By Gregory Reda, Senior Associate
March 15, 2016
Introduction
In 2014, Apple decided to cloak the password-protected contents of its mobile devices with default encryption; this security mechanism automatically encrypts data stored on the phone, on Apple’s servers, and data in transit.[1] To access the encrypted information, a person needs a key that is “tied to the device password and only stored locally on the phone.”[2] Further, the phone’s encrypted contents remain unreachable to Apple because the company did not make a separate key or pathway to the data for itself.[3] The data is more secure this way.[4] Apple’s method of encryption protects its customers from hackers and identity thieves, but also creates an obstacle for law enforcement.[5]
Two recent federal cases, one in New York and another in California, highlight the issue. In each instance, the United States government obtained a legally valid warrant to search an iPhone but was unable to access the phone’s data because that data was locked behind Apple’s encryption technology.[6] In both cases, the government sought a court order through the All Writs Act (“AWA”) that would compel Apple to create another pathway into the phone.[7] The courts’ rulings have created a conflict. Whereas the California court held that Apple must assist the government pursuant to the AWA,[8] the New York court ruled that using the AWA would be improper because another statute alleviates Apple from government cooperation.[9] To protect its customers’ data, Apple has moved to vacate the ruling in California.[10] A plain reading of the AWA supports Apple’s motion.
I. The All Writs Act
The AWA provides that the “Supreme Court and all courts established by Act of Congress may issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.”[11] The AWA allows a court to “effectively carry out the duties of an independent judiciary by issuing the orders necessary to do so—even if Congress had not had the foresight to create all of the procedural mechanisms that might be required.”[12] The AWA, however, is a discretionary,[13] residual source of authority, and courts should only use the AWA to issue writs when a statutory gap exists. As a result, when a statute specifically addresses the particular issue at hand, then that statute governs, even if “compliance with [its] procedures appears inconvenient or less appropriate.”[14] Therefore, determining if the AWA compels Apple to create another pathway into its devices turns on whether the government seeks to fill a statutory gap.
II. Searching for a Gap
Congress enacted the Communications Assistance to Law Enforcement Act (“CALEA”) to “preserve the government’s ability, pursuant to court order or other lawful authorization, to intercept communications involving advanced technologies.”[15] The federal government and Apple have agreed that CALEA does not compel Apple to bypass its security measures to allow access into one of its devices. The parties disagree, however, on why CALEA does not apply; “the government contends that CALEA simply has nothing to say on the matter, while Apple argues that the omission reflects a legislative choice.”[16]
Courts have expanded CALEA to cover additional technologies since the statute was enacted in 1994, but Congress created several exemptions “to ensure that the law would not stem technological progress.”[17] The exemptions limit the government’s ability to constrain the services that communication companies can offer. They prohibit the government from requiring a telecommunications carrier to help “bypass any encryption that might shield communications from surveillance.” Additionally, the exemptions preclude the government from asking an “information service” to intercept communications or access communication information.[18]
The act defines an information service as the “offering of a capability for generating, acquiring, storing, transforming, processing, retrieving, utilizing, or making available information via telecommunications.”[19] The term also “includes a service that permits a customer to retrieve stored information from, or file information for storage in, information storage facilities; electronic publishing; and electronic messaging services.”[20] Therefore, Apple is exempt from the obligations of CALEA as it is by definition an information service.[21]
III. Finding CALEA Instead
The New York court’s verdict—which was favorable to Apple[22]—resulted from a plain reading of the AWA. The court found that no statutory gap existed within CALEA that the AWA could fill. The court reasoned that Congress had considered the precise relief for which the government was requesting but had declined to adopt that relief in any legislation.[23] To justify its conclusion, the court severed the AWA’s statutory language into a three-part analysis: (1) whether the issuance of the writ the government sought was “in aid of” the court’s jurisdiction; (2) whether the writ was “necessary or appropriate” to provide such aid to the court’s jurisdiction; and (3) whether the writ would be “agreeable to the usages and principles of law.”[24]
The court found that the writ would be “in aid of” the court’s jurisdiction because it would help the government execute a valid warrant.[25] Further, no congressional prohibition existed on the matter, so the judicial action was inside the bounds of being “necessary or appropriate.”[26] The court emphasized, however, that the phrase “agreeable to the usages and principles of law” within the AWA must mean more than just an action not being prohibited by law. Otherwise, the words “usages and principles” would be left superfluous.[27] The court thus determined that the third element requires an AWA writ to also be consistent with both the development and implementation of the law.[28]
The New York court looked to CALEA’s history and found that the executive and legislative branches had, at different times, considered either updating the statute or creating special legislation to provide the exact assistance that the government sought. Fortunately for Apple, Congress never adopted that legislation.[29] What Congress knowingly left in place were the obligations and exemptions imposed by CALEA, including the exemption for information services that encompasses Apple. The court ultimately did not issue a writ on the grounds that Congress was aware of the remedy the government sought but had not enacted a law to provide for that remedy.[30]
Conclusion
A court should deny a request for a writ compelling Apple—or any other information service—to assist a law enforcement investigation by producing a new pathway into one of its devices if that writ is based upon the AWA. To allow a court to formulate a writ based upon a legislative agenda that was considered but not implemented would damage the AWA’s purpose and would give legislative-like powers to the judiciary.[31] The legislature is the proper place for the federal government to address its concerns over default encryption, not a court house.[32]
[1] Berkman Ctr. for Internet & Soc’y, Harvard Univ., Don’t Panic: Making Progress on the “Going Dark” Debate 3–4 (2016), available at https://cyber.law.harvard.edu/pubrelease/dont-panic/Dont_Panic_Making_Progress_on_Going_Dark_Debate.pdf [https://perma.cc/V5C7-CETU].
