1 2 3 4 5 6 7 8 9 10 MAYER BROWN LLP JOHN NADOLENCO (SBN 181128) jnadolenco@mayerbrown.com 350 South Grand Avenue, 25th Floor Los Angeles, California 90071-1503 Telephone: (213) 229-9500 Facsimile: (213) 625-0248 ANDREW J. PINCUS (pro hac vice pending) apincus@mayerbrown.com TRAVIS CRUM (pro hac vice pending) tcrum@mayerbrown.com 1999 K Street, N.W. Washington D.C. 20006-1001 Telephone: (202) 263-3328 Facsimile: (202) 263-5328 Attorneys for Amici Curiae 11 12 13 UNITED STATES DISTRICT COURT 14 CENTRAL DISTRICT OF CALIFORNIA 15 16 17 18 19 20 21 22 23 24 25 26 27 28 IN THE MATTER OF THE SEARCH OF AN APPLE IPHONE SEIZED DURING THE EXECUTION OF A SEARCH WARRANT ON A BLACK LEXUS IS300, CALIFORNIA LICENSE PLATE 35KGD203 Case No. CM 16-10 (SP) Motion for Leave to File Memorandum of BSA The Software Alliance, the Consumer Technology Association, the Information Technology Industry Council, and TechNet As Amici Curiae In Support Of Apple’s Motion To Vacate And In Opposition To The Motion To Compel Assistance Hearing Date: March 22, 2016 Time: 1:00 p.m. Location: Courtroom of the Hon. Sheri Pym PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT 1 INTEREST OF AMICI CURIAE 2 Amici are associations whose members comprise all of the companies that are 3 leaders in the global technology industry. Because the Court’s decision in this case 4 could have significant effect on the security of the products created by amici’s 5 members, and on the development of new hardware and software products, amici 6 have a substantial interest in this proceeding. 7 BSA The Software Alliance is an association of the world’s leading software 8 and hardware technology companies. BSA promotes policies that foster innovation, 9 growth, and a competitive marketplace for commercial software and related 10 technologies. 11 The Consumer Technology Association (CTA), formerly Consumer 12 Electronics Association (CEA), is a trade association representing the $287 billion 13 U.S. consumer electronics industry. CTA also owns and produces CES—the world’s 14 gathering place for all who thrive on the business of consumer technology. 15 The Information Technology Industry Council (ITI) is the global voice of the 16 technology sector. As an advocacy and policy organization for the world’s leading 17 innovation companies, ITI navigates the relationships between policymakers, 18 companies, and non-governmental organizations, providing creative solutions that 19 advance the development and use of technology around the world. 20 TechNet is an association of chief executive officers and senior executives of 21 the Nation’s leading technology companies across the country. TechNet’s objective 22 is to promote the growth of the technology industry and to advance America’s global 23 leadership in innovation. Its members are in the fields of information technology, 24 biotechnology, clean technology, venture capital, e-commerce, and finance, and 25 represent more than two million employees. 26 INTRODUCTION AND SUMMARY OF THE ARGUMENT 27 28 1 PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT 1 This dispute between Apple and the United States arises in the context of a 2 horrific crime that all Americans, and people around the world, condemn. That 3 dispute implicates a number of vitally important policy interests: 4 Law enforcement and protection of Americans against terrorism; 5 Individuals’ right to keep secure against hackers and other bad actors their 6 most personal information and communications; 7 The scope of the government’s power to force a private party to act as an agent 8 of the government; and 9 The extent to which the government may, and should, prescribe product 10 design requirements for technology products. 11 FBI Director James Comey was not engaging in hyperbole when he described 12 harmonizing these vital interests as “the hardest question I’ve seen in government,” 13 requiring consideration of “who do we want to be as a country, and how do we want 14 to govern ourselves.” Brian Bennett, FBI Director Calls Apple Case ‘Hardest 15 Question’ 16 http://www.latimes.com/nation/la-na-intel-threats-20160225-story.html. In Government, L.A. Times (Feb. 25, 2016), 17 The All Writs Act does not give this Court the power to reconcile these 18 fundamental policy issues. When Congress enacted that statute in 1789 it neither 19 anticipated nor broadly authorized government conscription of private parties that 20 might be able to assist a government investigation—which is the essence of the 21 government’s position. 