Apple and ‘Assistance Orders’ in Canada
- November 8, 2015
- Clayton Rice, K.C.
In my last post titled Apple And The ‘All Writs Act’ dated November 2, 2015, I discussed an application before Magistrate Judge James Orenstein of the United States District Court, Eastern District of New York, in In Re Order Requiring Apple, Inc. To Assist In the Execution Of A Search Warrant Issued By This Court, 15 Misc. 1902-JO (2015) (“Re Order Apple, Inc.”). The government had brought an application for an order under the All Writs Act 28 USC s. 1651 directing Apple, Inc. (“Apple”) to assist in the execution of a federal search warrant by disabling the security of an iPhone that had been seized pursuant to a warrant issued by the court.
In the penultimate paragraph of my last post, I said that I was unaware of any application by a law enforcement agency in Canada for a judicial order compelling the assistance of a manufacturer to unlock a device as occurred in Re Order Apple, Inc. That was not to say that none existed. I just didn’t know about any. Well, I do now.
On November 3, 2015, I was contacted by Riana Pfefferkorn who is a Cryptography Fellow with the Center for Internet and Society at Stanford Law School (@Riana_Crypto). As a result of my discussions with Ms. Pfefferkorn, I learned about Apple’s involvement in a Canadian investigation in Toronto that is strikingly similar to the application before Judge Orenstein in New York. Let’s begin with s. 487.02 of the Criminal Code that governs assistance orders in Canada:
“487.02 If an authorization is given under section 184.2, 184,3, 186 or 188 or a warrant is issued under this Act, the judge or justice who gives the authorization or issues the warrant may order a person to provide assistance, if the person’s assistance may reasonably be considered to be required to give effect to the authorization or warrant.”
The authorizations specified in s. 487.02, in addition to warrants under the Code, are: a wiretap authorization [s. 186], an emergency wiretap authorization [s. 188(1)], a one party consent wiretap authorization (e.g, body pack) [s. 184.2(1)(3)], and a telephone application for a wiretap authorization for a period up to 36 hours [s. 184.3(6)].
Now, let’s get to the story.
On April 3, 2014, the Canadian Broadcasting Corporation (“CBC”) published an article titled Rob Ford crack video: Death threats revealed in police wiretaps. This story was part of the media coverage surrounding the infamous video purportedly showing former Toronto Mayor Rob Ford smoking a crack pipe. The story’s lead off was: “The hunt for a video of Toronto Mayor Rob Ford smoking crack cocaine prompted death threats from Ford’s friend Alexander Lisi, according to police documents, with Lisi apparently acting as the mayor’s muscle around the Dixon Road community to suppress incriminating footage. A publication ban on the latest information to obtain (ITO) documents was lifted by a judge on Thursday. They were used by police to apply for warrants in the…surveillance operation on Lisi and Ford.”
The events dated back to October 1, 2013, when Lisi was arrested and charged with drug possession and trafficking under the Controlled Drugs and Substances Act. On October 9, 2013, the Toronto police obtained a warrant to search Lisi’s iPhone that had been seized. They were on a hunt for text messages between Lisi and phone numbers associated with Ford as well as photographs and videos. But the phone was locked and password protected. The police then applied for an assistance order that was granted by Justice David P. Cole of the Ontario Court of Justice on October 21, 2013. The investigation remained active until October 31, 2013, when Lisi was arrested again and charged with extortion. The Assistance Order and the Information to Obtain a search warrant became available to the media when Justice Cole lifted a publication ban on April 3, 2014. The material parts of the Order are:
“IT IS ORDERED that pursuant to Section 487.02 of the Criminal Code, it is hereby ordered that Apple Canada Inc. assist law enforcement agents [sic] conduct the search of one Apple iOS device, Model #A1387, on the Rogers Communication [sic] Incorporated network with access number (phone number)…serial number…and FCC ID#…It is hereby further ordered that Apple shall provide reasonable technical assistance to enable law enforcement agents to obtain access to unencrypted data (“Data”) on the Device.
