Federal Court Says Dismantling a Phone to Install Firmware Isn't a 'Search'

https://www.techdirt.com/2024/12/04/federal-court-says-dismantling-a-phone-to-install-firmware-isnt-a-search-even-if-was-done-to-facilitate-a-search/

by hn_acker • 2 years ago

270 142 2 years ago

techdirt.com

hn_acker6• 2 years ago

The full title is:

Federal Court Says Dismantling A Phone To Install Firmware Isn’t A 'Search,' Even If Was Done To Facilitate A Search

jerf2• 2 years ago

As the article says, it is probably a reasonable ruling, because it isn't a search.

What you have to watch out for is the legal two-step, where they do something like "install a firmware on the phone", which isn't a search, and then, oh gosh, the firmware just happened to sit there and flash all the contents of the phone on the screen because that's what the firmware does, we didn't actually search the phone, it just voluntarily dumped all its contents to the screen, so that wasn't a search either, so no search occurred.

koolba• 2 years ago

Does that mean that wiping the firmware or Secure Enclave would not constitute destroying evidence?

How about installing firmware that will wipe the Secure Enclave on boot? Especially if the secondary step of turning on the device is done by the seizing authorities.

fwip• 2 years ago

No, the judge would not be okay with that.

In the same way, shredding all your incriminating legal documents into a fun jigsaw puzzle for the cops to put together is also illegal.

LPisGood• 2 years ago

This makes sense, and I actually believe that it isn’t a search. It is definitely a _seizure_ though and I do wonder how often these two things are distinguished in law.

How often do the police raid a place and confiscate filing cabinets but not look through them.

rayiner6• 2 years ago

The seizure was done pursuant to a warrant too. There’s an argument that, once the warrant extensions expired, keeping the device in police custody constituted a continuing seizure. But it doesn’t seem like the defendant made that argument (or at least the court didn’t address that argument)

btilly4• 2 years ago

You and I disagree on reasonableness.

The government is here deliberately planning to take advantage of a seizure to damage someone's personal possessions. The right of that person to be secure in their possessions therefore should require a higher standard from the government than is required for mere temporary adverse possession after a seizure.

rayiner6• 2 years ago

The government had a warrant to seize the device. It got multiple warrant extensions trying to get into the device. They determined it needed a logic board replacement. The warrant extensions expired while that was being done. But the government got a warrant to then actually access the data.

I fail to see how this doesn’t satisfy even a high standard of reasonableness.

toomuchtodo• 2 years ago

I agree with this perspective, but think we're going to hit tension between right to repair and hardening devices against threat actors who have physical access to your device. Apple's move with the inactivity reboot timer is a step in the right direction, but a mode or option to wipe or otherwise destroy all my data if tampering is detected (device is opened) would be welcome (even if it means one is then unable to repair the device). Replacing one's device will always be cheaper than any prolonged interaction with US law enforcement or the US judicial system.

taneq2• 2 years ago

Breaking down the door of a house isn’t a search. Activating an autonomous drone in front of the house which then enters through the door of its own volition and records everything it sees in the house isn’t a search. And if I make a chomping motion in the air near a donut and it decides to enter my mouth while I’m chomping then I haven’t illegally taken a bite of the donut.

nyeah• 2 years ago

I sense irony here, but I'm American so it's hard to be sure.

zzo38computer• 2 years ago

Whether or not it is a "search", it is trespassing, and they should make the constitution to protect against that too (I don't know whether or not it already means that or whether or not it is intended to mean that). Protecting against "unreasonable search and seizures" should also include protecting against trespassing.

ortusdux2• 2 years ago

I guess I can understand the argument that picking a lock does not count as a search, but the second you open the door...

qup• 2 years ago

Like removing the doorframe and putting in your own new door that doesn't lock, then walking inside

tiahura• 2 years ago

is when they got the warrant

thayne2• 2 years ago

What if picking the lock damages the lock?

gnfargbl• 2 years ago

Ah, but standard firmware doesn't do that; the agency performing the action would need to have developed custom firmware which "just happened" to show the information when installed. Courts tend to see through those kinds of shams.

wbl3• 2 years ago

No that would be a search. Judges really don't like having these games played.

jerf2• 2 years ago

A sane judge, yes. A judge searching for a fig leaf, perhaps not.

