The Looming End to the Smartphone Company-Law Enforcement Standoff

(Inside Science) -- On December 2, 2015, two terrorists opened fire on a Christmas party in San Bernardino, California, killing 14 people and injuring 22. Besides the horror of the massacre, the shooting set off what many believed would be an historic court battle between law enforcement and the electronics industry over civil liberties and privacy.

The FBI found one of the terrorists’ iPhone 5Cs, and demanded Apple decrypt the phone so authorities could read the contents. Apple refused and, backed by many in the electronics industry, fought the order in court. Apple maintained that the encryption preserved privacy, a key selling point for its phones.

Former FBI director James Comey, in his memoir, says Apple’s position drove him “crazy.”

The dispute seemed insolvable, but the case became moot after an Israeli company, Cellebrite, broke the encryption for the FBI for an estimated $1 million.

The agency found nothing of importance.

Now the whole issue has mostly fizzled out. The phones are less valuable than many thought in solving cases, and the privacy encryption affords is too valuable for the industry to give up.

Since the release of iOS 9 in 2015, the iPhone has used a six-digit PIN, by default. This password encrypts the entire contents of the phone.

“When the device is fully powered off and you first turned it on, most of the contents of the hard drives are encrypted and your six-digit PIN actually does decrypt the home directory,” said Nate Cardozo, staff attorney at the Electronic Frontier Foundation in San Francisco.

On the iPhone the user gets 10 tries at the password, and the pause between each allowable try grows longer. After the 10th wrong password, the iPhone essentially self-destructs, completely erasing the contents. The missing data is irretrievable, although Apple has said it can decode some of the data from its iCloud servers, if users have backed up their phones there. They require an appropriate court order.

The FBI in San Bernardino, seeing the encryption was on, probably did not try more than once, Cardozo said.

“The password basically limits access to the key that's stored in the phone for decrypting,” said Martin Hellman, emeritus professor of electrical engineering at Stanford University in California, and one of the fathers of modern cryptography.

The math behind cracking passwords

You have to get past the password to even begin decryption. This can be true of computers as well as phones, although most computers do not come with an encryption default. The 10-tries limit is the reason brute force, or trying every possible code combination, doesn’t work. You have 10 tries to guess 1 million number combinations before the phone becomes a paperweight.

The secret is to get beyond the password and the rate limit so there are no limits on attempts on the key. A hundred thousand million million possible keys, the encryption standard back in 1975, is now breakable, said Hellman. Cracking such a code would take a bit more than a day.

A password made up of 10 random characters -- including letters, number or symbols -- on a device like a laptop would take an average of 12.5 years to crack. Cardozo said his personal phone has an 11-character password. Experts suggest that using between 9 and 12 characters makes a code essentially unbreakable.

There are now at least two companies including Cellebrite that sell code-breaking software to law enforcement that can open the latest iPhone operating systems (iOS 11) with the standard six digits. For $15,000 Grayshift will sell police a tool to break into 300 iPhones, and $30,000 for an unlimited number.

“So we think they're doing two things,” Cardozo said of the code-breaking companies. “They are getting around the 10-try limit and they're also getting around the artificial rate limiting that prevents you from trying a whole bunch of PIN codes in succession.”

But, in most cases, law enforcement doesn’t need the phones’ contents because they can get what they need other ways. There currently are no phone encryption cases in American courts, according to, Cardozo. Only in Australia and the United Kingdom is it still an issue, he said.

As recently as 2016, fewer than 10 percent of all Android phones were encrypted, but more recent versions offer encryption as a default.

The cryptowars

Despite the current lack of litigation on the subject, the relationship between government and industry on encryption has always been a frigid one. Until the 1970s, the government, especially the National Security Agency, considered codes and code-breaking to be a government monopoly and most research was classified. In 1976 Hellman and his graduate student, Whitfield Diffie, at considerable legal risk, published a paper using only unclassified material called New Directions in Cryptography which shattered the monopoly. Most commercial encryption software since came from that paper.