22 Moreover, the government’s interpretation of the statute effectively limits this 23 Court’s inquiry to law enforcement needs and dollars-and-cents economic burden, 24 and leaves no room for consideration of the other important interests at stake—such 25 as maintaining security of individuals’ most personal information, risk to a third 26 party’s business and reputation, potential damage to development of new technology 27 that would result from government-mandated design specifications, and whether in 28 our constitutional democracy specific congressional authorization should be 2 PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT 1 required before courts may determine on an ad hoc basis that a private individual or 2 company may be forced to assist in government investigations. The Court 3 accordingly should vacate the order on the ground that it exceeds the authority 4 conferred by the All Writs Act. 5 Controlling circuit precedent confirms that a company cannot be compelled 6 to develop a new product—here, new software that does not now exist—particularly 7 when it will create security risks for all users of the company’s products. The 8 government’s argument, moreover, has no limiting principle: any third party could 9 be conscripted to produce new software that would allow the government to breach 10 security measures. Congress could not have intended that result when it enacted the 11 All Writs Act in 1789—indeed, when Congress has authorized conscription of 12 unwilling private parties it has spoken clearly, and provided specific standards to 13 govern the imposition of such obligations. Finally, the predictable result of 14 upholding the government’s position will be to force companies to change the design 15 specifications they might otherwise utilize in response to the risk that they might be 16 subject to an order such as the one sought here. A decision with such significant 17 public policy consequences should be made by the People acting through the 18 political branches—not through the issuance of an order by this Court. 19 20 ARGUMENT 23 A Court May Invoke The All Writs Act To Compel A Third Party To Turn Over Or Provide Access To Existing Information The Third Party Possesses, But May Not Order A Third Party To Invent A New Product— Particularly When The Government’s Demand Would Create Security Risks And Effectively Dictate Product Design. 24 The general language of the All Writs Act “is not a grant of plenary power to 25 federal courts.” Plum Creek Lumber Co. v. Hutton, 608 F.2d 1283, 1289 (9th Cir. 21 22 26 27 28 3 PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT 1 1979).1 In the context here—requiring a third party to assist in a government 2 investigation—the Act has been invoked in three basic situations: 3 Requiring the third party to turn over information in its possession that the 4 government has a lawful right to obtain. See, e.g., United States v. Hall, 583 5 F. Supp. 717 (E.D. Va. 1984) (compelling credit card company to turn over 6 records in its possession); In re Application of United States for an Order 7 Directing X to Provide Access to Videotapes, No. 03-89, 2003 WL 22053105 8 (D. Md. Aug. 22, 2003) (unpublished) (directing landlord to turn over security 9 footage in its possession). 10 Compelling the third party to turn over a password possessed by the third party 11 that is needed to obtain access to information covered by the underlying 12 warrant or other legal process. 13 When the information covered by the warrant is possessed by the third party 14 as a result of a government-conferred monopoly, obligating the third party to 15 enable the government to obtain access to that information. United States v. 16 New York Telephone Co., 434 U.S. 159 (1977); In re Application of the United 17 States for an Order Authorizing an In-Progress Trace of Wire 18 Communications Over Telephone Facilities, 616 F.2d 1122 (9th Cir. 1980). 19 Virtually all of the cases cited by the government involving process directed at third 20 parties fall into these categories. 21 The government’s request here is dramatically different in kind. The 22 government has possession of the device containing the information that is the 23 subject of the underlying warrant. Apple does not have the password that would 24 unlock the device. The government instead would require Apple to create a new 25 26 27 28 1 The Act provides: “The Supreme Court and all courts established by Act of Congress may issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.” 28 U.S.C. § 1651(a). 4 PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT 1 product, a new software “tool,” meeting the list of requirements specified by the 2 government. 