Call me cynical if you like. It won't bother me.

mindslight3• 2 years ago

Independent of the legal nuance being worked out here, it is quite fucked up that the government can just demolish your entire digital infrastructure and then keep the pieces indefinitely. Imagine if they applied the same standard to your dwelling itself. "Sorry you can't live here for the next few years because a crime might have been committed. Go buy another house. Or not, we don't care".

readthenotes1• 2 years ago

Maybe you haven't heard of civil forfeiture?

https://en.m.wikipedia.org/wiki/Civil_forfeiture_in_the_Unit...

mindslight3• 2 years ago

I don't know why you would think that might be a possibility given the venue we are on.

Government has also demolished people's actual homes in the course of "crime fighting" and then refused to pay/fix them as well (that notorious case in Colorado comes to mind). But surely you can see there is still a distinction between things that happen infrequently, often with limited scope, or still at least with some semblance of a legal process, and what happens routinely to people accused of "digital crimes".

It should go without saying that I think all of these dynamics are terrible, and in dire need of reform. But at least civil forfeiture and "qualified" (née sovereign) immunity are getting talked about, while the totalitarian approach to personal digital infrastructure isn't getting so much attention.

sidewndr464• 2 years ago

What'd really be a shame is if the police could just show up one day and blow up your house. And then just leave

https://www.denverpost.com/2020/03/11/colorado-swat-house-de...

mindslight3• 2 years ago

I don't get the point to this reflexive whataboutism. Yes, that dynamic exists and it is bad too. (I referenced that event in a follow up comment, thanks for providing a specific link)

And at least that event had some condemnation in the media, as opposed to the routine destruction of digital personal lives escaping criticism even on techdirt.

btilly4• 2 years ago

What happens if we take this as precedent?

Dismantling a safe to facilitate a search, isn't a search. So it's allowed, even if the safe is left damaged.

Tearing a house apart to facilitate a search, isn't a search. So it's allowed, even if the house is left damaged.

Disassembling a car to facilitate a search, isn't a search. So it's allowed, even if the car never runs the same later.

Meanwhile you'll find me in the corner that reads the 4th Amendment as follows:

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

I think that if the result of a seizure is the potential permanent damage of my property, then my right to be secure in my possessions should be defended by demanding a higher standard from the government than that required for a mere temporary possession after a seizure. That principle applies just as much to electronics as it does to any physical item.

modernpacifist2• 2 years ago

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

If they have a search warrant then a judge has, from a legal perspective, determined that the request/search is reasonable. So while you have the right to secure against unreasonable cases I think it is a reasonable trade off that those security mechanisms/processes/etc should either be removed by yourself or you should expect them to be removed for you.

sidewndr464• 2 years ago

I don't know what fantasy world you live in but the police don't ask you to remove your security mechanisms yourself. Your likely to catch a charge for destruction of evidence if you do that along with a bunch of other related charges

Dylan16807• 2 years ago

If you want to get a close analogy, they already used a warrant to seize the safe/house/car, and already searched it a couple times and still have possession, so that makes a pretty big difference.

rayiner6• 2 years ago

The article’s headline is rather misleading (I assume unintentionally), because it omits that the actual seizure and data access was done pursuant to warrants. Only the repair and firmware update was performed during a donut hole when one warrant had expired before another was granted.

Here, the government obtained multiple, time-limited warrants to search the device, but was unable to get into it. They sent it to be repaired. After the warrant extension expired, the repair guy fixed it and updated the firmware. (The record doesn’t say what version the firmware was, but it seems like it was standard firmware, not some special forensic firmware.) The next day, the government again obtained a warrant. Only after doing so did the government perform the search.

In this unusual situation, it’s reasonable to conclude that the device repair wasn’t a search. The seizure and the data access were both performed pursuant to a warrant. The only part that wasn’t covered by the warrant was just fixing the device in a seemingly conventional way to get it working again.

