Biohackers Encoded Malware in a Strand of DNA

Wired reports Biohackers Encoded Malware in a Strand of DNA “In new research they plan to present at the USENIX Security conference on Thursday, a group of researchers from the University of Washington has shown for the first time that it’s possible to encode malicious software into physical strands of DNA, so that when a gene sequencer analyzes it the resulting data becomes a program that corrupts gene-sequencing software and takes control of the underlying computer. While that attack is far from practical for any real spy or criminal, it’s one the researchers argue could become more likely over time, as DNA sequencing becomes more commonplace, powerful, and performed by third-party services on sensitive computer systems. And, perhaps more to the point for the cybersecurity community, it also represents an impressive, sci-fi feat of sheer hacker ingenuity.”

A Plea for Responsible and Contextualized Reporting on User Security

Zeynep Tufekci In Response to Guardian’s Irresponsible Reporting on WhatsApp: A Plea for Responsible and Contextualized Reporting on User Security. She basically rips them a new one. It's a nice article, with the details of the issue which act as a great example of the difficulties of making something secure against a variety of adversaries vs making it usable by a wide range of users.

Signal is well-designed. Many in the security community use and consistently recommend it. However, the very thing that makes Signal a recommendation for people at high risk—that it drops messages at any sign of hiccup—prevents a large number of ordinary people from adopting it. Our community has used Signal for a long time, and have been trying to convert people to it, but its inevitable delivery failures (some by design, to keep users safer, and some due to bandwidth or other issues) mean that we often cannot convince people to use it despite spending a lot of effort trying to convince them—even people who have a lot at stake. The reason people, including journalists and activists, use WhatsApp over Signal isn’t because people are flaky, but because in the real world, reliability, usability and a large user base are key to security.

WhatsApp effectively protects people against mass surveillance. Individually targeted attacks by powerful adversaries willing to put effort into compromising a single person are a different kind of threat. If that is the threat model in mind, then merely recommending Signal is irresponsible. Your reckless, uncontextualized piece posits a mythical Snowden-type character, with a powerful, massively resourced adversary, for whom WhatsApp would not be a good choice. From that it concludes that WhatsApp is unsafe for a billion people for whom it is, at the moment, among the best options for secure communication.

To further complicate things, switching to Signal may not be advisable in some settings, because it marks you as an activist. There are many threat models under which WhatsApp is the safest option, and there are reports of people around the world being jailed merely for having installed an encryption app. It’s fine to recommend Signal and to broaden its user base. It’s not fine to fearmonger and scare people away from WhatsApp (which runs the same protocol as Signal) because of a minor and defensible difference in the kind of warnings it gives and the blocking behavior of a few undelivered messages when someone changes phones or SIM cards.

Hackers Are Emptying ATMs With a Single Drilled Hole and $15 Worth of Gear

Wired reports Hackers Are Emptying ATMs With a Single Drilled Hole and $15 Worth of Gear:

Kaspersky’s researchers already had the same model of ATM in their test lab, one that’s been in wide use since the 1990s. They removed its front panel to find a serial port that would have been accessible from the thieves’ hole. It connected to a wire that ran through the ATM’s entire internal bus of components, from the computer that controlled its user interface to the cash dispenser. Then the researchers spent five solid weeks with an oscilloscope and logic analyzer, decoding the protocol of the ATM’s internal communications from raw electric signals. They found that the machine’s only encryption was a weak XOR cipher they were able to easily break, and that there was no real authentication between the machine’s modules.

In practical terms, that means any part of the ATM could essentially send commands to any other part, allowing an attacker to spoof commands to the dispenser, giving them the appearance of coming from the ATM’s own trusted computer.

Eventually, the researchers were able to build their own device capable of sending cash-ejecting commands through just that exposed port. Their compact gadget, far smaller than even the arrested suspect’s laptop, consisted of only a breadboard, an Atmega microcontroller of the kind commonly found in Arduino microcomputers, some capacitors, an adapter, and a 9 volt battery. All told, it took less than $15 worth of equipment.

RIP, SHA-1

Ed Felton reports RIP, SHA-1 "Today’s cryptography news is that researchers have discovered a collision in the SHA-1 cryptographic hash function. Though long-expected, this is a notable milestone in the evolution of crypto standards."