3 The government cites two district court decisions—one issued ex parte and 4 one without any analysis—that endorse its position.2 Another court recently rejected 5 the government’s position in a lengthy opinion. See In re Order Requiring Apple, 6 Inc. To Assist In The Execution Of A Search Warrant Issued By This Court, No. 15 7 MC 1902 (E.D.N.Y. Feb. 29, 2016), Doc. 29. This Court should hold that the government’s request falls outside the 8 9 authority conferred by the All Writs Act. 10 A. 11 The government is unable to point to a single authoritative precedent in 12 support of its extraordinarily expansive construction of the Act. Its argument must 13 be rejected for two reasons. First, the Act simply does not reach beyond the three 14 situations in which it has routinely been applied. Second, even if the Act could 15 extend more broadly, it cannot apply in the circumstances presented here. Precedent Prohibits The Order Sought By The Government. 16 1. The Ninth Circuit’s rejection in Plum Creek of a similarly unprecedented 17 application of the All Writs Act demonstrates the flaws in the government’s analysis 18 here. 19 That case arose in the context of an investigation by the Occupational Safety 20 and Health Administration (OSHA) of a lumber yard explosion. During its 21 investigation, OSHA requested that the lumber yard’s employees wear noise- 22 measuring devices and air containment sampling devices. The company had a policy 23 barring its employees from wearing such devices, claiming, in relevant part, that the 24 devices were “dangerous because they could distract employees or cause them to 25 become entangled in moving equipment.” 608 F.2d at 1286. OSHA sought an order 26 27 28 2 See Apple Mem. in Support of Motion to Vacate at 28 (discussing United States v. Navarro, No. 13-CR-5525 (W.D. Wash. Nov. 13, 2013), ECF No. 39; In re Order Requiring [XXX], Inc. to Assist in the Execution of a Search Warrant Issued by This Court by Unlocking a Cellphone, 2014 WL 5510865, at *2 (S.D.N.Y. Oct. 31, 2014). 5 PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT 1 pursuant to the All Writs Act compelling the company to allow its employees to 2 wear the devices. 3 The Ninth Circuit held that the Act did not authorize OSHA’s proposed 4 order—even though the lumber company was the target of the investigation. The 5 Court relied on a number of factors in concluding that 6 9 although the use of the personal noise-level and aircontaminant measuring devices is a reasonable means of inspecting, there is no statutory or inherent authority in the district court to order Plum Creek to rescind its policy forbidding its employees to wear the OSHA devices. 10 608 F.2d at 1290. The Ninth Circuit held that the All Writs Act “does not authorize 11 a court to order a party to bear risks not otherwise demanded by law.” Id. at 1289- 12 1290.3 7 8 13 The Ninth Circuit thus refused to impose upon a private party a duty not 14 otherwise required by law—a duty that required the creation of information, rather 15 than merely providing the government with existing information in the possession 16 of the private party. The court of appeals’ reasoning requires rejection of the 17 government’s request here. Cf. New York Telephone, 434 U.S. at 174 (concluding 18 that, because telephone monopoly’s own facilities were “being employed to 19 facilitate a criminal enterprise on a continuing basis,” the company was not “so far 20 removed from the underlying controversy that its assistance could not permissibly 21 be compelled”). 22 The court of appeals’ conclusion about the limited scope of the All Writs Act 23 makes sense for an additional reason: a contrary result would embroil the courts in 24 wholly unguided assessments of the consequences to a third party of compelling it 25 to perform the tasks demanded by the government. Different courts could reach 26 different conclusions on that question, but those different results could have very 27 28 3 The Ninth Circuit also noted that OSHA had alternative means of accomplishing its objectives. See Plum Creek Lumber Co., 608 F.2d at 1289. 6 PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT 1 significant consequences for the security of data held by those companies—which 2 would be particularly unfair if, as is likely, the companies were marketplace 3 competitors. 4 Moreover, such ad hoc determinations would leave businesses and other 5 private parties with no certainty about their potential legal obligations. Businesses 6 would be unable to anticipate government demands that might be asserted, or how 7 such demands would be resolved by the courts. 8 2. Even if the Act could in some circumstances extend beyond situations in 9 which the government seeks disclosure of or access to existing information in the 10 possession of a third party, an order would be impermissible here. 11 Courts have limited the conscription of third parties under the Act to situations 12 in which the government’s demand would not subject the third party to an 13 unreasonable burden. New York Telephone Co., 434 U.S. at 172 (“[U]nreasonable 14 burdens may not be imposed.”); id. at 175 (“Nor was the District Court’s order in 15 any way burdensome. The order provided that the Company be fully reimbursed at 16 prevailing rates, and compliance with it required minimal effort on the part of the 17 Company and no disruption to its operations.”); Plum Creek Lumber, 608 F.2d at 18 1289-1290 (“[The All Writs Act] does not authorize a court to order a party to bear 19 risks not otherwise demanded by law.”). 