[2] Id.
[3] Id.
[4] See id. at 1.
[5] But see id. at 9–15 (arguing that default encryption does not put the FBI completely in “the dark”).
[6] Matt Apuzzo, Should the Authorities Be Able to Access Your iPhone?, N.Y. Times (Feb. 17, 2016), http://www.nytimes.com/2016/02/18/us/politics/whether-phones-should-lock-out-the-fbi.html?ref=technology&_r=1 [https://perma.cc/36YD-7G2Y].
[7] Since October of 2015, Apple has received federal orders to unlock at least twelve devices. With the amount of smartphones in use today, it is inevitable that these requests will only continue. Bill Chappell, Apple Has Gotten Federal Orders to Help Unlock at Least 13 Devices, NPR (Feb. 24, 2016, 12:15 PM), http://www.npr.org/sections/thetwo-way/2016/02/24/467943526/apple-has-gotten-federal-orders-to-unlock-at-least-13-devices [https://perma.cc/89RV-BER5].
[8] In re Search of an Apple Iphone Seized During Execution of a Search Warrant on a Black Lexus IS300, Cal. License Plate 35KGD203, No. ED 15-0451M, 2016 WL 618401 (C.D. Cal. Feb. 16, 2016).
[9] In re Order Requiring Apple, Inc. to Assist in the Execution of a Search Warrant Issued by this Court, No. 15-MC-1902(JO), 2016 WL 783565 (E.D.N.Y. Feb. 29, 2016).
[10] Apple’s Motion Opposing the iPhone Order, N.Y. Times (Feb. 25, 2016), http://www.nytimes.com/interactive/2016/02/25/technology/document-apple-motion-opposing-iphone-order.html [https://perma.cc/T72N-YMXA].
[11] 28 U.S.C. § 1651(a) (2015).
[12] In re Order Requiring Apple, Inc. to Assist in the Execution of a Search Warrant Issued by this Court, No. 15-MC-1902(JO), 2016 WL 783565, at *6 (E.D.N.Y. Feb. 29, 2016).
[13] See United States v. N.Y. Tel. Co., 434 U.S. 159, 174–78 (1977).
[14] Pa. Bureau of Corr. v. U.S. Marshals Serv., 474 U.S. 34, 43 (1985).
[15] H.R. Rep. No. 103-827, pt. 1, at 9 (1994).
[16] In re Apple, Inc., 2016 WL 783565, at *18.
[17] Id. at *16.
[18] 47 U.S.C. § 1002(b) (2015).
[19] Id. § 1001(6).
[20] Id.
[21] In re Apple, Inc., 2016 WL 783565, at *11.
[22] Id.
[23] The court looked at 18 U.S.C. § 2703(f)(1), which requires certain communication and computing services to preserve records. Id.
[24] Id. at *6.
[25] Id. at *8.
[26] Id.
[27] TRW Inc. v. Andrews, 534 U.S. 19, 31 (2001).
[28] In re Apple, Inc., 2016 WL 783565, at *12.
[29] Id. at *16 (reviewing In re Order Requiring Apple, Inc. to Assist in the Execution of a Search Warrant Issued by this Court, No. 1:15-mc-01902-JO, 2015 WL 5920207, at *2–3 (E.D.N.Y. Oct. 9, 2015)).
[30] Id. at *11.
[31] See id. at *14.
[32] See generally Berkman Ctr. for Internet & Soc’y, supra note 1, at 5–9.