Citi's Weird Security Processes

I got a call a phone call this morning, the Caller ID said "Unavailable". I answered and it said it was from Citibank fraud prevention and about my MasterCard and the automated voice said my full name from the account. It seemed real and shortly thereafter a woman came on and tried to verifiy I was who I said. I answered a couple of questions and then they wanted to send a text message and asked for a cell phone number. I said you called me and I'm not sure you are who you say you are. She said she understood and encouraged me to call the number on the back of the card which is the right thing.

So I hung up and did that. I called the customer service number and the automated system seemed to forward me directly to the fraud department. I got a guy this time. He wanted to verify I was who I said I was. He asked me for a cell phone number to send a text message. I gave it and said but that doesn't help since you're just sending the message to the number I told you to. He said that was a good point but they check the number in a database to verify it or something. Anyway somehow they never sent the text and that didn't help. I suspect this account never had my cell phone number but am not sure. He asked if I had other accounts with Citi, I said no, just an AmEx linked to the same account they sent me some time ago. He took the last five digits of that and said yes, since it was linked to the same account it didn't help. He asked if I had any car loans. I said no and this is ridiculous, he indistinguishable from a phisher. I said you called me, the agent told me to call back and said she'd write something in the account indicating this. I did and am calling from the landline linked to the account and you're asking me about the rest of my financial history when you should know that I don't have other Citi accounts.

He checked and said there was nothing he could do and that Citi Security Dept would call me in the next 24-48 hours and theres a hold on my account. I said that was fine, that I hadn't used the card in six months and that any recent charges on it are probably fraudulent. He said he'd make a note of it.

I suspect someone made some charges on the card and Citi noticed it hadn't been used in a while and that triggered an alert, that's great. I suppose that someone might have tried opening other accounts in my name and maybe he was seeing those on his screen (though he kept saying without passing security checks he couldn't see account details) but those accounts would have been recently created and therefore shouldn't be required to verify identity.

I get that Citi is trying to accurately verify I am who I say I am, but their processes have to make more sense. If I can't trust them when they call me (because I get about 4 spam calls a day) and they can't trust me when I call them (particularly right after they called me), then it can't ever work.

Britain has passed the most extreme surveillance law ever passed in a democracy

This is bad, ZDNet reports Britain has passed the ‘most extreme surveillance law ever passed in a democracy’. “The law forces UK internet providers to store browsing histories – including domains visited – for one year, in case of police investigations.”

The new law, dubbed the “snoopers’ charter”, was introduced by then-home secretary Theresa May in 2012, and took two attempts to get passed into law following breakdowns in the previous coalition government. Four years and a general election later – May is now prime minister – the bill was finalized and passed on Wednesday by both parliamentary houses.

The law will force internet providers to record every internet customer’s top-level web history in real-time for up to a year, which can be accessed by numerous government departments; force companies to decrypt data on demand – though the government has never been that clear on exactly how it forces foreign firms to do that that; and even disclose any new security features in products before they launch. Not only that, the law also gives the intelligence agencies the power to hack into computers and devices of citizens (known as equipment interference), although some protected professions – such as journalists and medical staff – are layered with marginally better protections.

Debunking the Patriot Act as It Turns 15

The Electronic Frontier Foundation on Debunking the Patriot Act as It Turns 15. “In honor of the law’s 15th anniversary, here are 15 things you might not know about the Patriot Act.”

Someone Is Learning How to Take Down the Internet

Bruce Schneier says Someone Is Learning How to Take Down the Internet:

Recently, some of the major companies that provide the basic infrastructure that makes the Internet work have seen an increase in DDoS attacks against them. Moreover, they have seen a certain profile of attacks. These attacks are significantly larger than the ones they're used to seeing. They last longer. They're more sophisticated. And they look like probing. One week, the attack would start at a particular level of attack and slowly ramp up before stopping. The next week, it would start at that higher point and continue. And so on, along those lines, as if the attacker were looking for the exact point of failure.

The attacks are also configured in such a way as to see what the company's total defenses are. There are many different ways to launch a DDoS attacks. The more attack vectors you employ simultaneously, the more different defenses the defender has to counter with. These companies are seeing more attacks using three or four different vectors. This means that the companies have to use everything they've got to defend themselves. They can't hold anything back. They're forced to demonstrate their defense capabilities for the attacker.

