1 2 3 4 5 DURIE TANGRI LLP MARK A. LEMLEY (SBN 155830) mlemley@durietangri.com MICHAEL A. FELDMAN (SBN 295780) mfeldman@durietangri.com 217 Leidesdorff Street San Francisco, CA 94111 Telephone: 415-362-6666 Facsimile: 415-236-6300 AMY L. LANDERS (SBN 169491) all328@drexel.edu 7 Professor of Law Drexel University Thomas R. Kline School of Law 8 3200 Market Street Philadelphia, PA 19104 9 Telephone: 215-571-4795 6 10 11 Attorneys for Amicus Curiae Law Professors 12 IN THE UNITED STATES DISTRICT COURT 13 FOR THE CENTRAL DISTRICT OF CALIFORNIA 14 EASTERN DIVISION IN THE MATTER OF THE SEARCH OF AN APPLE IPHONE SEIZED DURING 16 THE EXECUTION OF A SEARCH WARRANT ON A BLACK LEXUS IS300, 17 CALIFORNIA LICENSE PLATE 35KGD203. AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE, INC. 19 Date: March 22, 2016 Time: 1:00 p.m. Ctrm: 3 or 4 - 3rd Floor Judge: Honorable Sheri Pym 15 18 20 Case No. 5:16-cm-00010-SP 21 22 23 24 25 26 27 28 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP TABLE OF CONTENTS 1 Page 2 3 I.  INTRODUCTION ..................................................................................................... 1  4 II.  THIS COURT LACKS JURISDICTION TO ISSUE AND ENFORCE THE APPLE ORDER......................................................................................................... 3  III.  NEITHER THE DEPARTMENT OF JUSTICE NOR THE COURTS HAVE YET AFFORDED APPLE DUE PROCESS OF LAW ............................................ 4  5 6 7 A.  Apple’s Interests at Stake in this Case are Critical ......................................... 6  8 B.  A More Formalized Procedure to Consider Apple’s Perspective is Likely to Avoid Arbitrary or Erroneous Decisions ......................................... 6  C.  The Government Has No Substantial Countervailing Interest in Expediency ...................................................................................................... 8  9 10 11 IV.  THE FIRST CONGRESS INTENDED THE ALL WRITS ACT TO BE MORE LIMITED THAN THE GOVERNMENT NOW SUGGESTS .................... 8  V.  14 THE GOVERNMENT CANNOT USE THE ALL WRITS ACT TO REWRITE STATUTORY AUTHORITY CONTROLLING THE GOVERNMENT’S ACCESS TO ELECTRONICALLY STORED INFORMATION ..................................................................................................... 10  15 A.  CALEA Specifies Who Must Assist Law Enforcement in Obtaining Electronic Information and What Assistance They Must Provide—and Specifically Excludes Decryption ................................................................. 13  B.  ECPA Specifies Who Must Assist Law Enforcement in Obtaining Electronic Information and What Assistance They Must Provide—and Specifically Excludes Encrypted Information .............................................. 16  12 13 16 17 18 19 20 VI.  THE GOVERNMENT’S DEMAND WOULD IMPOSE AN UNREASONABLE BURDEN ON BOTH APPLE AND ITS USERS ................. 17  21 VII.  NEITHER NEW YORK TELEPHONE NOR THE OTHER CASES THE GOVERNMENT CITES CAN SUPPORT THE APPLE ORDER ........................ 20  22 VIII.  CONCLUSION........................................................................................................ 25  23 24 25 26 27 28 i AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP TABLE OF AUTHORITIES 1 Page(s) 2 3 Cases 4 Bd. of Regents of State Colls. v. Roth, 408 U.S. 564 (1972) ........................................................................................................ 5 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Carlisle v. United States, 517 U.S. 416 (1996) ...................................................................................................... 11 Clemons v. Mississippi, 494 U.S. 738 (1990) ........................................................................................................ 4 Crowley v. CyberSource Corp., 166 F. Supp. 2d 1263 (N.D. Cal. 2001) ........................................................................ 17 Garcia v. City of Laredo, 702 F.3d 788 (5th Cir. 2012) ........................................................................................ 16 Greene v. McElroy, 360 U.S. 474 (1959) ........................................................................................................ 5 Hilderman v. Enea TekSci, Inc., 551 F. Supp. 2d 1183 (S.D. Cal. 2008) ........................................................................ 16 In re Application of the U.S. for an Order (1) Authorizing the Use of a Pen Register & Trap & Trace Device, 396 F. Supp. 2d 294 (E.D.N.Y. 2005) .............................................................. 12, 17, 18 In re Application of U.S. for an Order Authorizing an In-Progress Trace of Wire Commc’ns Over Tel. Facilities, 616 F.2d 1122 (9th Cir. 1980) ...................................................................................... 23 In re Application of U.S. for an Order Authorizing Disclosure of Location Info. of a Specified Wireless Tel., 849 F. Supp. 2d 526 (D. Md. 2011) .................................................................. 10, 12, 18 In re Application of U.S. for an Order Directing X to Provide Access to Videotapes, No. 03-89, 2003 WL 22053105 (D. Md. Aug. 22, 2003) ............................................. 23 In re iPhone Application Litig., 844 F. Supp. 2d 1040 (N.D. Cal. 2012) ........................................................................ 17 24 In re Order Requiring Apple, Inc. to Assist in the Execution of a Search Warrant Issued by this Court, 25 No. 1:15-mc-01902-JO, 2015 WL 5920207 (E.D.N.Y. Oct. 9, 2015) ............... 5, 12, 21 26 27 In re U.S. for an Order Authorizing Installation & Use of a Pen Register, 415 F. Supp. 2d 211 (W.D.N.Y. 2006) ......................................................................... 12 28 ii AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 TABLE OF AUTHORITIES (Cont’d) Page(s) 2 3 In re U.S. for an Order Authorizing the Roving Interception of Oral Commc’ns, 4 349 F.3d 1132 (9th Cir. 2003) .................................................................... 10, 13, 17, 24 5 In re U.S. For an Order Directing a Provider of Commc’n Servs. to Provide Tech. Assistance to Agents of the U.S. Drug Enf’t Admin., 6 --- F. Supp. 3d ---, No. 15-1242 (M), 2015 WL 5233551 (D.P.R. Aug. 27, 2015) ......................................................................................................................... 4, 23 7 8 In re XXX, Inc., No. 14 Mag. 2258, 2014 WL 5510865 (S.D.N.Y. Oct. 31, 2014) ................................. 5 9 In the Matter of Commc’ns Assistance for Law Enf’t Act & Broadband Access & Servs., 10 20 F.C.C. Rcd. 14989 (2005), on reconsideration in part, 21 F.C.C. Rcd. 5360 (2006) ................................................................................................................... 15 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 Mathews v. Eldridge, 424 U.S. 319 (1976) ........................................................................................................ 5 McIntire v. Wood, 11 U.S. 504 (1813) ........................................................................................................ 10 Michigan Bell Tel. Co. v. United States, 565 F.2d 385 (6th Cir. 1977) ........................................................................................ 23 Mullane v. Cent. Hanover Bank & Tr. Co., 339 U.S. 306 (1950) ........................................................................................................ 4 Pa. Bureau of Corr. v. U.S. Marshals Serv., 474 U.S. 34 (1985) ........................................................................................................ 10 Plum Creek Lumber Co. v. Hutton, 608 F.2d 1283 (9th Cir. 1979) ................................................................................ 10, 23 Riley v. California, 134 S. Ct. 2473 (2014) .................................................................................................. 22 Rock v. Arkansas, 483 U.S. 44 (1987) .......................................................................................................... 4 Ruckelshaus v. Monsanto Co., 467 U.S. 986 (1984) ........................................................................................................ 5 Skinner v. Ry. Labor Execs.’ Ass’n, 489 U.S. 602 (1989) ...................................................................................................... 24 Smith v. Jackson, 22 F. Cas. 575 (C.C.N.D.N.Y. 1825)............................................................................ 10 28 iii AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP TABLE OF AUTHORITIES (Cont’d) 1 Page(s) 2 3 4 5 6 7 Syngenta Crop Prot. v. Henson, 537 U.S. 28 (2002) .......................................................................................................... 4 United States v. Hall, 583 F. Supp. 717 (E.D. Va. 1984) ................................................................................ 23 United States v. New York Tel. Co., 434 U.S. 159 (1977) .................................................................................... 17, 20, 21, 22 8 United States v. Zavalidroga, 2 F. App’x 787 (9th Cir. 2001) ..................................................................................... 10 9 Statutes 10 18 U.S.C. §§ 2701–2719 ............................................................................................. passim 11 28 U.S.C. § 1651 ......................................................................................................... passim 12 28 U.S.C. § 2243 ................................................................................................................ 