FBI Does Not Have to Disclose Details of Hacking Tool Used on Terrorist’s Phone, Court Rules

https://www.forensicmag.com/news/2017/10/fbi-does-not-have-disclose-details-hacking-tool-used-terrorists-phone-court-rules?et_cid=6118339&et_rid=454841023&location=top&et_cid=6118339&et_rid=454841023&linkid=https%3a%2f%2fwww.forensicmag.com%2fnews%2f2017%2f10%2ffbi-does-not-have-disclose-details-hacking-tool-used-terrorists-phone-court-rules%3fet_cid%3d6118339%26et_rid%3d%%subscriberid%%%26location%3dtop

A D.C. district court has ruled that the FBI does not have to the reveal further details about the tool it purchased from a third party vendor to unlock the phone of San Bernardino shooter Syed Farook, technology news outlet ZDNet reports. Three news agencies—the Associated Press, USA Today and Vice Media—filed Freedom of Information Act requests asking for the name of vendor and the price paid for the tool, but U.S. District Judge Tanya S. Chutkan ruled that these two pieces of information could remain secret under a number of FOIA exemptions.

“(…) the FBI notes that because the vendor’s networks are not as sophisticated as the FBI’s cyber-security facilities, releasing the name of the vendor could subject the vendor to attacks by entities who wish to exploit the technology,” reads the ruling, which was made available by ZDNet’s Zack Whittaker. The court determined that the vulnerability of the vendor to cyberattackers looking to use the tool for malicious purposes constituted a threat to national security (Exemption 1 of the FOIA).

The court also denied the FOIA requests under Exemption 3, ruling that the vendor constituted a protected intelligence source, and Exemption 7(E), ruling that the hacking tool could be used for law enforcement purposes and that revealing its source could compromise future law enforcement activities.

The plaintiffs in the case attempted to argue that, because Sen. Dianne Feinstein and former FBI Director James Comey had already made public comments about the tool and its price, no additional threat would arise from the FBI fully disclosing the information. But the court disagreed, saying disclosing the vendor’s name and the price could hurt the FBI’s ability to further develop the tool and possibly re-employ the vendor in the future.

This case arose following the FBI’s announcement in March 2016 that it had unlocked Farook’s iPhone 5c without help from iPhone manufacturer Apple, with whom it had been fighting a legal battle demanding help unlocking the device. (Farook was one of two shooters who killed 14 people in a terrorist attack in San Bernardino, California in December 2015. Both attackers were killed in a shootout with police following the attack.)

The FBI released 100 pages of documents in response to FOIA requests by the three plaintiffs, according to the Associated Press, but these documents were “heavily censored” and did not reveal the vendor’s name and the price of the tool used, causing the plaintiffs to further press the FBI for these details.

Feinstein and Comey both made public statements regarding the price—Comey said during a security conference in 2016 that the price was “more than I will make in the remainder of this job—which is seven years and four months,” which would have been over $1.34 million, according to ZDNet, while Feinstein said during an open Senate Judiciary Committee hearing that the price was about $900,000.

The news agencies will not be able to appeal the decision, according to ZDNet.

In a separate case in March 2017, a court ruled that the FBI would be required to reveal the software code they used to track users of a dark web child pornography site in order to go ahead with the prosecution of Jay Michaud, a teacher accused of downloading child porn from the site. This prompted the FBI to drop all charges against Michaud in order to avoid disclosing the code.