(Via Schneier on Security)

Forget Software—Now Hackers Are Exploiting Physics

Wired had a good article explain a new class of hacks, Forget Software—Now Hackers Are Exploiting Physics "Both of those new attacks use a technique Google researchers first demonstrated last March called ‘Rowhammer.’ The trick works by running a program on the target computer, which repeatedly overwrites a certain row of transistors in its DRAM flash memory, ‘hammering’ it until a rare glitch occurs: Electric charge leaks from the hammered row of transistors into an adjacent row. The leaked charge then causes a certain bit in that adjacent row of the computer’s memory to flip from one to zero or vice versa. That bit flip gives you access to a privileged level of the computer’s operating system. It’s messy. And mind-bending. And it works."

Rowhammer is far from the only new hacking technique that exploits computers’ physical properties. Proof-of-concept malware shown off by Israeli researchers over the summer, for instance, uses the sound of computers’ cooling fans or hard drive motors to transmit stolen data as audio. Another group of Israelis showed last year they could use just $300 of handheld equipment to extract encryption keys from a computer by monitoring the radio emissions leaked by its processor’s power use.

A Few Links

Here are some tech related articles I've liked recently

• Bob Messerschmidt wrote in Fast Company, What I Learned Working With Jony Ive's Team On The Apple Watch. This is one of the better "what's it like working at Apple" pieces I've read.

• Tim Cook has been CEO of Apple for five years now and gave an interview to the Washington Post, Tim Cook, the interview: Running Apple ‘is sort of a lonely job’. It's pretty good but there isn't much new here. We did learn that the failure of Maps lead to their public beta programs, which is intersting. Also, some of examples of who he's sought advice from.

• Wired wrote a (too long) piece, Meet Moxie Marlinspike, the Anarchist Bringing Encryption to All of Us. Marlinspike wrote Signal which is now integrated into WhatsApp.

• Wired wrote How One Journalist Uses Social Media to Get Inside the Minds of ISIS

• Joseph Gordon-Levitt is playing Edward Snowden in Oliver Stone's upcoming film. c|net interviewed Joseph Gordon-Levitt: The Privacy Debate is On

Not Politics: Some Random Tech Stuff

Researchers find over 100 spying Tor nodes that attempt to compromise darknet sites

These nodes -- ordinary nodes, not exit nodes -- sorted through all the traffic that passed through them, looking for anything bound for a hidden service, which allowed them to discover hidden services that had not been advertised. These nodes then attacked the hidden services by making connections to them and trying common exploits against the server-software running on them, seeking to compromise and take them over.

The researchers used "honeypot" .onion servers to find the spying computers: these honeypots were .onion sites that the researchers set up in their own lab and then connected to repeatedly over the Tor network, thus seeding many Tor nodes with the information of the honions' existence. They didn't advertise the honions' existence in any other way and there was nothing of interest at these sites, and so when the sites logged new connections, the researchers could infer that they were being contacted by a system that had spied on one of their Tor network circuits.

MIT’s anonymous online communications protocol Riffle could beat Tor at its own game

In addition to wrapping messages in multiple layers of encryption (the eponymous technique of Tor, “The Onion Router”), Riffle adds two extra measures meant to baffle would-be attackers.

First, servers switch up the order in which received messages are passed on to the next node, preventing anyone scrutinizing incoming and outgoing traffic from tracking packets using metadata.

Then comes a two-part measure to prevent a malicious server from simply replacing real messages with dummies and tracking a single target one. Messages are sent from the user to all servers, not just one — and outgoing messages must be signed with an independently verifiable mathematical proof that they are the ones the server received. This way, any server tampering with messages will be spotted at once.

LittleSis is a free database of who-knows-who at the heights of business and government. "A unique resource for investigating cronyism, conflicts of interest, and systemic corruption."

Ars describes Learning to code as a 30-year-old kid with Apple’s Swift Playgrounds

Pretty interesting story of how Feedly tracked down a performance problem: What Goes Down Better Come Up a.k.a. Adventures in Hbase Diagnostics

Here's another where Stack Overflow fixed an outage because of a malformed post an regular expressions: Outage Postmortem - July 20, 2016

Some Science Stories

io9 reports New Cancer Therapy Leaves Three Dead "Clinical trials of a promising new therapy, in which white blood cells are reprogrammed to attack cancer cells, has resulted in the deaths of three patients. In response, the US Food and Drug Administration has ordered a temporary halt to the trial."