11 13 47 U.S.C. § 1001 ......................................................................................................... passim 14 47 U.S.C. § 1002 ......................................................................................................... passim 15 Other Authorities 16 16B Charles Alan Wright & Arthur R. Miller, Federal Practice and Procedure § 4005 (3d ed. 2015).................................................. 4 17 18 19 20 21 22 Charles Warren, New Light on the History of the Federal Judiciary Act of 1789, 37 Harv. L. Rev. 49 (1923) ............................................................................................. 9 David F. Epstein, The Political Theory of The Federalist, 197–98 (2008) ................................................. 9 David Gray & Danielle Citron, The Right to Quantitative Privacy, 98 Minn. L. Rev. 62 (2013) .................................. 24 Deirdre K. Mulligan, Reasonable Expectations in Electronic Communications: A Critical Perspective on the Electronic Communications Privacy Act, 24 72 Geo. Wash. L. Rev. 1557 (2004) ............................................................................. 16 23 25 Gen. Michael Hayden Gives an Update on the Cyberwar, Wall St. J. (Feb. 9, 2016), http://www.wsj.com/articles/gen-michael26 hayden-gives-an-update-on-the-cyberwar-1455076153............................................... 19 27 28 iv AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP TABLE OF AUTHORITIES (Cont’d) 1 Page(s) 2 3 H. Abelson et al., Keys under doormats: mandating insecurity by requiring government 4 access to all data and communications, Journal of Cybersecurity, 1–11 (2015) ......................................................................... 18 5 6 7 8 9 10 H.R. Rep. No. 103-827 (1994) ........................................................................................... 15 Henry J. Bourguignon, The Federal Key to the Judiciary Act of 1789, 46 S.C. L. Rev. 647 (1995) ........................................................................................... 10 Lonny Sheinkopf Hoffman, Removal Jurisdiction and the All Writs Act, 148 U. Pa. L. Rev. 401 (1999) ........................................................................................ 9 Mike McConnell et al., Why the fear over ubiquitous data encryption is overblown, Wash. Post (July 28, 2015), https://www.washingtonpost.com/opinions/the-need-for12 ubiquitous-data-encryption/2015/07/28/3d145952-324e-11e5-83531215475949f4_story.html ............................................................................................. 20 11 13 14 15 Orin S. Kerr, A User’s Guide to the Stored Communications Act, and a Legislator’s Guide to Amending It, 72 Geo. Wash. L. Rev. 1208 (2004) ........................................ 16 Paul Taylor, Congress’s Power to Regulate the Federal Judiciary: What the First Congress and the First Federal Courts Can Teach Today’s Congress and Courts, 17 37 Pepp. L. Rev. 847 (2010) ........................................................................................... 9 16 18 19 20 21 22 23 24 25 Priscilla M. Regan, Legislating Privacy: Technology, Social Values and Public Policy (1995) ............... 16 Susan Landau, Surveillance Or Security?: The Risks Posed by New Wiretapping Technologies (2010) ..................................................................................................... 19 William N. Eskridge, Jr., All About Words: Early Understandings of the “Judicial Power” in Statutory Interpretation, 1776–1806, 101 Colum. L. Rev. 990 (2001) ......................... 9 Rules Fed. R. Crim. Proc. 41 ......................................................................................................... 4 26 27 28 v AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 INTEREST OF AMICI 2 Amici are law professors at schools throughout the United States. We have no 3 personal interest in the outcome of this case, but a professional interest in seeing that the 4 law develops to encourage creativity and innovation, and to advance the public interest. 5 No one other than the undersigned wrote or funded any portion of this brief. Institutional 6 affiliations are given for identification purposes only. 7 I. The government has gone to great lengths to sidestep due process in its effort to 8 9 INTRODUCTION avoid judicial scrutiny of the merits of its case. And for good reason: its case lacks merit. The Department of Justice and the FBI demand that Apple dedicate its employees 10 11 and hundreds of hours of employee time to develop software that provides a way to break 12 into iPhones. That software does not currently exist. In fact, Apple specifically chose not 13 to create it in the course of its business. The government now claims it can conscript 14 Apple to create software Apple does not want to create and then force Apple to assist the 15 government in using that software. The record demonstrates that government access 16 requests will not stop with this single device.1 Although the government admits it had the time to—and, in fact, did—first 17 18 approach Apple informally instead of going directly to the courts, and although the 19 government presents no plausible reason for needing an immediate answer now, the DOJ 20 and FBI filed their demand ex parte, depriving this Court of the benefit of Apple’s 21 perspective. Moreover the government acknowledges that the motion to compel was not 22 23 24 1 Declaration of Nicolat Hanna in Support of Apple Inc.’s Motion to Vacate Order Compelling Apple, Inc. to Assist Agents in Search and Opposition to Government’s 26 Motion To Compel Assistance (“Hanna Decl.”) ¶ 5 & Ex. C, In the Matter of the Search of an Apple iPhone Seized During the Execution of a Search Warrant on a Black Lexus 27 IS300, California License Plate 35KGD203, No. 5:16-cm-00010-SP (“Case No. 16-10”) (C.D. Cal. Feb. 25, 2016), ECF Nos. 16-1 & 16-4. 25 28 1 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 necessary.2 The government’s actions cloud the legal and factual landscape. Once the fog lifts, 2 3 it is clear that multiple laws, constitutional provisions, and judicial doctrines prohibit 4 precisely what the government demands. Compelling a private company to create 5 technology with features that the firm deliberately chose to exclude is an unprecedented 6 expansion of judicial power that Congress did not support by passing the All Writs Act. First, there is a jurisdictional problem. There is no basis in the record for this Court 7 8 to assert Article III jurisdiction to issue or enforce the February 16, 2016 Order (“the 9 Apple Order”). The search warrant’s authority is already exhausted and the government’s 10 motion to compel recognizes that CALEA (“Communications Assistance for Law 11 Enforcement Act”) does not provide sufficient authority to support the Apple Order. 12 Rather, the government’s request rests solely on the All Writs Act. However, the All 13 Writs Act is not an original source of federal jurisdiction and cannot support the 14 government’s motion or this Court’s order. The All Writs Act merely provides a source 15 of residual authority where such jurisdiction independently exists. Second, the underlying Order is invalid because it deprives Apple of liberty and 16 17 property without due process of law. The government initially took the time to seek 18 Apple’s help outside the judicial process. Only after Apple declined did the government 19 file its ex parte application, which did not allow Apple an opportunity to respond. Even 20 though Apple has now had an opportunity to respond to the government’s motion to 21 compel, the underlying Apple Order itself was issued in violation of due process and must 22 be vacated. 23 /// 24 2 The government acknowledges that “a separate order compelling Apple’s compliance with this Court’s February 16, 2016, order is not legally necessary . . . ,” suggesting that it 25 filed “this noticed motion to provide Apple with the due process and adversarial testing it 26 seeks.” Case No. 16-10 (C.D. Cal. Feb. 19, 2016), ECF No. 1 (Gov’t’s Mot. to Compel Apple Inc. to Comply with This Court’s Feb. 16, 2016 Order Compelling Assistance in 27 Search) at 3 n.3. However, as discussed below, Apple must be afforded the opportunity to challenge the merits of the Apple Order itself, not merely the motion to compel. 28 2 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP Third, CALEA and ECPA (“Electronic Communications Privacy Act”) govern the 1 2 substantive validity of the Order and set out telecommunications carriers’ obligations to 3 assist law enforcement. Significantly, when Congress enacted CALEA, it exempted 4 “information services,” which includes certain services that Apple provides, from that 5 requirement. The Supreme Court has instructed that where a statutory scheme governs a 6 particular subject matter, the All Writs Act’s residual power does not. Finally, no court has ever issued a valid order that imposes an equivalent burden on 7 8 a non-party. Our research has not found any case that uses the All Writs Act to require a 9 third-party private entity to design and create new software. Some courts have compelled 10 disclosure of already-existing information in cases where the All Writs Act is found 11 applicable. In contrast, the order the government demands in this case would require 12 substantial expenditures of time and talent above and beyond what is appropriate under 13 the All Writs Act. This point is particularly alarming where Apple has made a deliberate 14 decision to exclude the features that the government now demands. The issues in this case—particularly those concerning the All Writs Act—raise 15 16 important concerns for privacy interests globally and the security of the technical 17 infrastructure on which many in this country depend. The order the government demands 18 here threatens to give the government de facto control over the course of technical 19 innovation, favoring police access to evidence over the security of our technical 20 infrastructure as well as individual privacy. 