20 21 The order here would impose very substantial burdens and risks on Apple and its customers. 22 First, the government’s order would create a very real security risk for the 23 millions of Apple products with the same operating system as the iPhone involved 24 here. That imposes a substantial burden on Apple’s customers and on Apple. 25 26 27 28 The Supreme Court recently explained in detail the intensely personal nature of the information contained on these devices: First, a cell phone collects in one place many distinct types of information—an address, a note, a prescription, a bank statement, a video—that reveal much more in combination 7 PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 than any isolated record. Second, a cell phone’s capacity allows even just one type of information to convey far more than previously possible. The sum of an individual’s private life can be reconstructed through a thousand photographs labeled with dates, locations, and descriptions . . . . Third, the data on a phone can date back to the purchase of the phone, or even earlier. . . . Finally, there is an element of pervasiveness that characterizes [information contained in] cell phones. Riley v. California, 134 S. Ct. 2473, 2489-90 (2014) (emphasis added). Apparently recognizing the deeply private nature of the data contained on these devices, and the security risks inherent in circumventing encryption software, the government asserts that there is no danger because the software that Apple would be compelled to create would be used only for this one phone—and could be retained in Apple’s possession and then destroyed. That is an unrealistic picture of the consequences of upholding the government’s demand. To begin with, the government itself has made clear that this is not a one-off request. The Department of Justice has asserted multiple demands for the creation of this software, and other law enforcement officials have indicated that they too would utilize the Act or state equivalents to impose the same obligation. See Apple Motion to Vacate at 5-8. It would hardly make sense for a company faced with multiple demands to continuously create and destroy the software. Once software is created to circumvent the device’s security protections— both the password-protection feature and the “auto erase” function after ten incorrect entries—that software could fall into the wrong hands: it could be stolen by hackers or by a government intelligence agency. See Apple Motion to Vacate at 5-8. Moreover, there is a significant risk that multiple uses of such governmentspecified software will inevitably lead to public disclosure of information that would enable hackers (whether private or sponsored by foreign governments) to produce their own hacking tool. If, for example, the software resulted in access to evidence that federal or state authorities sought to introduce in a criminal proceeding, the 8 PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT 1 Apple engineers who created the government-mandated software could be required 2 to testify about how the software tool worked and to provide assurance that it merely 3 provided access to, and did not in any way alter, the information contained on the 4 device in question. That testimony, in turn, could provide hackers with a roadmap to 5 create their own tool for invading the contents of the device. Cf. Apple Mot. to 6 Vacate 24-25. The only effective way to prevent this software from falling into the 7 wrongs hands is to abstain from creating it in the first place. 8 In sum, the significant security risks to all device users that would result from 9 creation of the software demanded by the government is an unreasonable burden 10 under the New York Telephone standard that bars issuance of the order. 11 Second, the government’s order would force a company to breach its 12 assurances to its customers about the security of their information, possibly 13 subjecting it to liability as well as harm in the marketplace. 