Original decision here, pages 3-4 has the relevant facts: https://s3.documentcloud.org/documents/25423841/no-disassemb...

chefandy9• 2 years ago

I agree that most readers won’t really ‘get it’ by reading the headline, and appreciate your useful addition so we all can get some context without the click, but in defense of the author, I think writing layperson-accessible headlines for technical legal articles is often impossible. Having attempted to make interfaces and applications that made raw legal data useful for laypeople, including with NN summaries and such, if there’s a meaningfully better solution, I sure couldn’t find it after a few years of work. For the same reason reading case law doesn’t effectively help laypeople represent themselves in court, you need context and background knowledge to make sense of legal concepts. (If you’ve ever seen an overconfident ‘sovereign citizen’ cite opinions in court while representing themself, you’ve seen why. And while most are obviously under-educated for the task, they’re probably not unintelligent and they clearly put a lot of effort into it.) To people used to reading legal texts and familiar with the trajectory of decisions in this space, the headline makes sense, and I think that’s probably the best you can do. Trying to construct a headline that’s representative while also giving laypeople the background and context they need to make sense of the topic becomes way too long to be a headline long before it accomplishes it’s goal.

rayiner6• 2 years ago

Yes, I wouldn’t know how to explain all that in a headline either! Unfortunately the word “misleading” has multiple connotations—I wasn’t saying the author was trying to deliberately mislead, but rather that the reader shouldn’t conclude too much based on the headline alone.

throwup238• 2 years ago

The author probably didn’t come up with the headline, the editor did. It’s one thing if the Office of Legislative Counsel tries and fails to come up with a succinct one liner, it’s another when an editor driven entirely by clickbait economic incentives does it. The latter rarely even try to be accurate.

pc863• 2 years ago

Sovereign citizenry and misquoting admiralty law in your hearing about driving without valid registration or saying the court doesn't have jurisdiction because the flag has gold fringe on it is so close to mental illness it's hard to assign concepts like "smart" or "dumb" to it.

throwawaycities3• 2 years ago

I’ve attending 1,000’s of arraignments, motion calendars and pleas.

In all my experience I’ve seen 2 pro se defendants pull the “I’m a sovereign” spiel. Credit to them they both turned what should have been a 5 minute hearing into at least 15 minute circuses refusing to even announce their names for the record. Both were threatened with being held in contempt before the Judges passed on their cases and made them wait to hear the other matters on the docket.

Truly fascinating & unusual events and people, I think if you draw a vin diagram mental illness and Dunning-Kruger Effect these folks would be the overlap.

psunavy032• 2 years ago

There's a huge gray area between "not understanding the law" and "being competent to litigate a case in court." It is entirely possible for non-lawyers to understand the gist of the law at a high level. And thus it's not acceptable to tolerate misleading headlines about legal decisions any more than it is to tolerate misleading headlines about any other decision. And God knows I've seen enough of them about other issues that are within my realm of professional expertise.

The problem is that our system as currently set up does not incentivize reporters working a "beat" for years where they develop enough domain expertise on a field to report on it competently. If we had actual senior legal reporters, senior national security reporters, senior tech reporters, and so on, they would have enough knowledge of those fields to effectively write for laypeople.

stonemetal12• 2 years ago

It doesn't seem misleading to me just overly technical for no reason.

Something like "Court Says Repairing Seized Phone isn't a Search" conveys the same meaning with fewer technical details, but is a little no duh. To me that is just as click bait-ish, because I would want to know who was dumb enough to try that as a defense, or wonder what the actual situation was.

thayne2• 2 years ago

Was it just a repair, or did they install custom firmware? It isn't really clear from the article, and that seems like it would make a big difference.

BurningFrog2• 2 years ago

Since I had to look it up:

pursuant: in accordance with (a law or a legal document or resolution). "conversations that they wiretap pursuant to court order"

Suppafly7• 2 years ago

Are you new to learning English or have you managed to not come across it before?

WarOnPrivacy• 2 years ago

The only part that wasn’t covered by the warrant was just fixing the device in a seemingly conventional way to get it working again.