Making your iPhone Uncrackable

To put it simply, if you use 11 randomly selected characters on a relatively new operating system, it's extremely unlikely that even the National Security Agency could break into your iPhone during the professional lifetime of the code breakers. Even having a back door to the encryption software won’t help them.
 

And it’s not hard.
 

In most cases, the default six-digit iPhone password is pretty good security. Codebreakers often use “brute force” to break into iPhones, trying every one of the 1 million possible number combinations until they find the left one.
 

The number of possibilities increases geometrically with additional numbers. To make breaking in more difficult, most experts use at least nine, or even 11 digits.
 

How to do it? First, generate 11 completely random numbers. Not your Social Security number, your birthdate, or anything anyone can guess. You could use a website such as https://www.random.org/integers/.
 

Write it down someplace so you don’t forget it. If you do forget it, you have an expensive paper weight in your hands.
 

Go to SETTINGS, then TOUCH ID & PASSCODE. Enter your old password if asked. Select CHANGE PASSCODE, then PASSCODE OPTIONS, then CUSTOM NUMERIC CODE and then put in the random numbers you generated -- or to allow you to access additional letters and symbols, choose CUSTOM ALPHANUMERIC CODE.
 

Your phone is set. Remember to turn off any fingerprint or face recognition functions, as it may be easier for law enforcement or customs to force you to unlock your phone using those options. Also, be sure to set the phone to erase data, so that if someone tries to guess the passcode too many times, the phone erases itself.
 

Instead of using cloud-based backup options such as iCloud, use iTunes to put backups on your main computer if you have one.
 

Now, if anyone, including the FBI, tries to open your phone, they just might unlock it in time for their grandchildren to give it a try.
 

Sirichai Puangsuwan/Shutterstock

Hellman said there were three “crypto wars” between the government and the private sector. The first was the period before the 1976 paper, when almost everything was a secret. The second, in the 1990s, was an attempt to try a compromise by setting up an encryption system that gave access to a neutral third party. The government could then petition that neutral party for access, something like the present FISA court system. But no one could figure out how to make that work.

We are now in the third crypto war between the government and outside cryptologists, he said, as governments and the public attempt to balance safety with the ability to keep the contents of phones private for security and commerce, protecting people from fraud and keeping vital systems working.

Not all government officials support easy access or backdoors to devices. Michael Hayden, former director of the CIA and NSA, for instance, supported Apple's refusal to comply with the FBI's demands.

“My judgment is that we’re probably better served by not punching any holes into a strong encryption system – even well-guarded holes,” Hayden said in an interview with the American Enterprise Institute. If the government can gain access, so could enemies, and millions of people would be at risk.

The change in attitude has been gradual as the technology has changed. The bombings in Austin this winter is a perfect example. The bomber was traced through his truck license plate, the fact he wore oddly colored gloves, and footage from hundreds of closed-circuit cameras. The only role his phone played was that the cell towers could locate where he had been and who was called.

“The metadata is all that the intelligence agencies need to do their jobs,” Cardozo said.

Time limits and possible new laws

The time required to locate and begin cracking the phone's code could soon become an issue. Apple's iOS 11.4 reportedly includes an additional security measure that locks a devices' USB data ports after 7 days of inactivity. This would mean that a dormant device could only send data to another computer after it is unlocked normally, further complicating law enforcement's access to the data.

Cardozo said it’s a losing game. Apple is working very hard to block access, he is sure, and will eventually succeed. Then terrorists and criminals will likely figure out how to break through again.

An Apple spokesperson admits the company will be trying to keep ahead in what is likely an endless cycle.

The company’s business model is to sell devices and services to customers, not sell information about the customers, the spokesperson said, minimizing what is stored on its devices. It also is making it as hard as possible for criminals to break in, with constant updates to its operating system.

For most people the current encryption protects their privacy, but the debate is not entirely dead. Some people in law enforcement are pushing for new laws to address the issue, among them FBI director Christopher Wray, Cardozo said. “I would not be surprised if we saw something in this Congress.”