14 Customers are intensely concerned about maintaining control over their most 15 intimate and personal information. “[P]eople now are more anxious about the 16 security of their personal data and are more aware that greater and greater volumes 17 of data are being collected about them.” Lee Ranine & Shiva Maniam, Americans 18 Feel the Tensions between Privacy and Security Concerns, Feb. 19, 2016, 19 http://www.pewresearch.org/fact-tank/2016/02/19/americans-feel-the-tensions- 20 between-privacy-and-security-concerns. Eighty percent of adults “agree” or 21 “strongly agree” that Americans should be concerned about the government’s 22 monitoring of phone calls and internet communications. Mary Madden, Public 23 Perceptions of Privacy and Security in the Post-Snowden Era, Nov. 12, 2014, 24 http://www.pewinternet.org/2014/11/12/public-privacy-perceptions/. 25 These concerns have been heightened by recent revelations by Edward 26 Snowden about U.S. government access to personal information. Consumers are also 27 very sensitive to and concerned by the threats to security of their private information 28 posed by an array of criminals and bad actors, including hackers, fraudsters, and 9 PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT 1 identity thieves. See Rebecca Rifkin, Hacking Tops List of Crimes Americans Worry 2 About Most, Oct. 27, 2014, http://www.gallup.com/poll/178856/hacking-tops-list- 3 crimes-americans-worry.aspx. 4 Many technology companies have announced changes to their operating 5 systems specifically designed to provide customers with greater security for their 6 personal information. See, e.g., Hanna Decl. Ex. M [Berkman Center for Internet & 7 Society at Harvard University, Don’t Panic: Making Progress on the “Going Dark” 8 Debate, at 3-4 (2016)]. 9 The order sought by the government would force Apple to undermine the 10 hard-earned trust of its customers. That will subject the company to substantial 11 reputational and marketplace injury, leading customers to lose confidence in the 12 company’s willingness to protect their security and seek trustworthy alternatives that 13 provide greater protection. 14 These harms could be particularly pronounced in any country where 15 protection of personal information in general, and distrust of the U.S. government in 16 particular, is highly relevant in the marketplace. Indeed, some U.S. technology 17 companies suffered substantial economic and reputational harm in the wake of the 18 revelations about U.S. government access to personal information. See Gerry Smith, 19 ‘Snowden Effect’ Threatens U.S. Tech Industry’s Global Ambitions, Huffington 20 Post 21 snowden-techn-industry_n_4596162.html. (noting that in the wake of Snowden’s 22 revelations, approximately ten percent of non-U.S. companies cancelled contracts 23 with U.S. companies out of fear of NSA surveillance). (Jan. 24, 2014), http://www.huffingtonpost.com-/2014/01/24/edward- 24 Foreign competitors in particular would argue that devices or software created 25 by U.S. companies are less secure because of the risk that the U.S. government 26 would demand creation of a “tool” to enable access to personal information—and 27 that customers should therefore purchase only from non-U.S. technology companies. 28 This is not speculation: these very arguments were advanced in the wake of the 10 PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT 1 Snowden revelations. See Charles Babcock, NSA’s Prism Could Cost U.S. Cloud 2 Companies $45 Billion, InformationWeek (Aug. 14, 2013), http://tiny.cc/jn6pqx 3 (Neelie Kroes—at the time, the Vice President of the European Commission 4 responsible for Digital Agenda—observed: “If European cloud customers cannot 5 trust the United States government, then maybe they won’t trust U.S. cloud providers 6 either. . . . If I were an American cloud provider, I would be quite frustrated with my 7 government right now.”). 8 If Congress wants to subject American businesses to burdens, it can do so 9 explicitly; but this Court should not interpret the All Writs Act implicitly to authorize 10 courts to inflict such consequences based on ad hoc decisions without any guidance 11 from Congress. 12 Third, foreign nations, including repressive regimes, would argue that they, 13 too, may compel Apple—and other companies—to use their technical expertise to 14 access locked phones and other devices, including those seized from political and 15 religious dissidents or journalists. Companies that refuse assistance might well be 16 told: the United States government compels this assistance, we may do so as well. 17 And these foreign governments could well refuse to impose the same safeguards the 18 U.S. government proposes in this case, thereby making it far more likely that 19 repressive regimes could use unrestricted access to cellphones’ content to persecute 20 their own citizens for exercising free speech and similar human rights. 21 * * * * * 22 In Plum Creek, the Ninth Circuit held that the government’s request fell 23 outside the All Writs Act because the order would subject the lumber company to 24 risk. It observed that as a “private employer,” the company “bears all safety risks. 