Apple's lawyers indicated yesterday that they plan to use a First Amendment defense in the San Bernardino iPhone case, arguing that if code is speech, then the government is compelling the company to say something it doesn't want to by forcing it to cooperate in cracking the phone's password. That might sound like a weak argument on which to hang a critical data privacy case. But, as Motherboard previously pointed out, experts say the company might actually be onto something.
Here's why: a court has ordered Apple to assist the FBI in cracking the password on an iPhone used by one of the San Bernardino shooting suspects, but in order to do so, the FBI wants Apple to write a new software tool---essentially a crippled version of its iOS software---to eliminate specific security protections the company built into its phone software to protect customer data. Because iPhones won't accept firmware updates that aren't signed by the company, Apple would also have to use its digital key to sign that software.
A famous encryption case known as Bernstein v. US Department of Justice established long ago that code is speech and is protected by the First Amendment. Compelling Apple to write code would be the equivalent of the government compelling Apple's speech. But that's not the most important argument in this case. Instead, it's the digital signature that Apple would use to sign that code that is the key to Apple's First Amendment argument, say legal experts who spoke with WIRED.
"The human equivalent of the company signing code is basically saying, 'We believe that this code is safe for you to run,'" says Jennifer Granick, director of civil liberties for the Center for Internet and Society at Stanford Law School. "So I think that when you force Apple to cryptographically sign the software, it has a communicative aspect to it that I think is compelled speech to force them to do it."
Granick, who is working on an amicus brief to file in support of Apple, says the other argument---that simply forcing Apple to write the software tool is compelling the company's speech---is a weaker argument to her.
"[B]ecause what's so expressive, necessarily, about that? But to me, the signing is expressive---very clearly so," she says. "That's kind of what the code signing is---it's saying 'I'm Apple Computer and we support this software and we think this software is safe for you to run' ... So a forced signature to me is compelled speech."
Nate Cardozo, staff attorney for the Electronic Frontier Foundation, which is also working on an amicus brief, agrees.
"In the computer security world the digital signature is affirmation that not only is this code genuine, but it's intended," he says. When someone, for example, signs an email with their PGP encryption key and sends out the email, they're warranting with that PGP signature that the email is not only from them, but that they intended to send signed email that is represented as coming from them.
"[I]f Apple signs this [software tool], it's the computer version of Apple saying, 'Yes this is us; yes we meant to do this; and yes it's a genuine representation of our will'," he says.
And that is something, Cardozo explains, that Apple will argue puts an undue burden on the company. The degree of burden that the government's request places on Apple is one of the core issues the court will have to address.
"All of these First Amendment arguments are arguments that Apple is going to muster to say that the burden is unreasonable," Cardozo says.
Cardozo notes that no court has ever addressed anything like this before, and that lawyers on both sides are heading into uncharted territory. "There aren't actually very many cases around [the compulsion of speech], because the government doesn't do this very often," he says. "It's exceedingly rare."
Most prior cases involving government efforts to compel speech involved labeling on products, such as the ingredients and caloric count of foods, according to Cardozo. There have also been two other prominent cases that involved companies that were forced do something they said specifically went against their business interests. In one case, the California Public Utilities Commission wanted an electric company to include in mailings sent to customers information about rates and saving power from a consumer group often at odds with the electric company. The other case involved the health warnings that tobacco companies are required to place on packaging and advertisements warning people about the health risks associated with consuming tobacco.
"In those case[s] courts said because that information was purely factual, non-controversial and informative, that they could be compelled to include what are quite obviously speech against their will," he says.
Aside from the fact that these cases don't involve code, they're very different for another reason: even though encouraging people to consume less power and to stop smoking went against the interests of these companies, the compelled speech didn't fundamentally subvert or interfere with the specific service the companies were providing customers through their business, Cardozo says. That is quite different from the purpose of Apple's digital certificate, which is solely to authenticate and affirm the safety and security of that software to customers. Cardozo says that undermining that message undermines the certificate and code-signing structure itself.
"Apple's security model depends on all of us knowing that Apple's key is only used by Apple in its best judgment," Cardozo says. "And once that security model is broken that's sort of it. We can no longer assume that an over-the-air update to iOS isn't compromised.... Apple being ordered to compromise their code-signing infrastructure undermines trust in the whole system."
An important case that Apple could use as a precedent is one that the government lost. This involved an FBI request to use the OnStar system installed in cars to spy on the conversations of vehicle occupants. A court ruled that the FBI could not remotely activate the system to snoop on occupants because this would render the system inoperable during an emergency. One of the judges in the 9th Circuit Court of Appeals noted that "the company could not assist the FBI without disabling the system in the monitored car."
All of this may be moot, because the primary argument Apple is expected to make in its defense is that the All Writs Act---the statute the government is trying to use to compel Apple to cooperate---does not apply in this case. Apple has said in public statements and in other court cases involving iPhones that this statute doesn't provide the government with the authority it needs to compel Apple to comply.
Apple's lawyers have indicated to reporters that the All Writs defense will be Apple's primary defense argument, with the First Amendment argument only being secondary. And Granick says this will be the order of the court's priority as well.
"Courts usually go for the statutory argument before the Constitutional," she says. "We like to answer the narrow question before we have to answer the big one if that's possible. So I think the court will look at the All Writs Act question first."
But Cardozo says that the two may become intertwined, because the speech argument will color how the court views a precedent-setting case that involved the All Writs Act and which the government has cited in support of its arguments.
In that case, the government required New York Telephone company to provide technical assistance to record any numbers dialed from a phone in what is known as a pen-register. New York Telephone objected, saying the pen-register statute didn't require companies to provide technical assistance. The Supreme Court ultimately ruled that the phone company could be compelled to provide the technical assistance because it was already collecting this information as a matter of course for its own business purposes, in order to bill customers, detect fraud and conduct troubleshooting.
But the key thing that's missing from the New York Telephone case, Cardozo says, is a compelled-speech component---the company in that case wasn't being compelled to do or say anything that had First Amendment significance and that they weren't already doing.
"Here obviously Apple is being compelled to do a whole lot that they're not already doing," he says. And this added element could weaken the government's use of the All Writs Act, and the New York case, to support its arguments.
