FBI Makes Official Its Decision to Keep Apple iPhone Hack Secret

This is a scary precedent.<p>From the bits I&#x27;ve seen of it, the Vulnerabilities Equities Process is a really great bit of government transparency, run by a group of people who understand that the best interests of different parts of the government and the citizens of the country often end up at odds. The process allows for vulnerabilities to be periodically reviewed so that the costs and benefits of not disclosing can be weighed over time, and by an at-least-somewhat independent group.<p>Just skipping it altogether because &quot;we paid a contractor&quot; completely subverts the process. What&#x27;s stopping all the TLAs from simply routing all their vulns through a private third party and bypassing the VEP altogether?

This might be great for the FBI right up until they actually try to use the evidence in court. The defense attorney can claim (rightly so) that unless they can examine the unlock method to verify it doesn&#x27;t tamper with any of the data on the phone, the evidence is inadmissible.<p>The only way the FBI will be able to use this data in court is if they turn the process over to the defense so they can have the process independently verified. Since the article states that they don&#x27;t have access to the &quot;technical details&quot; of the hack, they have no way to prove the method doesn&#x27;t manipulate the data on the device.

Did any of the commenters here actually read the article?<p><i>Although the FBI paid more than $1.3 million for the method, Amy Hess, the agency’s executive assistant director for science and technology, said Wednesday that it didn’t purchase the rights to the technical details and therefore doesn’t have the necessary information to submit the method for an Obama administration review known as the Vulnerabilities Equities Process. &quot;The FBI assesses that it cannot submit the method to the VEP,&quot; Hess said in a statement. &quot;We do not have enough technical information about any vulnerability that would permit any meaningful review.”<p>...<p>The law enforcement agency bought the hacking tool from an entity it hasn’t identified and then used it to access data on an encrypted iPhone</i><p>It sounds like the FBI doesn&#x27;t actually understand the details of how the crack worked and was hand-holded through the process.

So, if I understand correctly, the FBI doesn&#x27;t really know how the phone was hacked? Wouldn&#x27;t that also mean that they don&#x27;t really know if the data their contractors retrieved from the phone is really from the phone?

I&#x27;ve never seen government decision-making work first-hand, so I wouldn&#x27;t claim that this speculation should carry weight.<p>But if I was someone on the FBI side who wanted to &quot;win&quot; this somehow, I could imagine how this might look like a victory. Apple wanted for its phones to look so secure that they will even stand up to the government to protect them. In response, the FBI made Apple&#x27;s phones look so weak that anyone who has $1M to spend on the black market can get in.

Not to be a conspiracy theorist, but maybe they don&#x27;t actually have a hack. Maybe they just want people to think they do.

If the FBI can pay a million for the hack, what&#x27;s stopping Apple? I&#x27;d expect them to be fully aware of it by now.

I personally don&#x27;t have a problem with this, just as I had no problem with Apple not wanting to help the government with an investigation. I don&#x27;t think it is right to want it both ways.

I am really beginning to think if the FBI actually used a hack. There were reports that the passcode was changed when in FBI&#x27;s possession, what if this was just a deliberate attempt to force Apple to create a backdoor?

Would FOIA apply here in any way?

Oh, now they care about privacy.

I assume Apple already knows the hack&#x2F;vulnerability. Apple should announce they know it, fix it, and give the FBI a big F-U.

<a href="https:&#x2F;&#x2F;www.whitehouse.gov&#x2F;the-press-office&#x2F;2015&#x2F;02&#x2F;13&#x2F;executive-order-promoting-private-sector-cybersecurity-information-shari" rel="nofollow">https:&#x2F;&#x2F;www.whitehouse.gov&#x2F;the-press-office&#x2F;2015&#x2F;02&#x2F;13&#x2F;execu...</a><p>Then again, goose!=gander

Micro-probing the bus lines, to disable the self-destruct or time-delay counter ? Or perhaps &quot;glitching&quot;, sending badly-timed signals to the specific part of the asic that keeps count of the number of bad tries, causing it to lock up. Then brute forcing it at high speed.

These times are so interesting. The FBI is making policy that they wont expose the 0 days they bought for over a million USD. We need to consider the amount of cool things we learn right now and appreciate it.

Ive got a friend at Sun Corporation who, a few weeks ago, when I congratulated her on the recent (unconfirmed) news of her company, she said it was Cellebrite&#x27;s news and not theirs.

What would stop one or couple of apple engineers from creating a backdoor and then selling a &quot;unlock service&quot; trough some foreign intermediary making $1 mil each time?

Is FBI faking again [1]?<p>[1] - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=11578240" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=11578240</a>

Isn&#x27;t this title a little misleading if they never knew the actual technical process of hacking the iPhone? They can&#x27;t share what they don&#x27;t know.

Are we sure the FBI is not bluffing?

I hope that the security community reciprocates: if the FBI won&#x27;t disclose security flaws to the community, then neither should the security community give the FBI any special privilege or notice in disclosing flaws in FBI software. The FBI might then learn about the benefits of disclosure the hard way.

Just seems petty of the FBI to actually make an official announcement like this. I get if it&#x27;s understood that they&#x27;re not releasing it, but why make a formal press release about it?

Translation: <i>We got taken for a $1M ride, and have neither a valid exploit nor any data to disclose.</i>