25 The safety factor cannot be eliminated. [The employer] pays the cost of all industrial 26 accidents. OSHA cannot guarantee that these devices would cause none.” Id. at 27 1289. The court of appeals held that “in the absence of law specifying [the devices] 28 use, we cannot order [the employer] to bear the added risks the devices would bring.” 11 PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT 1 Id. 2 The Department of Justice here, like OSHA in Plum Creek, cannot guarantee 3 that the foreseeable security risks—borne by Apple’s customers and Apple itself— 4 will not be realized. Just as the All Writs Act did not give “court[s] a roving 5 commission to order a party subject to an investigation to accept additional risks at 6 the bidding of OSHA inspectors,” id., the Act also does not authorize the government 7 to force Apple to create a massive security vulnerability for its devices, causing 8 serious and potentially irreparable economic and reputational harm to the company, 9 as well as potentially infringing the fundamental human rights of individuals using 10 11 12 its products around the world. B. The Government’s Expansive Interpretation Of The Act Has No Limiting Principle. 13 The order should be vacated for the additional reason that it rests on a 14 construction of the All Writs Act that has no limiting principle. Under the 15 government’s approach, any private party may be forced against its will to assist the 16 government in any way, subject only to the vague “unreasonable burden” limitation. 17 Courts would be obliged to apply this standard on an ad hoc basis in numerous 18 cases—involving different devices, device manufacturers, and software creators— 19 that inevitably will follow this one if the government is successful. The Court should 20 refuse to interpret the statute to produce such a substantial intrusion on liberty in the 21 absence of express congressional authorization. 22 The target of the government’s request in this case is Apple, but the 23 government’s theory would just as easily extend to any third-party developer of 24 software that has as one of its functions collecting and storing personal information 25 about the device’s owner. All such software includes security measures to protect 26 the owner’s personal information—and the government’s theory would empower it 27 to require the software creator to develop a “tool” to enable the government to access 28 that information. The authority sought by the government would therefore extend 12 PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT 1 not only to phones, laptop computers, and tablets, but also to automobiles that store 2 information regarding location and times of use; insulin pumps that store 3 information about blood sugar levels; and the myriad other devices that collect and 4 store personal information. 5 Creation of government-required software tools providing access to the 6 information stored on any such device would multiply the security risks and other 7 burdens described above. These burdens would fall most heavily on smaller, 8 younger technology companies—such as start-ups—that will have fewer employees 9 and less resources. 10 The government’s decisions regarding which companies to target—and 11 courts’ case-specific decisions regarding which government requests could grant— 12 could have significant marketplace consequences. Companies forced to invent new 13 tools to facilitate government access would have to take on risks and could be 14 disadvantaged in the marketplace vis-à-vis competitors not forced to do so. And the 15 uncertainty over the scope of the government’s authority itself would impose 16 significant costs on all businesses. 17 Importantly, although the government focuses on the horrific nature of the 18 underlying crime here, nothing in the government’s interpretation of the statute 19 would limit such orders to crimes of great magnitude. Indeed, as discussed above 20 (see page xx, supra), the federal government and state and local prosecutors have 21 already made clear that they believe their interpretation extends broadly to any 22 criminal investigation.4 23 The government’s theory, moreover, is not limited to digital technology. What 24 if the government were unable to break into an “unbreakable” safe? Could the 25 government force the company that made the safe to design a way to defeat their 26 4 27 28 In addition, nothing in the All Writs Act limits the statute’s scope to criminal cases. It is not inconceivable that private plaintiffs will argue that they may invoke the All Writs Act in the same manner that the government attempts here, but in furtherance of civil discovery orders. 