By 'the only part that wasn't covered', I think you meant "The only part that wasn't within a warrant period" (as opposed to not falling the scope of one of the warrants).

Assuming that, this is what I think you are considering.

    Are the constitutional safeguards of these warrants reasonably satisfied here?

Instead, I believe the following is the matter for concern here.

    By declaring a repair 

    [a repair which occurred to enable and assist a search for incriminating evidence] 

    to not be a search (to not be an action that merits 4th amendment protections)

    a court establishes that LEO are now free to forcefully perform certain evidence gathering actions on private devices without a warrant - as long as those actions can be construed as a 'repair'.

Suppafly7• 2 years ago

In this unusual situation, it’s reasonable to conclude that the device repair wasn’t a search.

I'm more comfortable concluding that it's an illegal search than I am concluding that it's not a search at all. During the period that the warrant(s) didn't apply, it should have been sitting in a sealed evidence bag and not being modified by a 3rd party. The law doesn't and shouldn't make provisions for "eh, it's probably not a big deal, we'll probably get another warrant".

d0mine• 2 years ago

[uneducated impressions:] Sure, it sounds like technicality. It is a shame it is not treated as such. The right solution would be to force government officials to do their job and get warrants on time next time.

Just physical access not mentioning firmware update means your device is compromised.

It sets a bad precedent.

It is not like people have too many rights as it is.

hn_acker6• 2 years ago

They sent it to be repaired. After the warrant extension expired, the repair guy fixed it and updated the firmware.

These sentences you wrote are just as misleading, if not more so. The "repair guy" was a government detective who performed the repair by re-flashing firmware at a forensic laboratory during a period when no search warrant was active [1]:

Detective Sheldon Clay, an HSI Task Force Officer at that laboratory was able to repair the iPhone 6 by replacing its circuit board and re-flashing the device's firmware. Mot., ECF 106, EX. D at 2. At that time, Detective Clay also determined that new forensic software was likely able to bypass the iPad's passcode.

The headline of TFA claims that the reflashing of firmware was for the purpose of facilitating a search.

[1] https://s3.documentcloud.org/documents/25423841/no-disassemb...

EPWN3D• 2 years ago

Author chose to take a jab at "walled gardens" which made absolutely no sense. They basically implied that because both iPhones and iPads were accessed in this way, Apple's ecosystem is worthless. Or something. Clearly had an agenda.

Pxtl• 2 years ago

So if the government bugs your car and home but doesn't turn the bug on, is that a search?

Clubber• 2 years ago

Yes and I believe if you remove it, they can charge you with theft.

rolph• 2 years ago

[0] Is It Considered Theft if You Remove a Law Enforcement G.P.S. Tracking Device from Your Automobile?[2020]

https://www.wimmercriminaldefense.com/is-it-considered-theft...

ezfe• 2 years ago

No, and there's actually an analogy: phone taps. The "bug" is already installed, they just need the warrant to turn it on.

rangestransform• 2 years ago

we found out that "lawful" intercept is a lie recently, and it left a gaping hole in our infrastructure

can we please encrypt everything and turn off government access for all communications now

yapyap• 2 years ago

Federal court is stupid,

throwawaycities3• 2 years ago

This will be great legal precedent for the courts to extend to implanting neuralink style chips in your brain - although a neuralink chip may facilitate a future search and seizures (pun intended), the installation of the chip itself is neither a search nor a seizure; therefore, the 4th Amendment does not apply

WaitWaitWha• 2 years ago

Couple of notes on this:

52 devices could mean a phone, a tablet, and 50 USBs, SD cards, and such.

The problem with loading firmware to permit is the potential damage to the evidence and the potential to imply that the evidence was planted.

The vast majority of the cell phone hacking involves loading material into at least into memory and often modify the boot load sequence. This is how all that I worked with (e.g., Cellebrite, Magnet, MSAB, Oxygen, AccessData) function.

damage: I have toasted devices by hooking them up to forensic tools, mobile phones and more.

planted evidence: There have been several challenges to this (I think US v. Ganias), and let's not forget the Casey Anthony trial where they argued that the forensic tool CacheBack reliability. Not surprisingly, F/LOSS tools are better defense for this than black-box commercial ones.