It’s an incredibly promising new approach to battling cancer—but now there’s been a major setback. Three patients, all under the age of 25, have died in a Juno Therapeutics Phase II clinical trial that’s been using the CAR-T cells to treat ALL. The patients died after excess fluids accumulated in their brains (cerebral edemas). In all cases, the deaths happened after a chemotherapy drug, fludarabine, was added to the treatment regimen.

stat news has more, What's next for CAR-T after Juno's clinical misstep?

The Verge reports This robot stingray is propelled by rat heart cells, and it’s teaching us about underwater robotics. "A team of scientists have developed a robot that mimics the motion of a stingray by using the cardiac muscles from a rat mounted on a stingray-shaped skeleton. The robot, detailed in a study published in the journal Science, is a wonderfully weird hybrid of biological and mechanical engineering that could be the first step towards a new class of underwater robots."

This robot uses a single layer of muscle allowed for downward contraction to mimic movement. While live creatures have another layer of muscle to pull their wings upward, the skeleton of this robot is designed to rebound after such a contraction, simplifying the overall structure. When the muscles were stimulated with light, the combined actions allowed the robot to swim forward.

FIveThirtyEight reports, The Loudest Sound In The World Would Kill You On The Spot. "Consider this piece of history: On the morning of Aug. 27, 1883, ranchers on a sheep camp outside Alice Springs, Australia, heard a sound like two shots from a rifle. At that very moment, the Indonesian volcanic island of Krakatoa was blowing itself to bits 2,233 miles away. Scientists think this is probably the loudest sound humans have ever accurately measured. Not only are there records of people hearing the sound of Krakatoa thousands of miles away, there is also physical evidence that the sound of the volcano’s explosion traveled all the way around the globe multiple times."

Are reports, HTTPS crypto’s days are numbered. Here’s how Google wants to save it. "In the coming months, Google servers will add a new, experimental cryptographic algorithm to the more established elliptic curve algorithm it has been using for the past few years to help encrypt HTTPS communications. The algorithm—which goes by the wonky name "Ring Learning With Errors"—is a method of exchanging cryptographic keys that's currently considered one of the great new hopes in the age of quantum computing. Like other forms of public key encryption, it allows two parties who have never met to encrypt their communications, making it ideal for Internet usage."

How the Top 5 PC Makers Open Your Laptop to Hackers

Wired reports How the Top 5 PC Makers Open Your Laptop to Hackers

SOFTWARE MAKERS LIKE Microsoft put a lot of effort into ensuring that the operating system and application updates they deliver to your system are secure, so that hackers can’t hijack updates to get into your computer.

But it turns out that PC hardware makers are not so careful. An investigation conducted by Duo Security into the software updaters of five of the most popular PC manufacturers—HP, Dell, Acer, Lenovo, and Asus—found that all had serious security problems that would allow attackers to hijack the update process and install malicious code on victim machines.

Researchers at Duo Security’s Duo Labs found that all five vendors, known as OEMs or Original Equipment Manufacturers, shipped computers with pre-installed updaters that had at least one high-risk vulnerability that would give an attacker remote-code execution abilities—the ability to remotely run whatever malicious code they want on a system—and gain complete control of the system. The skill required to exploit the vulnerabilities was minimal, the researchers said in a report they’re releasing (.pdf) about their findings."

It's amazing to me that vendors are still getting this so wrong when security has been a big issue on PCs for so long and Microsoft is so public about securing Windows. To be sending updates over unencrypted channels shows complete incompetence.

The Senate’s Draft Encryption Bill Is ‘Ludicrous, Dangerous, Technically Illiterate’

Wired reports The Senate’s Draft Encryption Bill Is ‘Ludicrous, Dangerous, Technically Illiterate’ "On Thursday evening, the draft text of a bill called the ‘Compliance with Court Orders Act of 2016,’ authored by offices of Senators Diane Feinstein and Richard Burr,  was published online by the Hill.1 It’s a nine-page piece of legislation that would require people to comply with any authorized court order for data—and if that data is ‘unintelligible,’ the legislation would demand that it be rendered ‘intelligible.’ In other words, the bill would make illegal the sort of user-controlled encryption that’s in every modern iPhone, in all billion devices that run Whatsapp’s messaging service, and in dozens of other tech products. ‘This basically outlaws end-to-end encryption,’ says Joseph Lorenzo Hall, chief technologist at the Center for Democracy and Technology. ‘It’s effectively the most anti-crypto bill of all anti-crypto bills.’"