21 II. 22 23 THIS COURT LACKS JURISDICTION TO ISSUE AND ENFORCE THE APPLE ORDER The government is proceeding in this Court on the basis of a search warrant that 24 Magistrate Judge David Bristow issued on December 3, 2015. See Declaration of 25 Christopher Pluhar ¶ 5 & Ex. 1, In the Matter of the Search of an Apple iPhone Seized 26 During the Execution of a Search Warrant on a Black Lexus IS300, California License 27 Plate 35KGD203, No. 15-0451-M (“Case No. 15-451”) (C.D. Cal. Feb. 16, 2016), ECF 28 No. 16. The search warrant allows law enforcement to search a Black Lexus IS300 and to 3 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 seize certain items, including “digital device[s]” and evidence about those digital devices. 2 The FBI searched the car and found the iPhone that is at issue here. The government now 3 has that phone and may search it consistent with the limitations imposed by the December 4 3, 2015 warrant. With that, the warrant’s authority is exhausted. The government concedes that neither CALEA nor Federal Rule of Criminal 5 6 Procedure 41 provides authority to require Apple to create software to access data now 7 stored on the device. See Case No. 16-10, ECF No. 1 at 22. Instead, the government’s 8 request rests solely on the All Writs Act. Id. However, the All Writs Act cannot support 9 the government’s motion or this Court’s order. 10 The All Writs Act provides a source of residual authority to federal courts “in aid of 11 their respective jurisdictions” where such jurisdiction independently exists. See 28 U.S.C. 12 § 1651(a). A court must have Article III jurisdiction before it can issue an extraordinary 13 writ. 16B Charles Alan Wright & Arthur R. Miller, Federal Practice and Procedure § 14 4005 (3d ed. 2015). By itself, the All Writs Act is incapable of serving as an original 15 source of federal jurisdiction. See Syngenta Crop Prot. v. Henson, 537 U.S. 28, 33 16 (2002). Therefore, this district court lacks jurisdiction to issue and enforce the Apple 17 Order. See In re U.S. For an Order Directing a Provider of Commc’n Servs. to Provide 18 Tech. Assistance to Agents of the U.S. Drug Enf’t Admin., --- F. Supp. 3d ---, No. 15-1242 19 (M), 2015 WL 5233551, at *5 (D.P.R. Aug. 27, 2015). Because this Court lacks Article 20 III jurisdiction to issue or enforce the Apple Order, it should vacate the order. 21 III. 22 23 NEITHER THE DEPARTMENT OF JUSTICE NOR THE COURTS HAVE YET AFFORDED APPLE DUE PROCESS OF LAW The right to be heard is fundamental to due process of law in an adversary system 24 in both criminal and civil contexts. See Clemons v. Mississippi, 494 U.S. 738, 769 (1990) 25 (quoting Rock v. Arkansas, 483 U.S. 44, 51 & n.9 (1987)); Mullane v. Cent. Hanover 26 Bank & Tr. Co., 339 U.S. 306, 314 (1950). The adversary system relies on the 27 opportunity for both sides to offer their perspectives so that the Court may have a full 28 understanding before it issues a ruling. Yet the government filed its All Writs Act 4 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 application ex parte, requiring this Court to make a decision based on a skewed and 2 incomplete understanding of the facts and legal landscape. Due process requires more. The Fifth Amendment is clear that “No person shall be . . . deprived of life, liberty, 3 4 or property, without due process of law.” Courts have consistently applied Fifth 5 Amendment due process protections to the All Writs Act, including similar cases 6 involving Apple. See, e.g., In re Order Requiring Apple, Inc. to Assist in the Execution of 7 a Search Warrant Issued by this Court, No. 1:15-mc-01902-JO, 2015 WL 5920207, at *7 8 (E.D.N.Y. Oct. 9, 2015) (“[C]ourts have held that due process requires that a third party 9 subject to an order under the All Writs Act be afforded a hearing on the issue of 10 burdensomeness prior to compelling it to provide assistance to the Government.”) 11 (quoting In re XXX, Inc., No. 14 Mag. 2258, 2014 WL 5510865, at *2 (S.D.N.Y. Oct. 31, 12 2014)) (emphasis added). In this case, the government seeks to deprive Apple of both 13 property3 and liberty.4 To determine whether due process was adequate to support this 14 deprivation, courts consider three factors: (1) the importance of the individual’s interest at 15 stake, (2) the likelihood that more formalized procedures would avoid arbitrary or 16 erroneous decisions by the government, and (3) the countervailing government interest 17 (such as the efficiency of government administrative agencies. Mathews v. Eldridge, 424 18 U.S. 319, 335 (1976). In this case, each of these factors weighs against the government’s 19 demand. 20 21 22 23 24 25 26 27 3 The government demands that Apple develop new software that would be protected both as a trade secret, see Ruckelshaus v. Monsanto Co., 467 U.S. 986, 1002 (1984) (finding that trade secrets are property rights subject to constitutional protections, such as the takings clause), and as copyrighted software, see 3 Patry on Copyright § 9:240 n.2 (“Computer programs are, of course, generally classified as ‘literary works’ [under the Copyright Act].”). 4 Apple has a liberty interest in operating its company as it chooses to. Cf. Greene v. McElroy, 360 U.S. 474, 492 (1959) (finding that “the right to hold specific private employment and to follow a chosen profession free from unreasonable governmental interference” is a liberty interest protected by the Due Process Clause); Bd. of Regents of State Colls. v. Roth, 408 U.S. 564, 572 (1972) (holding that liberty “denotes not merely freedom from bodily restraint but also the right of the individual to contract, to engage in any of the common occupations of life, [and] to acquire useful knowledge” among other rights). 28 5 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 A. Apple’s Interests at Stake in this Case are Critical 2 Apple has made a conscious decision as part of the operation of its business to build 3 in an iPhone Unique ID that is necessary to decrypt the data on the phone and which 4 Apple itself does not know. See Case No. 16-10 (C.D. Cal. Feb. 25, 2016), ECF No. 16 5 (Apple’s Mot. To Vacate) at 5–7, 23. The government’s demand would interfere with a 6 private company’s decisions about which software and security it will develop and which 7 it will not. Apple’s business is developing technology—both physical and intellectual 8 property. Whether the government can dictate the technology Apple must develop and 9 force Apple to turn that technology over to the government is a vitally important interest. B. 10 11 A More Formalized Procedure to Consider Apple’s Perspective is Likely to Avoid Arbitrary or Erroneous Decisions This Court, and courts addressing similar issues in the future, are likely to reach 12 13 arbitrary or erroneous decisions without a formalized process for Apple—or another 14 future company—to be heard. Because this Court issued its February 16, 2016 order 15 without the benefit of a hearing or briefing from Apple, it made its decision on incomplete 16 and misleading information. For instance, the government represented in its ex parte application that it was not 17 18 asking to place an “unreasonable burden” on Apple because “while the order . . . requires 19 Apple to provide modified software . . . it is not an unreasonable burden for a company 20 that writes software code as part of its regular business.” See Case No. 15-451 (C.D. Cal. 21 Feb. 16, 2016), ECF No. 18 at 14–16. This proves too much. By this same logic, it 22 would not be unreasonably burdensome to demand that Boeing build a custom jet for the 23 government because Boeing builds planes as part of its regular business or to demand that 24 a pharmaceutical company make drugs for executions after it has made the intentional 25 decision not to. With the benefit of Apple’s briefing, the Court can consider Apple’s 26 perspective on the burden of developing, testing, implementing, and protecting custom 27 code for this investigation. See Case No. 16-10, ECF No. 16 at 23–30. 28 /// 6 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 Apple’s perspective is also critical to the security of consumers using Apple 2 devices. The government demanded that this Court order Apple to develop software 3 without allowing Apple the opportunity to explain the risks involved in the way the 4 government wants Apple to develop its software. Allowing the government to dictate 5 how Apple develops software can create very real privacy and security risks for Apple 6 users. Computer scientists have shown that grave risks arise from requiring the 7 introduction of insecure software. See H. Abelson et al., Keys under doormats: 8 mandating insecurity by requiring government access to all data and communications, J. 9 of Cybersecurity, 69–79 (2015). Apple is better suited than the government to address 10 potential privacy and security problems in development of its own software. It is therefore 11 critical that Apple have the opportunity to address these considerations to the Court before 12 it issues an order. 