It is further ordered that, to the extent that data on the iOS device is encrypted, Apple may provide a copy of the encrypted data to law enforcement but Apple is not required to attempt to decrypt, or otherwise enable law enforcement’s attempts to access any encrypted data. Apple’s reasonable technical assistance may include, but is not limited to, bypassing the iOS Device’s [sic] user’s passcode so that the agents may search the device, extracting data from the Device and copying the data onto an external hard drive or other storage medium that law enforcement agents may search, or otherwise circumventing the Devices’s security systems to allow law enforcement access to Data and to provide law enforcement with a copy of encrypted data stored on the iOS Device. Although Apple shall make reasonable efforts to maintain the integrity of data on the Device, Apple shall not be required to maintain copies of any user data as a result of the assistance ordered herein; all evidence preservation shall remain the responsibility of law enforcement agents.”
The intriguing aspect is that the Assistance Order granted by Justice Cole of the Ontario court is virtually identical (all but word for word) to the proposed Order that was presented to Judge Orenstein of the New York court by the United States Attorney. Rather than describe the minor variations in wording, I will reproduce that proposed Order with the inconsequential differences bolded:
“FURTHER ORDERED that Apple shall provide reasonable technical assistance to enable law enforcement agents to obtain access to unencrypted data (“Data”) on the iOS Device;
FURTHER ORDERED that, to the extent that data on the iOS Device is encrypted, Apple may provide a copy of the encrypted data to law enforcement, but Apple is not required to attempt to decrypt, or otherwise enable law enforcement’s attempts to access any encrypted data;
FURTHER ORDERED that Apple’s reasonable technical assistance may include, but is not limited to, bypassing the iOS Device user’s passcode so that the agents may search the iOS Device, extracting data from the iOS Device and copying the data onto an external hard drive or other storage medium that law enforcement agents may search, or otherwise circumventing the iOS Device’s security systems to allow law enforcement access to Data and to provide law enforcement with a copy of encrypted data stored on the iOS device;
FURTHER ORDERED that although Apple shall make reasonable efforts to maintain the integrity of data on the iOS Device, Apple shall not be required to maintain copies of any user data as a result of the assistance ordered herein; all evidence preservation shall remain the responsibility of law enforcement agents.”
The Assistance Order issued by Justice Cole, the Warrant to Search, extracts from the Information to Obtain and Appendices in the Lisi investigation are attached to the CBC article that I referenced. Ms. Pfefferkorn also steered me to the proposed Order before Judge Orenstein in Re Order Apple, Inc., described as Exhibit A, that can be found here: ia601501.us.archive.org/27/items/gov.u…
The inference I draw is that Apple (Apple’s lawyers) was consulted at the drafting stage prior to the applications before the courts. This would benefit Apple by having orders obtained that it can live with technologically and in the context of its privacy relationship with its customers. It benefits both Apple and prosecutors by minimizing protracted court proceedings where a manufacturer has the right to be heard on the issue of burdensomeness under the All Writs Act. I mentioned in my last post that the issue of burdensomeness has not arisen in Canadian law although Justice Thomas Cromwell hinted at the question of inconvenience in his dissenting opinion in R v Telus Communications Co., [2013] 2 SCR 3, at para. 126. It appears that, if the issue does arise, a Canadian court will likely follow the lead of US federal jurisprudence.
There is also good reason for cross-border consistency between Canada and the United States, as well as internationally, regarding the position Apple takes in its privacy policy. After all, Apple CEO Tim Cook has been a strong advocate of privacy as a fundamental human right. In my last post on the All Writs Act I referenced Apple’s written response in Re Order Apple Inc. where it asserted that forcing it to extract data could threaten the trust between Apple and its customers. Public sensitivity to digital privacy and security is at an unprecedented level. Certainly, the language adopted in both the Ontario and New York Orders limits Apple’s role to that of providing reasonable technical assistance to enable law enforcement agents to obtain access to unencrypted data. Apple is not required to attempt to decrypt data or enable law enforcement’s attempt to access encrypted data. That burden, and the preservation of seized data, remain on the investigating police agency.