The more complex the evidence collection, the more likely damage can occur, or planted evidence can be argued.

julianeon• 2 years ago

It seems like the writing is on the wall.

There will be some Official Ruling that you can't do this (probably antiquated 20th century) thing because that constitutes an Unlawful Search or whatever. Thank you to the Constitution for protecting our freedoms, etc.

Meanwhile, there will be a much more powerful way to achieve that goal using a smartphone, which is 100x more subtle and effective, which will be legal because technically it doesn't cross the big red line. There will be some arcane logic here that only a lawyer could love, but it will amount to 20th century technique = banned, 21st century cellphone technique = fine. So everyone will do that.

It'll just get more pronounced over time.

wbl3• 2 years ago

Look at Katz to see the opposite.

salawat• 2 years ago

I second this. That kind of trickery is absolutely obvious to the judiciary, and as of yet Katz hasn't been overturned, even if it has been at times pointedly ignored.

renecito• 2 years ago

I'd guess that's the criteria to make government mandated backdoors legal.

yieldcrv2• 2 years ago

nah, appeal. reviving it involved modifying someone’s personal property.

I like that this is in the 9th circuit so I think the defendant and this country’s subjects will get a favorable ruling

people ask me how much I want to make: enough to take any cases through federal appeals court

singleshot_• 2 years ago

Analogize to those cases where they seize an inoperative gun and then go to certain, specific lengths to make the gun operate before charging the possessor with possession of a (potentially) operative gun.

Distinguishable because it’s not a search. Can you draw a rule from this?

yieldcrv2• 2 years ago

I would argue that what theyre doing is outside of the scope of the warrant they already used, and also possible that the defendant asked the wrong question for this challenge

And that those other cases should have been challenged too, if they weren’t

I’ve seen too many things that were either difficult to challenge or only affected people too poor to challenge, to just accept a common practice because its common. I will accept prior case law from federal appeals courts though

I feel like there should be a limitation on government power here either way as they changed the circuitry and firmware. they should at least give more information about the firmware, for mounting a defense we should have information about the firmware itself

dhx• 2 years ago

Is this ruling effectively that it's irrelevant whether or not a warrant existed to modify the iPhone 6 because in this case, there is no loss to the claimant from that modification having been made? How much would an old second hand broken iPhone 6 that needs repair sell for? ... not much. Yet the repair carried out has seemingly significantly increased the value of the iPhone 6. The only argument that otherwise comes to mind is an iPhone 6 with an old and very specific version of firmware could be more valuable due to rarity and people are transacting them for $20,000 on eBay because of that firmware version's ability to be rooted. Yet an eBay confirms this is seemingly not the case. Perhaps though there is a non-insignificant cost to buying and selling 20 or 50 iPhone 6's off eBay before finding one with an old enough firmware version installed?

Sparkyte• 2 years ago

It isn't, but it should be illegal to repair or modify something you do not own without the consent of the owner. You wouldn't rent an apartment only to put 10k renovations into it? I mean lets be real that is practically illegal.

radicaldreamer• 2 years ago

This was an iPhone 6, so I assume that the logic board change enabled brute force passcode searches. This was fixed in a subsequent update to the secure enclave, so this is less likely to work on the latest devices.

sharpshadow• 2 years ago

Maybe Apple was right after all with their iPhone refusing any replacement parts.

ReptileMan• 2 years ago

Fair game. The government shouldn't be able to force you to unlock a device. Even with fingerprint or face. But it is totally ok to get inside any way they can.

015a• 2 years ago

Unrelated to the ruling: Why is the Department of Homeland Security investigating and pursuing a CSAM case in the first place? Isn't that more FBI's jurisdiction?

K0balt• 2 years ago

So they figured out that they needed different firmware with a zero day they had access to, so they contrived a way to get the firmware on there? That seems like maybe not a search? Idk. If a search warrant includes destruction to obtain information, seems like this would fly.

Federal Court Says Dismantling a Phone to Install Firmware Isn't a 'Search'

Related Stories