13 The government also represented that new Apple software is “necessary” to collect 14 data from the iPhone. See Case No. 15-451, ECF No. 18 at 16–17. However, with the 15 benefit of Apple’s briefing, the Court learned that the FBI created this situation. Case No. 16 16-10, ECF No. 16 at 11. As Apple explains in its motion to vacate, the iPhone might 17 have been able to initiate an automatic iCloud backup, allowing the FBI access to the 18 information it wants. See id. at 29–30. However, the FBI changed the iCloud password on 19 the account associated with the iPhone without consulting Apple, making it impossible to 20 trigger the automatic backup. See id. 21 Finally, the government’s application for the Apple Order makes no mention of 22 CALEA or ECPA despite the fact that these statues govern this precise issue: the scope of 23 responsibilities for a third party to provide assistance to law enforcement in obtaining 24 electronic communications evidence. Without Apple’s brief, the Court did not have the 25 opportunity to consider the limitations of CALEA, which “does not authorize any law 26 enforcement agency or officer . . . to require any specific design of equipment, facilities, 27 services, features . . . .” 47 U.S.C. § 1002(b)(1)(A). CALEA is directly relevant to the 28 question whether the order the government demands is “agreeable to the usages and 7 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 principles of law.” 28 U.S.C. § 1651(a). These facts and legal background are vital to a Court’s reasoned decision. Without 2 3 them, the Court risks arbitrary or erroneous decisions. 4 C. 5 The Government Has No Substantial Countervailing Interest in Expediency The government cannot show any compelling interest in expediency. Ex parte 6 7 proceedings were not necessary because the government had time to ask Apple to assist 8 voluntarily, as the government itself admits. See Case No. 15-451, ECF No. 18 at 16–17. 9 If the government had time to ask Apple to assist voluntarily before demanding Court 10 intervention, the Court had time to consider Apple’s position before issuing its order. * 11 * * The government’s ex parte motion and this Court’s order deprived Apple of its 12 13 liberty and property without due process of law. Apple was entitled to a hearing and 14 opportunity to be heard before this Court issued an order conscripting its services in 15 support of law enforcement. It is not enough that Apple now has the opportunity to 16 challenge the government’s motion to compel. The Apple Order itself issued without 17 affording Apple an opportunity to be heard and therefore suffers from the errors and 18 arbitrariness discussed above in Section III(B). Even if the Court denies the government’s 19 motion to compel, the Apple Order would still stand and might be considered 20 precedential. Thus, the Court should vacate the underlying Apple Order because it issued 21 in violation of due process. 22 IV. 23 THE FIRST CONGRESS INTENDED THE ALL WRITS ACT TO BE MORE LIMITED THAN THE GOVERNMENT NOW SUGGESTS The All Writs Act, 28 U.S.C. § 1651 (a), provides that the federal courts “may issue 24 25 all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to 26 the usages and principles of law.” The All Writs Act derives from the Judiciary Act of 27 1789, enacted by the country’s first Congress in order to create the federal court system. 28 /// 8 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 The context of this enactment is critical to understanding the present dispute. 2 Congress tasked the federal courts with a significant role that was, nonetheless, 3 constrained. See Paul Taylor, Congress’s Power to Regulate the Federal Judiciary: What 4 the First Congress and the First Federal Courts Can Teach Today’s Congress and 5 Courts, 37 Pepp. L. Rev. 847, 857 (2010). When the first Judiciary Act was promulgated, 6 state courts already existed. Yet the Federal system was found to be necessary to, among 7 other things, protect the population’s liberty interests “from hasty or undue encroachment 8 by the federal government.” William N. Eskridge, Jr., All About Words: Early 9 Understandings of the “Judicial Power” in Statutory Interpretation, 1776–1806, 101 10 11 Colum. L. Rev. 990, 1055 (2001). The first Congress did not contemplate that the federal courts would be empowered 12 to exercise independent law-making authority. As Alexander Hamilton articulated, the 13 courts “may truly be said to have neither force nor will, but merely judgment.” The 14 Federalist No. 78 (Alexander Hamilton) (Jacob E. Cooke ed., 1961); see also David F. 15 Epstein, The Political Theory of The Federalist (2008). The All Writs Act was not 16 intended to provide the courts with law-making power. 17 A review of the historical scholarship demonstrates that writ authority was a 18 comparatively inconspicuous addition to the federal court system. The first Congress 19 extensively deliberated several other aspects of the first Judiciary Act. See generally, 20 Charles Warren, New Light on the History of the Federal Judiciary Act of 1789, 37 Harv. 21 L. Rev. 49, 95 (1923). Yet there is virtually no evidence of debate about the All Writs 22 Act. Id. at 49; Lonny Sheinkopf Hoffman, Removal Jurisdiction and the All Writs Act, 23 148 U. Pa. L. Rev. 401, 435–36 (1999). The statute’s language, considered in association 24 with the lack of any significant discussion on this point, demonstrates that the drafters 25 intended to grant the federal courts only limited authority. Id. (stating “the notion that a 26 federal court, once created, would be vested with writ power to aid its existing jurisdiction 27 would have been considered unremarkable”). The statute ensured that the federal system 28 was authorized to issue writs sufficient to preserve its own jurisdiction, which is 9 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 consistent with the understanding and experiences of the drafters in the courts of the day. 2 See Henry J. Bourguignon, The Federal Key to the Judiciary Act of 1789, 46 S.C. L. Rev. 3 647, 672 (1995). Early judicial interpretations confirm the understanding that the All 4 Writs Act did not confer the courts with plenary power to issue orders. See McIntire v. 5 Wood, 11 U.S. 504, 505–06 (1813) (the courts’ power to issue writs “is confined 6 exclusively to those cases in which it may be necessary to the exercise of their 7 jurisdiction”); Smith v. Jackson, 22 F. Cas. 575 (C.C.N.D.N.Y. 1825). The Supreme Court’s more recent interpretations continue to view the All Writs 8 9 Act, 28 U.S.C. § 1651(a), as only “a residual source of authority.” United States v. 10 Zavalidroga, 2 F. App’x 787, 788 (9th Cir. 2001) (citing Pa. Bureau of Corr. v. U.S. 11 Marshals Serv., 474 U.S. 34, 43 (1985)). Today, courts are clear that the All Writs Act 12 “does not give the district court a roving commission” to enlist third parties into law 13 enforcement. Plum Creek Lumber Co. v. Hutton, 608 F.2d 1283, 1289 (9th Cir. 1979). 14 Rather, as the Ninth Circuit recognizes, the All Writs Act applies where there is an 15 unmistakable “gap to fill” in a congressional statutory regime. In re U.S. for an Order 16 Authorizing the Roving Interception of Oral Commc’ns, 349 F.3d 1132, 1145 & n.26 (9th 17 Cir. 2003). Courts consistently reject efforts like this one to use the All Writs Act to “issue 18 19 supplemental orders to effectuate valid orders or warrants [that] constitute an additional 20 invasion of privacy.” In re Application of U.S. for an Order Authorizing Disclosure of 21 Location Info. of a Specified Wireless Tel., 849 F. Supp. 2d 526, 579 (D. Md. 2011). The 22 historical interpretation of the All Writs Act is irreconcilably inconsistent with the 23 position the government puts forward today. 24 V. 25 26 27 28 THE GOVERNMENT CANNOT USE THE ALL WRITS ACT TO REWRITE STATUTORY AUTHORITY CONTROLLING THE GOVERNMENT’S ACCESS TO ELECTRONICALLY STORED INFORMATION Today, although the All Writs Act facilitates extraordinary remedies under very particular circumstances, the section incorporates fundamental limitations that are 10 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 consistent with the Judiciary Act’s original purpose. Specifically, the Act is considered a 2 “residual source of authority to issue writs that are not otherwise covered by statute.” 3 Pennsylvania Bureau, 474 U.S. at 43. Although the All Writs Act empowers federal 4 courts to issue certain types of remedies, “it does not authorize them to issue ad hoc writs 5 whenever compliance with statutory procedures appears inconvenient or less appropriate.” 6 Id. Therefore, “[w]here a statute specifically addresses the particular issue at hand, it is 7 that authority, and not the All Writs Act, that is controlling.” Id.; Carlisle v. United 8 States, 517 U.S. 416, 429 (1996) (same); Plum Creek, 608 F.2d at 1289. The analysis 9 must proceed under the relevant statute and not the All Writs Act. See In re U.S. for an 10 Order Authorizing the Roving Interception of Oral Commc’ns, 349 F.3d at 1145 & n.26. 11 Pennsylvania Bureau illustrates the operation of this principle. In Pennsylvania 12 Bureau, the Court considered district court orders that required U.S. Marshals to transport 13 state prisoners to the federal trial courts to provide testimony. 474 U.S. at 35. The Court 14 recognized that a statute, 28 U.S.C. § 2243, required prisoner transport by the “custodian,” 15 meaning the state prisons. Id. at 39. The Court rejected the argument that the All Writs 16 Act allowed the district court to engage in “‘creative’ use of federal judicial resources to 17 alleviate the drain on States’ fisc” in light of the statute. Id. at 40. Holding that the All 18 Writs Act could not support such an order, the Court recognized that the statute “expressly 19 commands the custodian to bring his prisoner to the court, but extends this duty to no 20 other.” Id. at 39. 