and other technology companies to help us find a solution so that we can better protect the lives of Americans and prevent future attacks."
Most likely, Apple's decision not to help the FBI unlock the phones matches the same reason it gave for not obeying a federal court ruling in 2016 that demanded that Apple unlock the iPhone 5c that belonged to San Bernardino shooter Syed Farook. Apple would have to develop a special version of iOS and the company feared that if it was leaked out by the FBI, no iPhone would be safe. So the FBI paid Israeli company Cellebrite a reported $1 million to crack open Farook's phone which reportedly held some important information.
It should be pointed out that unlike the events that transpired in 2016, this time Apple has not been ordered by a court to unlock the phones. However, there is a chance that Barr will obtain a court order compelling Apple to open the handsets. When asked whether he plans on doing so, the Attorney General refused to comment.
Perhaps the most important thing that we can take away from the current situation is that companies like Cellebrite and Grayshift apparently are unable to unlock iPhone models running iOS 13 or else Mr. Barr would not have been complaining to the press today about Apple's lack of assistance. Cracking machines use brute force attacks to unlock iPhone models. Plugged into an iPhone's Lightning port, these devices seek to bypass limits on passcode attempts and then try every possible passcode combination until it hits the right one. Apple thought that it had closed this vulnerability with the USB Restricted Mode added in iOS 12. This feature prevented the Lightning port from communicating with other devices if an iPhone not been unlocked within the previous hour. But shortly afterward, Cellebrite's web site was bragging that the company could crack any iOS device from iOS 7 to iOS 12.3. Apple might have moved one step ahead in iOS 13.
It will be interesting to see what happens if Apple continues to defy the FBI. Attorney General Barr is known to be extremely close with President Donald Trump and Trump seems to consider Apple CEO Tim Cook to be someone reasonable he can talk to. We can imagine a scenario in which Barr tells Trump that the iPhones in question need to be opened for the security of the country. Trump calls Cook who explains why it can't be done from Apple's perspective. Back in 2016, when Apple defied the court order demanding that it open Farook's phone, then candidate Trump said that he was boycotting Apple and would start to use Samsung phones. He also said at the time, "It’s ridiculous that the government has to be put in a position where if they have information about a possible attack, we waste a second because that could be the second that kills somebody." Now, with the full weight of the Office of the President behind his statements, who knows what Trump would do to Apple if pressured by Barr.