The following post originally appeared on the ACLU Nationwide's blog.
By Eliza Sweren-Becker
The stakes of the fight between Apple and the FBI could not be higher for digital security and privacy. If the government has its way, then it will have won the authority to turn American tech companies against their customers and, in the process, undercut decades of advances in our security and privacy.
Today, the ACLU — joined by its affiliates in California — is filing anamicus brief in support of Apple’s challenge to FBI efforts to compel the company to help break into an iPhone as part of the investigation into the 2015 San Bernardino shootings. We filed asimilar brief several months ago in support of Apple’s parallel fight in Brooklyn. But in this case, the stakes are even higher, because the FBI wants to force Apple to write new computer code to disable security features on one of its devices.
If the government gets its way, the legal precedent set by this case will reverberate far beyond this particular investigation and the single phone at issue. (In fact, just Monday, the magistrate judge overseeing the parallel case in Brooklyn noted the gravity of the government’s legal theory in issuing a comprehensive rejection of it.)
The government’s request relies on the All Writs Act, a gap-filling law passed in 1789, in its bid to compel Apple to create and authenticate software so that the FBI can hack into an individual’s iPhone. That law gives courts the authority to issue orders necessary for it to fulfill its judicial role and enforce its decisions. It does not, however, permit courts to give law enforcement new investigative tools that Congress has not authorized. In this case, the act can’t be used by law enforcement to give itself the unprecedented power to conscript an innocent third party into government service against its will. The use of this law is made all the more sweeping considering the vast cybersecurity and privacy implications of what the government wants to be able to do.
What the government wants here goes beyond the well-established duties of citizens to aid law enforcement — by, for example, turning over evidence or giving testimony — because Apple doesn’t actually possess the information on the iPhone that the government seeks. The order the government has proposed would also violate the Fifth Amendment, which imposes a limit on the assistance that law enforcement may compel of innocent third parties who don’t actually have the information the government is after — a limit the government has crossed in this case. Think of it this way: Could the government get a court order compelling you to spy on your neighbor, or perhaps compelling the friend of a Black Lives Matter organizer to seek out information and report on that person’s plans for a peaceful protest? We don’t think so, and the Fifth Amendment is what defines the outer bounds of law enforcement’s authority to conscript us all into investigative service.
Though the legal arguments may seem esoteric, the power the government aims to establish here would set a troubling and dangerous precedent that would undermine everyone’s digital privacy and security. For example, if the courts uphold the government’s interpretation of the law, the FBI could force Apple to authenticate and deliver malware to a target’s devices using Apple’s automatic-update system. That would put us all at risk when you consider the implications for the rest of our devices. Automatic updates are the vaccinations of the digital world: They only work if they’re taken, and they’re only taken if they’re trusted. Consumers will have little incentive to install automatic updates if they believe they could be government-mandated malware masquerading as security fixes. As the array of mobile devices and web-connected appliances grows, so does the need for regular security updates. The government’s legal theory would undermine this system and the security of the Internet across the board.
This case did not arise in a vacuum. Over the last few years, Congress has considered and declined to compel tech companies to build backdoor access to encrypted data. And, despite the pitched battle in court, Apple and the government agree that Congress is best positioned to grapple with this enormously important question in the first place. Indeed, the House Judiciary Committee held a hearing just yesterday on Apple’s iPhone encryption. Notwithstanding its commitment to public debate on this question, the government has sought to compel Apple to assist law enforcement in mobile device unlocking more than 80 times, largely through secret court filings. (We’ve filed a FOIA request to learn more about these cases and the policy behind this effort.)
In the Brooklyn case, Magistrate Judge James Orenstein ruled, in a thorough 50-page opinion, that the government may not rely on the All Writs Act to compel Apple to assist in unlocking an iPhone. Judge Orenstein recognized a critical flaw in the government’s All Writs Act theory: It contains no “principled limit on how far a court may go in requiring a person or company to violate the most deeply-rooted values.” It doesn’t take a constitutional scholar to understand that there is a limit on the government’s power to conscript third parties into the service of law enforcement. That’s the kind of limit that distinguishes a democratic government from a police state.
As the ACLU told the court in California today, the government has crossed that limit.
Eliza Sweren-Becker is attorney with the ACLU Speech, Privacy, and Technology Project.