13 PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT 1 own product? Or suppose the government seized encoded records. Could the 2 government conscript MIT graduate students to break the code? 3 The government can of course employ its own resources—its own employees 4 and its own funds—to accomplish the ends it desires. But the All Writs Act does not 5 confer a broad license upon the government to force unwilling private companies 6 and individuals to accede to its demands.5 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 5 An expert on cybersecurity issues, testifying before the House Judiciary Committee, urged Congress to address this issue by giving the FBI the resources needed to “[b]ring FBI investigative capacity into the twenty-first century”: The Bureau has some expertise in this direction, but it will need more, much more, both in numbers and in depth. The FBI will need an investigative center with agents with a deep technical understanding of modern telecommunications technologies; this means from the physical layer to the virtual one, and all the pieces in between. Since all phones are computers these days, this center will need to have the same level of deep expertise in computer science. In addition, there will need to be teams of researchers who understand various types of fielded devices. This will include not only where technology is and will be in six months, but where it may be in two to five years. This center will need to conduct research as to what new surveillance technologies will need to be developed as a result of the directions of new technologies. I am talking deep expertise here and strong capabilities, not light. This expertise need not be in house. The FBI could pursue a solution in which they develop some of their own expertise and closely manage contractors to do some of the work. But however the Bureau pursues a solution, it must develop modern, state-of-the-art capabilities for surveillance. Testimony of Susan Landau, The Encryption Tightrope: Balancing Americans’ Security and Privacy, Hearing before the House Judiciary Comm., March 1, 2016, 14 PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT C. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 When Congress Intends To Authorize Government Conscription Of Private Parties, It Does So Expressly. The absence from the All Writs Act of any express authority for conscripting third parties provides another reason for rejecting the government’s request. Congress in other contexts has acted clearly and expressly when authorizing the federal government to force private parties to do the government’s bidding. For example, the Defense Production Act, 50 U.S.C. § 4501 et seq., confers authority on the President to require private persons or companies to accept contracts necessary for the national defense. Id. § 4511. That authority is explicit, specific, and subject to a variety of restrictions, including narrow definitions of when the statute may be invoked, see id. § 4552. The Defense Production Act also has provisions requiring specific congressional authorization, see id. § 4514(a) (wage and price controls), as well as a sunset provision, see id. § 4564. Similarly, the Communications Assistance for Law Enforcement Act (CALEA), 47 U.S.C. § 1001 et seq., establishes a detailed statutory scheme governing the assistance that telecommunications providers are obligated to provide to the government. And CALEA expressly distinguishes “telecommunications carriers” and “information services” providers, requiring only the former to enable the government to intercept communications pursuant to a court order. Id. §§ 1001(8), 1002. Apple plainly is not a “telecommunications carrier.” Thus, when Congress enacted CALEA in 1994, it made a considered judgment to exclude information services providers such as Apple from the statute’s obligations. Indeed, Congress in 2015 held hearings on whether CALEA should be amended to require technology companies like Apple to assist law enforcement’s requests for decryption. See Hanna Decl. Ex. L [Joint Statement of Sally Quillian Yates and James B. Comey, Jr., Going Dark: Encryption, Technology, and the 27 28 between http://judiciary.house.gov/_cache/files/b3af6e9e-b599-4216-b2f91aee6a1d90cd/landau-written-testimony.pdf. 15 PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT 1 Balances Between Public Safety and Encryption, Hearing before the S. Judiciary 2 Comm. (July 8, 2015)]. 3 The Executive Branch publicly decided not to seek legislation, however. See 4 Hanna Decl. Ex. S [James B. Comey, Statement Before the Senate Comm. On 5 Homeland Sec. & Governmental Affairs (Oct. 8, 2015)]. And the Chairman of the 6 Senate Judiciary Committee has criticized the Administration for failing to give 7 Congress the information it needs to consider these important policy questions. 