San Bernadino Chief Deputy District Attorney Gary Fagan isn’t content to await a congressional ruling in the Apple and FBI case — instead, he chose to file an amicus brief, a legal show of support, containing language (penned by District Attorney Michael Ramos) designed to arouse the suspicions of the people.
“The iPhone is a county owned telephone that may have connected to the San Bernardino County computer network,” said Ramos. “The seized iPhone may contain evidence that can only be found on the seized phone that it was used as a weapon to introduce a lying dormant cyber pathogen that endangers San Bernardino’s infrastructure.”
Ramos believes that the phone may contain malware that could wreak havoc on San Bernadino’s critical infrastructure. But there are numerous problems with his statement.
If this statement were true — and we’re to just gloss over the terminology for a second — the shooter’s iPhone would have had to be jailbroken to house such an exploit.
According to iOS security researcher Jonathan Zdziarski:
The 💜 of EU tech
The latest rumblings from the EU tech scene, a story from our wise ol' founder Boris, and some questionable AI art. It's free, every week, in your inbox. Sign up now!
A jailbroken iPhone means that the code signing on the device has already been compromised. There are a number of commercial forensics tools capable of imaging a jailbroken iPhone simply because this code signing barrier is out of the way… it also means that the one big piece to what the FBI is after (Apple’s code signing) isn’t in fact needed at all, and so Apple doesn’t even need to be involved in the FBI’s investigation.
FBI officials are pleading with Apple to create software that disables key security features that would allow them to access the phone. A jailbroken iPhone downloads third-party firmware never authenticated by Apple, which is kind of the point of jailbreaking in the first place.
It also removes the need for Apple to unlock the phone as the FBI could just upload new firmware to disable the security features.
The language also presents a problem. The term “cyber pathogen” has never been used in reference to cyber security before the December 2 shooting.
I Googled the term and other than omitting the first result — which must have involved psychic writers capable of breaking a story before it actually happened — there isn’t a single usage of “cyber pathogen” in the past ten years, at least as it relates to system threats.
It is, for all intents and purposes, completely made up and designed for nothing more than creating uncertainty in the minds of the courts, and the people.
Zdziarski also takes issue with the “blatant fear mongering” designed to take a FUD (fear, uncertainty, death) approach to manipulating the courts.
Fagan’s statements are not only misleading to the court, but amount to blatant fear mongering. They are designed to manipulate the court into making a ruling for the FBI, and in my opinion are egregious enough that Fagan should be held in contempt just for filing what amounts to a crazy apocalypse story.
Ars Technica reported that even San Bernadino county officials are attempting to distance themselves from the filing — “the county didn’t have anything to do with this brief. It was filed by the district attorney,” a spokesperson said.
➤ On Dormant Cyber Pathogens and Unicorns [Zdziarski’s Blog of Things]
Get the TNW newsletter
Get the most important tech news in your inbox each week.