There are issue I really hate Diane Feinstein on.

Once again: Why you shouldn't blindly install things on your Mac

iMore explains Once again: Why you shouldn't blindly install things on your Mac.

It seems that people who accidentally misspell a URL and end it with .om versus .com are being redirected to sites that only exist to serve malware. Sites many of us visit every day have been spoofed, such as Citibank, Dell, Macy's and Gmail. Our testing hasn't seen the issue on the listed sites, but it's always better to be safe than sorry."

The only popups I run into that tell me to install something are for flash and they've always been legit. But still, whenever I see one I never click yes in the popup, instead I dismiss it, open the flash system preferences on my mac and install from there. That way I know I'm going to the real site.

I'm also mostly immune to the described attack because all such sites I regularly visit I have Safari bookmarks for and to visit them I use the bookmark via Quicksilver (Spotlight will serve the same function). The bookmarks also include HTTPS so I visit them securely.

The Two Misconceptions Dominating The Encryption Debate

TechCrunch describes The two misconceptions dominating the encryption debate.

In the first he points out that the government already has access to more data than it's ever had before or knows what to do with:

The majority of global networks – including Facebook, Google, Twitter and Skype – operate with full visibility into user accounts and often their activities, rendering this data available to law enforcement with a warrant request. That includes metadata, a rich unencrypted layer in our expanding profiles – who we talk to, where and how often, where we spend time and with whom, and what our interests are.

Widespread visual surveillance — from cameras on public utility polls and transport to commercial data collectors time-stamping and geo-tagging billions of photos of license plates – supplies an exhaustive picture of ourphysical activity. Law enforcement has access to a historically unprecedented amount of information, capable of mapping out countless connections between people, businesses, locations, and things – sometimes with and sometimes without a warrant.

Current trends in technology are only adding to the pool of data that law enforcement can draw from. When vulnerability is injected into technology used worldwide, it becomes everyone’s liability."

And this will only get worse with the Internet of Things (as more and more things are connected to the Internet). The second is the obvious one, we only want a backdoor for warranted government access; but of course there's no way to enforce that any such backdoor is not also used by bad guys. That's the part that non-technical people have problems understanding or believing (this is not going to be fixed any time soon by smart people trying harder).

John Oliver covered part of this brilliantly and hilariously last night:

Kevin Mitnick's advice on protecting laptops, smartphones, and more

MacWorld has Kevin Mitnick's advice on protecting laptops, smartphones, and more. Nice simple tips for everyone.

First OS X Ransomware Found in Transmission BitTorrent Client Installer

The Transmission.app installer was infected on March 4th, 2016 and it was found yesterday, so the window is small. If you installed Transmission this weekend, you should read this in detail. The malware waits 3 days before activating, so you have time to remove it. You can otherwise read it in detail because it's interesting. :) New OS X Ransomware KeRanger Infected Transmission BitTorrent Client Installer.

Diffie and Hellman Receive Turing Award

The Turing Award is basically the Nobel Prize of computer science. Today, Cryptography Pioneers Receive ACM A.M. Turing Award "ACM, the Association for Computing Machinery, today named Whitfield Diffie, former Chief Security Officer of Sun Microsystems and Martin E. Hellman, Professor Emeritus of Electrical Engineering at Stanford University, recipients of the 2015 ACM A.M. Turing Award for critical contributions to modern cryptography. The ability for two parties to communicate privately over a secure channel is fundamental for billions of people around the world. On a daily basis, individuals establish secure online connections with banks, e-commerce sites, email servers and the cloud. Diffie and Hellman's groundbreaking 1976 paper, 'New Directions in Cryptography,' introduced the ideas of public-key cryptography and digital signatures, which are the foundation for most regularly-used security protocols on the Internet today. The Diffie-Hellman Protocol protects daily Internet communications and trillions of dollars in financial transactions."