21 Here, the government has attempted to sidestep this crucial limitation. Specifically, 22 the government argues that because there is no statute precluding it from forcing Apple to 23 create government-specific software, it can demand the software under the All Writs Act 24 instead. That is not—and cannot be—the test. The All Writs Act “does not authorize 25 [federal courts] to issue ad hoc writs.” See id. at 43. Indeed, just this week, Judge 26 Orenstein rejected the government’s argument in another case where the government 27 28 11 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 sought to force Apple to bypass the passcode on an Apple device.5 Judge Orenstein held 2 that “the established rules for interpreting a statute’s text constrain me to reject the 3 government’s interpretation that the AWA empowers a court to grant any relief not 4 outright prohibited by law.” Id. Other rulings have reached this same conclusion in analogous contexts.6 Most 5 6 notably, In re Application of the U.S. for an Order (1) Authorizing the Use of a Pen 7 Register & Trap & Trace Device, 396 F. Supp. 2d 294 (E.D.N.Y. 2005) rejected the 8 government’s argument that the All Writs Act empowers a court to require a cell phone 9 provider to furnish the government with a suspect’s location. Observing that Congress 10 had enacted two statutes, ECPA and CALEA, to govern this subject matter, the court 11 explained: 12 The government thus asks me to read into the All Writs Act an empowerment of the judiciary to grant the executive branch authority to use investigative techniques either explicitly denied it by the legislative branch, or at a minimum omitted from a far-reaching and detailed statutory scheme that has received the legislature’s intensive and repeated consideration. Such a broad reading of the statute invites an exercise of judicial activism that is breathtaking in its scope and fundamentally inconsistent with my understanding of the extent of my authority. 13 14 15 16 17 Id. at 326. Here, two statutes, CALEA, 47 U.S.C. § 1001 et seq., and ECPA, 18 U.S.C. §§ 18 19 2701–2719, already provide extensive rules that govern access to electronically 20 communicated and stored information. For decades, Congress has responded to new 21 technology and new threats to privacy and public safety with a network of carefully 22 23 24 25 26 27 5 In re Order Requiring Apple, Inc. To Assist in the Execution of a Search Warrant Issued by This Court, No. 1:15-mc-01902-JO (E.D.N.Y. Feb. 29, 2016), ECF No. 29 at 1. 6 See In re Application of U.S. for an Order Authorizing Disclosure of Location Info. of a Specified Wireless Tel., 849 F. Supp. 2d at 580 (“the All Writs Act cannot be used to circumvent the safeguards set in place by existing law”); In re U.S. for an Order Authorizing Installation & Use of a Pen Register, 415 F. Supp. 2d 211, 219 (W.D.N.Y. 2006) (same); In re Application of U.S. for an Order Authorizing Disclosure of Location Info. of a Specified Wireless Tel., 849 F. Supp. 2d at 583 (“The government simply cannot use the All Writs Act to circumvent the requirements of the Fourth Amendment and other statutes that already occupy the space.”). 28 12 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 drafted statutes. CALEA and ECPA outline a complex regime controlling the 2 government’s power to access electronically stored and communicated information held 3 by a range of service providers, including detailed provisions prescribing the entities on 4 which design requirements can be imposed, and the physical and semantic boundaries that 5 limit such assistance. These statutes “cover the field.” Courts should not disrupt the 6 careful balance that Congress has struck after years of hearings, study, and experience. 7 The Ninth Circuit limits the All Writs Act to authorize court orders where there is 8 some “gap to fill” due to Congress’s failure to consider an area of law. In re U.S. for an 9 Order Authorizing Roving Interception of Oral Commc’ns, 349 F.3d at 1145 & n.26. 10 Here, there are no gaps. Indeed, there are few areas of law in which Congress has 11 provided more legislative guidance than the search and surveillance of electronically 12 stored and communicated information—as well as the assistance third parties must 13 provide law enforcement in obtaining this information. 14 Requiring Apple to redesign the iPhone operating system pursuant to an order 15 issued under the All Writs Act to disable security features that prevent guessing or 16 hacking the passcode reflects a profound disruption of Congress’s carefully crafted 17 regime. Such a mandate will have costs not just for Apple, but also for security and 18 privacy globally. Because Congress can best weigh these difficult social issues, it is 19 Congress’s role to answer the contentious, difficult question of when manufacturers must 20 redesign their products to undermine their own privacy protections. That decision should 21 be left to the legislative power in Congress, not the courts’ judicial power under the All 22 Writs Act. 23 A. 24 CALEA Specifies Who Must Assist Law Enforcement in Obtaining Electronic Information and What Assistance They Must Provide—and Specifically Excludes Decryption 25 In the area of protection of electronically communicated and stored information— 26 and government’s power to compel third parties to assist in collecting that information, 27 Congress left no gaps. CALEA has been amended once and produced 850 pages of 28 legislative history as well as a plethora of regulatory interpretations by the Federal 13 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 Communications Commission. See, e.g., Communications Assistance for Law 2 Enforcement Act, Report and Order, FCC 99-11 (Mar. 15, 1999); Communications 3 Assistance for Law Enforcement Act, Order on Reconsideration, FCC 97-213 (Aug. 2, 4 1999); Communications Assistance for Law Enforcement Act, Second Report and Order, 5 FCC 97-213 (Jan. 29, 1999). 6 CALEA provides a detailed statutory scheme that specifies which kinds of 7 companies must assist the government in its surveillance orders and what assistance those 8 companies must provide. Congress specifically excluded from its regulatory ambit firms 9 such as Apple, decryption obligations (except in limited circumstances not present here), 10 11 and, above all, design mandates. First, CALEA explicitly states that it does not require telecommunication carriers to 12 redesign their system configurations, stating that it “does not authorize any law 13 enforcement agency or officer . . . to require any specific design of equipment, facilities, 14 services, features, or system configurations to be adopted by . . . any manufacturer of 15 telecommunications equipment, or . . . to prohibit the adoption of any equipment, facility, 16 service, or feature by . . . any manufacturer of telecommunications equipment.” 47 U.S.C. 17 § 1002(b)(1). 18 Second, in defining those types of firms subject to assist law enforcement, Congress 19 decided that only “telecommunications carriers” would be obligated to make sure that 20 their “equipment, facilities, or services” allow the government to intercept 21 communications pursuant to a court order or other lawful authorization. Id. CALEA 22 defines “telecommunications carrier” as an “entity engaged in the transmission or 23 switching of wire or electronic communications as a common carrier for hire.” 47 U.S.C. 24 § 1001(8)(A). Apple is not a common carrier, i.e., a telephone company. 25 Rather, the Apple functionality at issue in this case would be classified under 26 CALEA as an “information service,” which is defined as “the offering of a capability for 27 generating, acquiring, storing, transforming, processing, retrieving, utilizing, or making 28 available information via telecommunications.” 47 U.S.C. § 1001(6). CALEA explicitly 14 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 “does not include persons or entities insofar as they are engaged in providing information 2 services.” 47 U.S.C. § 1001(8)(C)(i). 3 Third, Congress balanced privacy, security, and law enforcement needs by 4 explicitly excluding from its obligations the duty to “decryp[t], or ensur[e] the 5 government’s ability to decrypt, any communication encrypted by a subscriber or 6 customer, unless the encryption was provided by the carrier and the carrier possesses the 7 information necessary to decrypt the communication.” 47 U.S.C. § 1002(b)(3). 8 9 Finally, CALEA has set forth a procedure for expanding its coverage—which the government should first make use of. Section 1001(8)(B)(ii) states that the Federal 10 Communications Commission can pull under its regulatory authority not simply providers 11 of “wire or electronic communication” but also a “person or entity engaged in providing 12 wire or electronic communication switching or transmission service to the extent that the 13 Commission finds that such service is a replacement for a substantial portion of the local 14 telephone exchange service.” To the extent that law enforcement is seeking, for example, 15 email or iMessage content from the iPhone in question, this provision provides a way for 16 the FBI to go to the Commission to seek an extension of Apple’s CALEA obligations. 17 Indeed, the government already has done so, obtaining FCC authority to monitor VoIP 18 and other internet-based communications. In the Matter of Commc’ns Assistance for Law 19 Enf’t Act & Broadband Access & Servs., 20 F.C.C. Rcd. 14989, 14989 (2005), on 20 reconsideration in part, 21 F.C.C. Rcd. 5360 (2006). 21 CALEA legislative history also shows Congress’s decision to exclude Apple from 22 any decryption requirements. Congress intended that collection and surveillance of 23 electronic information should extend only to telecommunication providers, i.e., telephone 24 companies. “The only entities required to comply with the functional requirements are 25 telecommunications common carriers, the components of the public switched network 26 where law enforcement agencies have always served most of their surveillance orders.” 