Golden Frog Submits Amicus Brief in Support of Apple

Golden Frog and our sister company Data Foundry are excited to announce we’ve submitted an Amicus Brief to the court in the Apple versus FBI case. Our brief is in support of Apple.

Why We Submitted the Brief

We submitted this brief because we believe everyone has a right to privacy and security and to bear strong encryption to protect themselves. At Golden Frog, we believe encryption is the Second Amendment for the Internet and we wholeheartedly support Apple’s decision to fight back against the FBI’s demand to provide access into an encrypted iPhone. This case is huge, and we want to be a part of it.

Main points of our brief are included below, and you may access the full document here.

Introduction & Background

There is a clear and present danger posed by criminal hackers and state sponsored organizations attempting to surveil citizens. As such, businesses build security into their products and devices to protect both their business and their customers. In many cases, including the Apple case, the decryption key is in the hands of the users only.

What the Government Ordered

In an investigation surrounding the San Bernardino terrorist case, the FBI demanded Apple design new software to defeat the existing security protections in place in iPhones. This was under the guise that the government would access a single device a single time. The All Writs Act (which is a piece of legislation over 200 years old) was used to justify this ruling. The government order specifically compelled Apple to provide “reasonable technical assistance,” including: ‘Signed phone software file, and recovery binder or other Software Image Files (SIF) to load onto subject device.’ This information would enable the government to “crack” the encryption and access communications on the device, which Apple currently does not have access to.

Why We’re Opposed

The use of the All Writs Act here is too expansive. It contradicts other limitations Congress has put into place to govern how law enforcement can (and cannot) compel companies to assist in their investigations. Further, the All Writs Act cannot create new authority in contradiction to the existing Communications Assistance for Law Enforcement Act (CALEA), nor can it make an exception to CALEA and compel companies to break encryption. The way the case was conducted, and the urgency with which it was done, disregarded due process. Furthermore, this ruling could have huge and devastating implications for small businesses across the country. 

Details from the Filing

ARGUMENT 1: The Court’s Order is an Improper and Unprecedented Expansion of Scope of All Writs Act

The government’s current position is not supported by the historical context of the All Writs Act. The government’s current interpretation of the All Writs Act is too broad, and there is no precedent for providing “assistance” of the sort the government is seeking in the Apple case.

• The Historical Context in Which the All Writs Act Was Enacted Weighs Against the Government’s Broad Interpretation
• The original context of the All Writs Act was to support a limited reading of orders that were “agreeable” to the principles of law. The day after it was enacted, Congress approved the Fourth Amendment, in direct response to the dislike of the writs employed from the All Writs Act. The law was not, in its creation, intended to authorize orders conscripting private citizens into service to the government.

• Courts Have Not Applied the All Writs Act to Compel Companies to Create New Technology to Undermine Fundamental Features of Their Businesses
• The All Writs Act states a federal court can issue orders as “necessary or appropriate” – but in this context the government has gone beyond any historical use of this “assistance.” The All Writs Act has never been used to compel the invention of technology that didn’t previously exist, or that a business wouldn’t otherwise create. Nor has it compelled the creation of technology that’s harmful to a business and its customers.

• Compelling a Company to Create Technology That Undermines Security Is “Offensive” and Against the Substantial Interests of That Company
• Beyond the argument above, the All Wrist Act included a caveat – that assistance was not required if it was “offensive” to company’s business or imposed “undue burden.” In this case, compelling a company to create technology that undermines security is both offensive and goes against interests of the company. Cyber threats are real and increasingly common in today’s world, and the implications for both individuals and businesses (including financial implications) are huge. Furthermore, the executive branch has previously called upon American businesses to fortify their security and innovate to protect consumer information. The FTC even urges “privacy by design” including encryption of data both in transit and in rest. 
• An Order to Invent and Create New Technology to Assist Law Enforcement Is Unduly Burdensome, Particularly on Small and Nascent Technology Companies
• The cost and burden of complying with an order like this is too great for small companies, which do not have ample resources. Previous requests made under the All Writs Act were much easier for businesses to comply with. Creating new technology involves ample costs and, if this is a burden to Apple – one of the world’s largest and most valuable companies – this would certainly be an “undue burden” for small companies. The alternatives are all negative: going out of business, choosing not to innovate, or building permanent insecurities into devices.

ARGUMENT 2: CALEA (Communications Assistance for Law Enforcement Act) Limits the Application of the All Writs Act to Compel Assistance in Breaking User-Controlled Encryption

Courts can’t use the All Writs Act to grant powers that Congress has already considered and declined to give. In short, it cannot be used to create new authority. This authority was already denied in CALEA, which outlined terms for assisting law enforcement that do not include obligation regarding encrypted communications.

• CALEA Imposes Strict Limits on Government’s Ability to Compel Access to Encrypted Communications to Command Particularity Tech Design
• CALEA’s application was narrowly defined to apply to a set of “telecommunications carriers.” This list later included broadband Internet services and VOIP, yet excluded “information services” – or Internet based services. This means things like cloud storage services, social networks and chat apps would be excluded. Congress also wrote CALEA to balance privacy can security needs, and included two exceptions to compliance. The law did not mandate they adopt any “specific design of equipment, facilities, services, features or system configurations” nor did it mandate providers to “decrypt or ensure the governments ability to decrypt” any user communications.

• The Government’s Attempt to Distinguish CALEA Would Create an Exception to CALEA That Would Swallow the Rule
• Using the All Writs Act to create exceptions to CALEA would downplay the existing law and have negative consequences. The law states that probable cause must be used. Further, it says that serious and urgent cases may receive an exception, such as those with time sensitive data. This does not apply in the Apple case, indicating the government’s logic is flawed.

ARGUMENT 3: The Ex parte Nature of the Government’s Application and Court’s Order is Improper and Implicates the Due Process Rights of Companies Being Compelled Under the All Writs Act

A troubling process was used in the Apple case – one in which the decision came from a judge, without all parties present. There was not appropriate notice given to Apple, who should have been heard first and had a chance to respond. However, their input was missing. There was no need to use this procedure. The government acted too quickly, without good reason for trumping due process. The phone – and the information – would have still been there. Furthermore, when thinking about this in the context of company size, Apple had a hard time keeping up, so we must ask – how would any smaller company be able to?

Read the full brief we submitted for all the details.

Who Joined Us in the Brief

We joined with several other organizations in submitting this amicus brief, including AVG Technologies, Data Foundry, Golden Frog, the Computer & Communications Industry Association (CCIA), the Internet Association, and the Internet Infrastructure Coalition (“i2Coalition”).

Many other companies around the country – including giants like Facebook, LinkedIn, Twitter, Google, the EFF and ACLU have also submitted amicus briefs in support of Apple in this case. We are encouraged that so many influential groups and businesses are standing together, and hopeful that this fight will be successful and the right to privacy and encryption will be upheld.

Read our position on the Apple case

Want to fight back?  Sign the Access Now petition in support of Apple