Here's a nice video explanation of their invention:

Apple v FBI

One of the San Bernardino shooters, Syed Rizwan, had an iPhone (it was actually a work phone owned by his employer). Now the FBI has it but they can't unlock it. They've looked at other info, they can get call records from Verizon and they asked for and Apple gave them iCloud backups of the device, but those stopped in October. Now the FBI wants Apple to provide them with software to help them unlock the phone. Apple has said no but the FBI got United States Magistrate Judge Sheri Pym to issue a writ to compel Apple to help them, and Apple has said no.

Techdirt in a addition to a description of the order, has the actual order itself. No, A Judge Did Not Just Order Apple To Break Encryption On San Bernardino Shooter's iPhone, But To Create A New Backdoor. Wired has it too, pdf.

Here's Apple's reply, A Message to Our Customers. I think it's very well worded. Here's the heart of it:

Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession.

The FBI may use different words to describe this tool, but make no mistake: Building a version of iOS that bypasses security in this way would undeniably create a backdoor. And while the government may argue that its use would be limited to this case, there is no way to guarantee such control.

Here's a technical analysis by Dan Guido saying, Apple can comply with the FBI court order. It's mostly because the iPhone in question is a 5C which doesn't have TouchID or the Secure Enclave as later models do. More info: Errata Security: Some notes on Apple decryption San Bernadino phone and tl;dr Apple’s technical capabilities under FBI AWA order.

There's also a debate about the governments use of the All Writs Act to compel Apple. I've seen some debate on the point, but Apple says this is "unprecedented".

The implications of the government’s demands are chilling. If the government can use the All Writs Act to make it easier to unlock your iPhone, it would have the power to reach into anyone’s device to capture their data. The government could extend this breach of privacy and demand that Apple build surveillance software to intercept your messages, access your health records or financial data, track your location, or even access your phone’s microphone or camera without your knowledge.

Now the writ itself says on page 11:

Further, based on the authority given to the courts under the All Writs Act, courts have issued orders, similar to the one the government is seeking here, that require a manufacturer to assist in accessing a cell phone's files so that a warrant may be executed originally contemplated. See, e.g., In re Order Requiring [XXX], Inc. to Assist in the Execution of a Search Warrant Issued by This Court by Unlocking a Cellphone, 2014 WL 5510865 at *2 (S.D.N.Y. Oct. 31, 2014)

I wonder what company XXX is? Apparently even Judges being asked to issue similar writs don't know (see footnote at bottom of page 8 in this pdf! Ars Technica says the All Writs Act has come up in other cases, but cites several experts saying "The DoJ went with the nuclear option" and they can't think of similar precedents.

Joshua Gans writes about Game Theory and Apple’s Encryption Challenge. It's interesting that Apple can do this but the FBI (or NSA) can't. Also interesting is that Apple can't do this on more recent iPhones and this is clearly another salvo in the debate of should companies like Apple be able to make devices with secure encryption technology.

Ben Thompson provides a really good summary and makes some good points in Apple Versus the FBI, Understanding iPhone Encryption, The Risks for Apple and Encryption.

This solution [a government backdoor using a master key in future products] is, frankly, unacceptable, and it’s not simply an issue of privacy: it’s one of security. A master key, contrary to conventional wisdom, is not guessable, but it can be stolen; worse, if it is stolen, no one would ever know. It would be a silent failure allowing whoever captured it to break into any device secured by the algorithm in question without those relying on it knowing anything was amiss. I can’t stress enough what a problem this is: World War II, especially in the Pacific, turned on this sort of silent cryptographic failure. And, given the sheer number of law enforcement officials that would want their hands on this key, it landing in the wrong hands would be a matter of when, not if.

This is why I’m just a tiny bit worried about Tim Cook drawing such a stark line in the sand with this case: the PR optics could not possibly be worse for Apple. It’s a case of domestic terrorism with a clear cut bad guy and a warrant that no one could object to, and Apple is capable of fulfilling the request. Would it perhaps be better to cooperate in this case secure in the knowledge that the loophole the FBI is exploiting (the software-based security measures) has already been closed, and then save the rhetorical gun powder for the inevitable request to insert the sort of narrow backdoor into the disk encryption itself I just described?