27 H.R. Rep. No. 103-827, pt. 1, at 18 (1994). Similarly, Congress did not intend CALEA to 28 force firms to maintain an “encryption service for which [a carrier] does not retain the 15 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 2 3 4 ability to decrypt communications for law enforcement access.” See also id. at 24. B. ECPA Specifies Who Must Assist Law Enforcement in Obtaining Electronic Information and What Assistance They Must Provide—and Specifically Excludes Encrypted Information ECPA sets forth a comprehensive set of rules that specifies the power of 5 government to access stored electronic communications. It was the product of detailed 6 study, robust debate, and compromise among competing interests. See Deirdre K. 7 Mulligan, Reasonable Expectations in Electronic Communications: A Critical Perspective 8 on the Electronic Communications Privacy Act, 72 Geo. Wash. L. Rev. 1557 (2004) 9 (discussing background court disputes, Office of Technology Assessment Reports, 10 congressional hearings, etc.); see also Priscilla M. Regan, Legislating Privacy: 11 Technology, Social Values and Public Policy 131 (1995) (discussing the formation of the 12 Privacy and Technology Project of the ACLU and extensive consultations between 13 privacy groups, technology experts, business groups, and congressional staff). ECPA’s 14 rules reflect Congress’s balance between privacy and the needs of law enforcement, 15 requiring certain types of firms to provide access to records that they store or possess. 16 These rules refrain from requiring firms such as Apple from developing new technologies 17 to undermine its own consumer privacy protections or to assist government in decryption. 18 Under ECPA, Apple must assist the government in obtaining records related to the 19 iPhone stored on Apple’s servers. Presumably, it has already provided access and 20 assistance to the government with respect to information it possesses. See Orin S. Kerr, A 21 User’s Guide to the Stored Communications Act, and a Legislator’s Guide to Amending 22 It, 72 Geo. Wash. L. Rev. 1208, 1209–13 (2004). However, ECPA obligations only 23 extend to records that are, in fact, stored by an electronic communication service provider 24 or remote computing service provider. ECPA excludes from this obligation “information 25 that an individual stores to his hard drive or cell phone [because it] is not in electronic 26 storage under the statute.” Garcia v. City of Laredo, 702 F.3d 788, 793 (5th Cir. 2012). 27 See also Hilderman v. Enea TekSci, Inc., 551 F. Supp. 2d 1183, 1205 (S.D. Cal. 2008) 28 (“E-mails stored on the laptop computer are not” subject to ECPA); In re iPhone 16 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 Application Litig., 844 F. Supp. 2d 1040, 1057–58 (N.D. Cal. 2012) (iPhones “d[id] not 2 constitute ‘facilit[ies] through which an electronic communication service is provided’” 3 and thus ECPA does not cover them); see also Crowley v. CyberSource Corp., 166 F. 4 Supp. 2d 1263, 1271 (N.D. Cal. 2001) (“[Argument that] computers of users of electronic 5 communication service, as opposed to providers of electronic communication service 6 [conceivably subject to ECPA] [be] considered facilities through which such service is 7 provided. . . . [is] destined to failure[.]”). ECPA places significant duties on Apple to assist law enforcement, but the 8 9 government seeks more than ECPA permits. The government reads the All Writs Act “to 10 grant the executive branch authority to use investigative techniques either explicitly 11 denied it by the legislative branch, or at a minimum omitted from a far-reaching and 12 detailed statutory scheme that has received the legislature’s intensive and repeated 13 consideration.” In re Application of the U.S. for an Order (1) Authorizing the Use of a 14 Pen Register & a Trap & Trace Device, 396 F. Supp. 2d at 326. * 15 * * 16 Congress, through the democratic process, has weighed and balanced these difficult 17 concerns and created a comprehensive statutory regime, consisting in CALEA and ECPA. 18 That regime—not the All Writs Act—should control. 19 VI. 20 21 THE GOVERNMENT’S DEMAND WOULD IMPOSE AN UNREASONABLE BURDEN ON BOTH APPLE AND ITS USERS The All Writs Act “may not impose an undue burden on a company enlisted to aid 22 the government.” In re U.S. for an Order Authorizing Roving Interception of Oral 23 Commc’ns, 349 F.3d at 1148 (citing United States v. New York Tel. Co., 434 U.S. 159, 24 172 (1977)). Nor may the All Writs Act create “disruption to [a third party’s business] 25 operations.” In re U.S. for an Order Authorizing Roving Interception of Oral Commc’ns, 26 349 F.3d at 1145. No court has ever looked to the All Writs Act to require a private 27 corporation to develop new, costly technology that creates serious financial burdens, 28 radically disrupts its business plan and disrupts its consumers’ long-held privacy and 17 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 security expectations. Courts have resisted the government’s attempts to use the All Writs 2 Act to collect data using newer, more intrusive technologies. For instance, courts have 3 rejected its use to obtain the real-time acquisition of prospective cell site information 4 absent probable cause, concluding that such reliance “invites an exercise of judicial 5 activism that is breathtaking in its scope and fundamentally inconsistent with . . . the 6 extent of [judicial] authority.” In re Application of the U.S. for an Order (1) Authorizing 7 the Use of a Pen Register & a Trap & Trace Device, 396 F. Supp. 2d at 326; see also In 8 re Application of U.S. for an Order Authorizing Disclosure of Location Info. of a 9 Specified Wireless Tel., 849 F. Supp. 2d at 578 (“The government [seeks] . . . precise [cell 10 phone] location information under the All Writs Act. This may be the most troubling 11 position the government has taken in pursuit of this precise location data”) (internal 12 citations omitted). 13 Congress’s restraint in dictating design features stems from the risks such 14 requirements pose not just to individual privacy, but to security in general. Such 15 requirements threaten the security of information held by individuals, private firms and 16 corporations, and, indeed, by our own local, state, and federal government, many of whom 17 use iPhones to protect confidential information. 18 Adding custom mechanisms for law enforcement to access software systems, even 19 if they are not, strictly speaking, ‘back doors’, creates a variety of technical risks to the 20 security of the overall system. In particular, building the new features required by the 21 Apple Order has uncertain consequences for the security of Apple’s iOS environment 22 overall. If Apple writes the code and gives it to the FBI to use, some or all of the code 23 may fall into malicious hands. Whereas, if the code is executed within Apple’s secure 24 facilities, the connection between the FBI and Apple could become a target for attack. H. 25 Abelson et al., Keys under doormats: mandating insecurity by requiring government 26 access to all data and communications, Journal of Cybersecurity, 1–11 (2015). A 27 thorough analysis of these risks would depend on the precise implementation approach 28 chosen by Apple, but it is not clear how this Court could monitor the security exposure 18 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 2 created by the system as it operates. Indeed, government’s investigatory tools can be and have been misused. See Susan 3 Landau, Surveillance Or Security?: The Risks Posed by New Wiretapping Technologies 4 (2010). Security experts understand that the use of product update channels, to undermine 5 device security in support of government access poses a serious security threat for three 6 related reasons: 7 First, establishing a general practice of signing code—whose purpose is unrelated 8 to the product’s function and only for the benefit of law enforcement—will provide a 9 vector for attacking cell phones. Requiring new updates pushed by law enforcement will 10 put new pressure on the update cycle and risk diverting developers’ attention from the 11 core security of the product. 12 Second, software updates are essential to maintaining the security of devices and 13 networks as new threats emerge. Their utility depends upon consumer trust that the 14 software delivered improves their product. The use of update channels to open up 15 vulnerabilities in response to law enforcement requests will undermine trust in updates. 16 Finally, orders to disable aspects of a cryptographic implementation, signal to the 17 industry that investments in robust security may be ill-advised and costly, as they will 18 require countless hours to redesign after the government comes knocking. Apple may 19 have the resources to continue deploying strong encryption, but other companies with 20 fewer resources may be incentivized to build systems ready-made for government access. 21 Yet a technical vulnerability designed to ease law enforcement access also lets in anyone 22 who can find it. 23 The delicate policy choices at issue are underscored by the number of former 24 National Security, Intelligence, and Defense officials who have come out in support of 25 robust “end-to-end unbreakable encryption” (Gen. Michael Hayden Gives an Update on 26 the Cyberwar, Wall St. J. (Feb. 9, 2016), http://www.wsj.com/articles/gen-michael- 27 hayden-gives-an-update-on-the-cyberwar-1455076153), because “the greater public good 28 is a secure communications infrastructure protected by ubiquitous encryption at the 19 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 device, server and enterprise level without building in means for government monitoring.” 