8 Letter from Sen. Charles E. Grassleyto Sally Q. Yates, Deputy Att’y Gen., and James 9 B. Comey, Jr., Dir., Fed. Bureau of Investigation, Feb. 16, 2016, 10 http://www.grassley.senate.gov/sites/default/files/judiciary/upload/Encryption,%20 11 02-16-16,%20Going%20Dark%20QFR%20Response%20Letter.pdf 12 This Court should not transform the general language of the All Writs Act into 13 all-purpose authority for compelling the very sorts of assistance from private 14 companies that Congress has required only pursuant to detailed laws that carefully 15 balance all of the relevant interests. To hold otherwise would violate the Supreme 16 Court’s instruction that the All Writs Act is designed only to “fill statutory 17 interstices.” Pennsylvania Bur. of Corr. v. U.S. Marshals, 474 U.S. 34, 42 n.7 18 (1985). It would confer upon the courts plenary, unguided authority to resolve a 19 policy issue so complex that the FBI Director has characterized it as the “hardest 20 question” he has ever seen in government. And it would be inconsistent with the 21 Supreme Court’s ruling in the Steel Seizure Cases rejecting the federal government’s 22 analogous argument that the general language of the Constitution somehow 23 authorized the President to seize and operate steel mills. Youngstown Sheet and Tube 24 Co. v. Sawyer, 343 U.S. 579 (1952). 25 26 D. The Likely Practical Result of The Government’s Position Will Be De Facto Government-Mandated Design Specifications. 27 Congress has explicitly refused to subject technology companies to 28 government-imposed design specifications. CALEA expressly prohibits the 16 PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT 1 government from requiring any “provider of . . . electronic communication service” 2 to adopt a “specific design of equipment, facilities, services, features, or systems 3 configuration.” Id. §1002(b)(1). Granting the order sought here—and the large 4 numbers of requests that are sure to follow in its wake—will have the practical effect 5 of doing just that, circumventing Congress’s intent in passing CALEA. 6 If Apple is compelled to develop the new software that the government 7 demands, it is inevitable that the federal government, and state and local law 8 enforcement, will seek to impose the same obligation on creators of other operating 9 systems. Companies will then face a choice: continue to be burdened by such 10 government demands, and design products in a manner that such demands can be 11 more easily satisfied; or configure new versions of their operating systems to make 12 development of such software “tools” impossible. 13 The first option would mean products intentionally designed to be less secure. 14 That would not only subject customers to a greater risk of privacy intrusions, but 15 also harm long-term U.S. economic interests and national security. See, e.g., Hanna 16 Decl. Ex. O [McConnell et al., Why The Fear Over Ubiquitous Data Encryption Is 17 Overblown, Wash. Post (July 28, 2015)]. It would harm ordinary citizens, but 18 malevolent actors would retain the ability to purchase completely-secure devices. 19 The second option—encouraging companies to configure products in a way 20 that makes orders such as the one sought here impossible to implement—could have 21 the result of making it even more difficult for law enforcement and national security 22 agencies to access information. Indeed, it has been reported that Apple is already 23 working on encryption software that would not be susceptible to the work-around 24 sought by the government in this case. See Matt Apuzzo & Katie Benner, Apple Is 25 Said To Be Trying To Make It Harder To Hack iPhone, N.Y. Times (Feb. 24, 2016), 26 http://www.nytimes.com/2016/02/25/technology/apple-is-said-to-be-working-on- 27 an-iphone-even-it-cant-hack.html. The Court should not fuel that self-defeating 28 result. 17 PRIVILEGED AND CONFIDENTIAL – MARCH NOON DRAFT 1 * * * * * 2 As Justice Alito has explained: “In circumstances involving dramatic 3 technological change, the best solution to privacy concerns may be legislative. A 4 legislative body is well situated to gauge changing public attitudes, to draw detailed 5 lines, and to balance privacy and public safety in a comprehensive way.” United 6 States v. Jones, 132 S. Ct. 945, 964 (2012) (Alito, concurring in the judgment). The 7 All Writs Act plainly does not address this complex question. This Court should 8 therefore reject the government’s request, and leave resolution of these complex 9 questions to policymakers. 10 11 12 CONCLUSION The motion to vacate should be granted and the motion to compel assistance should be denied. 13 14 15 16 Dated: March 3, 2016 MAYER BROWN LLP JOHN NADOLENCO ANDREW PINCUS TRAVIS CRUM 17 By: 18 John Nadolenco Attorneys for Amici Curiae 19 20 21 22 23 24 25 26 27 28 18