Then again, I can see the other side: a backdoor is a backdoor, and it is absolutely the case that the FBI is demanding Apple deliberately weaken security. Perhaps there is a slippery slope argument here, and I can respect the idea that government intrusion on security must be fought at every step. I just hope that this San Bernardino case doesn’t become a rallying cry for (helping to) break into not only an iPhone 5C but, in the long run, all iPhones.

Rich Mogull in Why the FBI's request to Apple will affect civil rights for a generation says:

The crux of the issue is should companies be required to build security circumvention technologies to expose their own customers? Not “assist law enforcement with existing tools,” but “build new tools.”

The FBI Director has been clear that the government wants back doors into our devices, even though the former head of the NSA disagrees and supports strong consumer encryption. One reason Apple is likely fighting this case so publicly is that it is a small legal step from requiring new circumvention technology, to building such access into devices. The FBI wants the precedent far more than they need the evidence, and this particular case is incredibly high profile and emotional.

He also previously explained Why Apple Defends Encryption "Apple is nearly unique among technology firms in that it’s high profile, has revenue lines that don’t rely on compromising privacy, and sells products that are squarely in the crosshairs of the encryption debate. Because of this, everything Apple says about encryption comes from a highly defensible position, especially now that the company is dropping its iAd App Network."

As he points out, "Google is fundamentally an advertising company that collects data on its users." For Google to use that info, it has to have access to it, so available to the government with a warrant. Microsoft until recently has a history of working with the government. Most of Facebook's and Twitter's information about you is already public.

The ACLU is, not surprisingly, on Apple's side here. "“This is an unprecedented, unwise, and unlawful move by the government. The Constitution does not permit the government to force companies to hack into their customers' devices. Apple is free to offer a phone that stores information securely, and it must remain so if consumers are to retain any control over their private data."

Even a Congressman agrees with Apple, it's probably no coincidence it's one with a computer science degree from Standford, Rep Ted Lieu (D-CA), Congressman Lieu Statement on Apple Court Order .

This court order also begs the question: Where does this kind of coercion stop? Can the government force Facebook to create software that provides analytic data on who is likely to be a criminal? Can the government force Google to provide the names of all people who searched for the term ISIL? Can the government force Amazon to write software that identifies who might be suspicious based on the books they ordered?

Forcing Apple to weaken its encryption system in this one case means the government can force Apple—or any other private sector company—to weaken encryption systems in all future cases. This precedent-setting action will both weaken the privacy of Americans and hurt American businesses. And how can the FBI ensure the software that it is forcing Apple to create won’t fall into the wrong hands? Given the number of cyberbreaches in the federal government—including at the Department of Justice—the FBI cannot guarantee this back door software will not end up in the hands of hackers or other criminals.

Researching this I learned this is not the first time that a government agency has used the All Writs Act to coerce Apple to break into an iPhone. The EFF wrote about a case last October, Judge to DOJ: Not All Writs. The documents for that case are here and apparently the Judge still has not ruled on the matter.

In one of those documents the government says:

Apple has an established track record of assisting law enforcement agents by extracting data from passcode-locked iPhones pursuant to court orders issued under the All Writs Act. The government has confirmed that Apple has done so in numerous federal criminal cases around the nation, and the vast majority of these cases have been resolved without any need for Apple to testify. In the course of handling these requests, Apple has, on multiple occasions, informed the government that it can extract data from a passcode-locked device and provided the government with the specific language it seeks in the form of a court order to do so.

Interesting past history, but they're clearly trying to move away from this and it's for the privacy of their customers. I'm on Apple's side here. Not the least of reasons is that our own government is when other governments try to do this. This is from March 2015, Obama sharply criticizes China's plans for new technology rules.

In an interview with Reuters, Obama said he was concerned about Beijing's plans for a far-reaching counterterrorism law that would require technology firms to hand over encryption keys, the passcodes that help protect data, and install security "backdoors" in their systems to give Chinese authorities surveillance access.

"This is something that I’ve raised directly with President Xi," Obama said. "We have made it very clear to them that this is something they are going to have to change if they are to do business with the United States."

Drew Hartwell gives a nice overview of Tim Cook's recent advocacy, Tim Cook just escalated Apple’s fight with the FBI – and his own role as corporate activist

On a good note, The President's NSA Advisory Board Finally Gets a Tech Expert. Steve Bellovin is a great choice.