2 Mike McConnell et al., Why the fear over ubiquitous data encryption is overblown, Wash. 3 Post (July 28, 2015), https://www.washingtonpost.com/opinions/the-need-for-ubiquitous- 4 data-encryption/2015/07/28/3d145952-324e-11e5-8353-1215475949f4_story.html. 5 Moreover, an additional set of third parties also risk facing burdens in this case: 6 users of Apple products. Users may be at additional security risk as a result of the 7 proliferation or mistaken use of the software being created under the Apple Order. Of 8 course both Apple and the FBI will take care to avoid misuse of the software created here, 9 but we have no means within this proceeding of carefully evaluating these burdens. In the 10 meantime, users will have reason to wonder whether either Apple or the FBI has 11 introduced vulnerabilities into the iOS environment. 12 The government’s requested order here raises the question how the court should 13 evaluate the cost of mandating security design not simply to Apple—but upon society 14 and, indeed, the entire global economy. The fact that All Writs Act jurisprudence offers 15 no guidance on this question strongly suggests that the court has entered territory much 16 better suited for the democratic policymaking process of a legislature. 17 VII. NEITHER NEW YORK TELEPHONE NOR THE OTHER CASES THE GOVERNMENT CITES CAN SUPPORT THE APPLE ORDER 18 19 In the government’s motion to compel and its underlying application for the Apple 20 Order, the government relies heavily on New York Telephone. 434 U.S. at 174–75. 21 However, that case cannot support the weight the government puts on it. 22 New York Telephone recognized that the order at issue in that case posed essentially 23 no burden on the telephone company’s ongoing operations. Id. (“Certainly the use of pen 24 registers is by no means offensive to it. The Company concedes that it regularly employs 25 such devices without court order for the purposes of checking billing operations, detecting 26 fraud, and preventing violations of law.”). In contrast, there is every indication that the 27 Apple Order represents a significant outlay of time, expense, and risk to Apple. Cf. In re 28 Order Requiring Apple, Inc. to Assist in the Execution of a Search Warrant Issued by this 20 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 Court, 2015 WL 5920207, at *5 (“there is nothing in the record to suggest that Apple has 2 or wants the ability to defeat customer-installed security codes to access the encrypted 3 data that its customers store on Apple devices after purchasing them.”); id., Case No. 15- 4 1902 (E.D.N.Y. Feb. 29, 2016), ECF No. 29 at 38–44 (finding that requiring Apple to 5 bypass an iPhone passcode would place an unreasonable burden on Apple including 6 reputational harm, financial harm, burdens on Apple’s ability to compete in the market, 7 and a burden on Apple’s ability, as a private entity, to avoid doing what it finds to be 8 offensive). Apple has submitted evidence that the creation, design, validation and deployment 9 10 of the software necessary to comply with the Apple Order would take six to ten 11 experienced Apple engineers and employees dedicating a substantial period of time for a 12 minimum of two weeks.7 Additionally, such deployment must occur at a secure, isolated 13 facility to minimize the probability of a security leak.8 Beyond this, to prevent the 14 possibility that the code might get into the wrong hands and/or to accommodate additional 15 government requests, Apple must maintain and house the government-specific operating 16 system by taking the same levels of precautions needed to protect Apple’s most sensitive 17 trade secrets.9 The Apple Order requires Apple to violate design decisions that it made 18 intentionally to secure the device.10 Under these circumstances, New York Telephone 19 cannot support the Apple Order. The burdens imposed on Apple—and the risks to the public’s safety and privacy— 20 21 22 23 24 25 26 27 are unlike other orders issued under the All Writs Act authority. The implications of 7 Decl. of Erik Neuenschwander in Supp. of Apple Inc.’s Mot. to Vacate Order Compelling Apple, Inc. to Assist Agents in Search and Opp’n to Gov’t’s Mot. to Compel Assistance (“Neuenschwander Decl.”) ¶ 22, Case No. 16-10 (C.D. Cal. Feb. 25, 2016), ECF No. 16-33. 8 Id. ¶¶ 36–37. 9 Id. ¶¶ 47–49. See also Decl. of Lisa Olle in Supp. of Apple Inc.’s Mot. to Vacate Order Compelling Apple, Inc. to Assist Agents in Search and Opp’n to Gov’t’s Mot. to Compel Assistance ¶¶ 13–14, Case No. 16-10 (C.D. Cal. Feb. 25, 2016), ECF No. 16-32. 10 Neuenschwander Decl. ¶¶ 50–53. 28 21 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 disrupting the existing encryption system on iPhones are profound. These devices “place 2 vast quantities of personal information literally in the hands of individuals.” Riley v. 3 California, 134 S. Ct. 2473, 2485 (2014). The software redesign the government 4 demands in this case is arguably more privacy invasive. See generally id. at 2488–89 5 (recognizing privacy interests in cell phone content). While the facts of this case mute the 6 privacy risks (the owner of the phone has consented, and the owner of the data is 7 deceased), the background statutory scheme that must inform the court’s use of the AWA 8 does not contemplate, nor authorize, device manufacturers to assist the government in 9 hacking lawfully purchased products to facilitate investigations. 10 Unlike the simple pen register at issue in New York Telephone, an iPhone facilitates 11 myriad capabilities that rely on the storage of images, texts, browsing history, calendars, 12 books, films, contact lists, banking information, and travel documentation. Using Apps or 13 a browser, cell phones provide access to data stored remotely. The information stored on 14 a device may concern the device’s owner, as well as the owner’s friends, family and 15 acquaintances. Although both cases concern phones, a pen register stores numbers dialed 16 from a particular phone line. In contrast, many cell phones “are in fact minicomputers 17 that also happen to have the capacity to be used as a telephone.” Riley, 134 S. Ct. at 2489. 18 Importantly, the Supreme Court only allowed the All Writs Act to include pen 19 registers because such expansion was acceptable under Congress’s existing electronic 20 privacy regime. “It is clear that Congress did not view pen registers as posing a threat to 21 privacy of the same dimension as the interception of oral communications and did not 22 intend to impose Title III restrictions upon their use.” New York Telephone, 434 U.S. at 23 168. Congress judged that the pen register’s privacy infringement was not that significant 24 and, therefore, made the decision not to regulate it. Here, however, Congress concluded 25 the opposite, finding that mandating particular designs constituted such a threat to privacy 26 and security that CALEA explicitly excludes it. See 47 U.S.C. § 1002(b). 27 28 As a private company, Apple is legally distinct from the public utility analyzed in New York Telephone. See, e.g., Michigan Bell Tel. Co. v. United States, 565 F.2d 385, 22 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 389 (6th Cir. 1977) (“It is to be emphasized that a telephone company is no ordinary third 2 party. It is a public utility, enjoying a monopoly in an essential area of 3 communications.”); In re Application of U.S. for an Order Authorizing an In-Progress 4 Trace of Wire Commc’ns Over Tel. Facilities, 616 F.2d 1122, 1129 (9th Cir. 1980) 5 (same). The government does not have the authority to conscript the services of a private 6 company like Apple as it does to conscript the services of a highly regulated public utility. 7 Case No. 15-1902 (C.D. Cal. Feb 29, 2016), ECF No. 29 at 31–32 (“[U]nlike the 8 telephone company—‘a highly regulated public utility with a duty to serve the public,’— 9 Apple is a private entity with no greater duty to serve the public than any other business.”) 10 (internal citation omitted). The other cases the government cites are readily distinguishable. In United States 11 12 v. Hall, 583 F. Supp. 717, 721 (E.D. Va. 1984), the credit card records were already 13 maintained by the company and could be generated by “punching a few buttons” and were 14 in the company’s possession. See also In re Application of U.S. for an Order Directing X 15 to Provide Access to Videotapes, No. 03-89, 2003 WL 22053105, at *3 (D. Md. Aug. 22, 16 2003) (“the only cooperation required by the apartment complex is merely to provide 17 access to surveillance tapes already in existence, rather than any substantive assistance, 18 and nothing more.”). The additional authority cited by the government acknowledges that 19 the All Writs Act “do[es] not provide authority for [the court] to enter the requested 20 order.” In re U.S. for an Order Directing a Provider of Commc’ns Servs. to Provide 21 Tech. Assistance to Agents of the U.S. Drug Enf’t Admin., 2015 WL 5233551, at *4 22 (relying on alternative authority). These cases underscore that the All Writs Act does not 23 support the burdensome and intrusive nature of the Apple Order. Cf. Plum Creek, 608 24 F.2d at 1290 (“This circuit has never held that the district court has such wide-ranging 25 inherent powers that it can impose a duty on a private party when Congress has failed to 26 impose one.”). 27 /// 28 /// 23 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP According to Apple, software on the iPhone that is the subject of the Apple Order 1 2 was designed to optimize security, a core attribute of its functionality.11 There may be 3 private information on any iPhone that is more extensive, personal, and all-encompassing 4 than almost any other owned object. It is a fair assumption that most cell phones also 5 include information about those with whom the owner has communicated. To ask Apple 6 to create code that unravels that security threatens harm to both Apple and the public 7 interest. Cf. In re U.S. for an Order Authorizing the Roving Interception of Oral 8 Commc’ns, 349 F.3d at 1145 (“The obligation of private citizens to assist law 9 enforcement, even if they are compensated for the immediate costs of doing so, has not 10 extended to circumstances in which there is a complete disruption of a service they offer 11 to a customer as part of their business . . . .”). This case raises important concerns for private enterprise, innovation, privacy, and 12 13 constitutional rights more broadly. If upheld, the Apple Order will convert Apple into a 14 state actor insofar as it will be compelled to participate in this search as an “agent or 15 instrument of the Government.” Skinner v. Ry. Labor Execs.’ Ass’n, 489 U.S. 602, 614– 16 15 (1989). To the extent these requests become routine, they raise concerns that 17 companies will be required to design their products to support governmental access going 18 forward. This would have the effect of giving the government de facto control over 19 technical design while also permanently converting Apple and other private companies 20 into state actors, subjecting them to a range of constitutional duties and restraints that 21 normally do not apply to private entities, including those imposed by the Fourth 22 Amendment. See David Gray & Danielle Citron, The Right to Quantitative Privacy, 98 23 Minn. L. Rev. 62, 135–36 (2013). This would have a host of consequences for 24 individuals’ rights to be secure against unreasonable searches, data security, and scientific 25 and technical advance more generally while also dramatically altering relationships 26 between technology companies and their consumers. As both a constitutional matter and 27 11 Hanna Decl. Ex. D, Case No. 16-10 (C.D. Cal. Feb. 25, 2016), ECF No. 16-5. 28 24 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP 1 a policy matter, allowing the federal government de facto control over the design of 2 technology is therefore an extraordinary remedy that requires careful consideration. 3 CALEA reflects a legislative view that this remedy is appropriate in a very narrow 4 circumstance. The All Writs Act by contrast does not reflect any legislative wisdom 5 suggesting that broader government control over technology companies, their products, 6 and their consumer market is appropriate or constitutional. 7 VIII. CONCLUSION 8 9 For the reasons described above, the Court should deny the government’s motion to compel and vacate its February 16, 2016 order. 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 25 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. 5:16-CM-00010-SP DURIE TANGRI LLP By: AW MARK A. LEMLEY Dated: March 3, 2016 Attorneys for Amicus Curiae Law Professors 26 AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE CASE NO. Janet Ainsworth John D. Eshelman Professor of Law Seattle University Jordan (Jody) M. Blanke Ernest L. Baskin, Jr. Distinguished Professor of Computer Information Systems and Law Stetson School of Business & Economics Mercer University Annemarie Bridy Professor, University of Idaho College of Law Dan L. Burk Chancellor's Professor of Law University of California, Irvine Adam Candeub Professor of Law, Director, IP, Information, and Communications Law Program Michigan State University College of Law Michael A. Carrier Distinguished Professor Rutgers Law School Megan M. Carpenter Professor of Law Co-Director, Center for Law and Intellectual Property (CLIP) Faculty Director, IP and Technology Law Clinic Faculty Director, Entrepreneurship Law Clinic Texas A&M University School of Law Anupam Chander Professor University of California, Davis, School of Law Andrew Chin Associate Professor University of North Carolina School of Law   A. Michael Froomkin Laurie Silvers & Mitchell Rubenstein Distinguished Professor of Law University of Miami David Gray University of Maryland Francis King Carey School of Law Woodrow Hartzog Associate Professor Samford University’s Cumberland School of Law Stephen E. Henderson Judge Haskell A. Holloman Professor of Law The University of Oklahoma Margot E. Kaminski Assistant Professor The Ohio State University Moritz College of Law Affiliated Fellow, Information Society Project at Yale Law School Raymond Ku Professor of Law Case Western Reserve University School of Law Mark A. Lemley William H. Neukom Professor, Stanford Law School Director, Stanford Program in Law, Science, and Technology Senior Fellow, Stanford Institute for Economic Policy Research partner, Durie Tangri LLP co-founder, Lex Machina Inc. Richard A. Leo, Ph.D., J.D. Hamill Family Professor of Law and Psychology University of San Francisco David S. Levine Visiting Research Collaborator, Center for Information Technology Policy, Princeton University; Associate Professor and Chair, Faculty Development, Elon University School of Law; Affiliate Scholar, Center for Internet and Society, Stanford Law School   Yvette Joy Liebesman Associate Professor of Law Saint Louis University School of Law Deirdre K. Mulligan Associate Professor of Law School of Information University of California at Berkeley Ira Steven Nathenson Professor of Law St. Thomas University School of Law Blake E. Reid Assistant Clinical Professor Colorado Law Neil Richards Professor of Law Washington University Jorge R. Roig Associate Professor of Law Charleston School of Law Ira Rubinstein Senior Fellow and Adjunct Professor Information Law Institute New York University School of Law Victoria Schwartz Associate Professor Pepperdine University School of Law Robert H. Sloan Professor and Department Head University of Illinois at Chicago Dept. of Computer Science   Stephen F. Smith Professor of Law University of Notre Dame Daniel J. Solove John Marshall Harlan Research Professor of Law George Washington University Law School Gerry Stegmaier George Mason University School of Law Daniel J. Weitzner Principal Research Scientist, MIT Computer Science and Artificial Intelligence Lab, Director, MIT Internet Policy Research Initiative Michael Zimmer, PhD Associate Professor and PhD Program Director, School of Information Studies Director, Center for Information Policy Research University of WisconsinMilwaukee   PROOF OF SERVICE I am a citizen of the United States and resident of the State of California. I am employed in San Francisco County, State of California, in the of?ce of a member of the bar of this Court, at whose direction the service was made. I am over the age of eighteen years, and not a party to the within action. My business address is 217 Leidesdorff Street, San Francisco, CA 94111. On March 3, 2016, I served the following documents in the manner described below: AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF APPLE, INC. (BY US. MAIL) I am personally and readily familiar with the business practice of Durie Tangri LLP for collection and processing of correspondence for mailing with the United States Postal Service, and I caused such envelope(s) with postage thereon fully prepaid to be placed in the United States Postal Service at San Francisco, California. (BY MESSENGER SERVICE) by consigning the document(s) to an authorized courier and/or process server for hand delivery on this date. (BY ACSIMILE) I am personally and readily familiar with the business practice of Durie Tangri LLP for collection and processing of document(s) to be transmitted by facsimile and I caused such document(s) on this date to be transmitted by facsimile to the of?ces of addressee(s) at the numbers listed below. (BY OVERNIGHT MAIL) I am personally and readily familiar with the business practice of Durie Tangri LLP for collection and processing of correspondence for overnight delivery, and I caused such document(s) described herein to be deposited for delivery to a facility regularly maintained by Federal Express for overnight delivery. BY ELECTRONIC SERVICE: By electronically mailing a true and correct copy through Durie Tangri?s electronic mail system from mfeldman@durietangri.com to the email addresses set forth below. [3 (BY PERSONAL DELIVERY) I caused such envelope to be delivered by hand to the of?ces of each addressee below. On the following part(ies) in this action: Eric David Vandevelde Gibson Dunn and Crutcher LLP 333 South Grand Avenue Los An eles, CA 90071 213229 186 Fax: 2132296186 Email: evandevelde@gibsondunn.com Attorneys for Respondent Apple Inc. 27 Theodore Boutrous, Jr. Gibson Dunn and Crutcher LLP 333 South Grand Avenue Los An eles, CA 900713197 213229 000 Faxz2132297520 Email: tboutrous@gibsondunn.com Attorneys for Respondent Apple Inc. AMICUS CURIAE BRIEF OF LAW PROFESSORS IN SUPPORT OF CASE NO. ALAN Jeffrey Landis Zwill en PLLC 1900 Street NW Suite 250 Washin on, DC 20036 202296 585 Fax: 2027065298 Ema11: Jeff@zwillgen.com Attorneys for Respondent Apple Inc. Nicola Hanna Gibson Dunn and Crutcher LLP 3161 Michelson Drive 12th Floor Irv1ne, CA 926124412 94945 13 800 Faxg9494514220. Ema11: nhanna@g1bsondunn.com Attorneys for Respondent Apple Inc. Allen Chiu AUSA Of?ce of US Attorney . Natlonal Security Sectlon . 312 North Street Sulte 1300 Los An eles, 90012 213894 435 Fax: 2138946436 Email: allen.chiu@usdoj. gov Attorneys for USA Theodore Olson Gibson Dunn and Crutcher LLP 1050 Connecticut Avenue NW Washin ton, DC 200365306 202955 668 Fax: 2025309575 Ema11: tolson@g1bsondunn.eom Attorneys for Respondent Apple Inc. Marc Zwillin er Zwill en PLL 1900 Street NW Suite 250 Washin ton DC 20036 202296 585 Fax12027065298 Email: marc@zwillgen.com Attorneys for Respondent Apple Inc. Trac Wilkison A Of?ce of US Attorney Chlef, ber and Intellectua Property Crimes ection 312 North Sprin Street 11th Floor Los An eles, 900124700 213894 622 Fax22138940141 Email: tracy.wilkison@usdoj. gov Attorneys for USA I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on March 3, 2016, at San Francisco, California. MICHAEL A. FELDMAN 28 AMICUS CURIAE BRIEF OF LAW PROF ESSORS IN SUPPORT OF CASE NO.