Page 7 - GCN, April/May 2018

\[BrieFing\]
Unlocking iPhones
at $50 a pop
BY SARA FRIEDMAN
AS SECURITY AND ENCRYPTION
for mobile devices grow more so- phisticated, the same techniques that keep users’ data secure also make it nearly impossible for law enforcement agencies to examine the contents of a phone without the user’s permission. And even if the phone’s manufacturer agrees to help officials unlock the phone, encrypted data might not be accessible.
Law enforcement officials have pressed manufacturers to include backdoors or responsible encryption on phones, but computer scientists and cybersecurity experts argue there is no way to satisfy those demands without also reducing security barriers for hackers. Other solutions include hiring high-priced consultants, like the one that reportedly unlocked the iPhone of the perpetrator of the mass shooting in San Bernardino, Calif., for $900,000.
Now, however, a new product from Grayshift promises to unlock iPhones for as little as $50 per device. The tool, called GrayKey, has already attracted the attention of at least three federal agencies, and at that price, it could be an option for many federal, state and local law enforcement agencies.
Motherboard reported that the State Department had issued a $15,000 purchase order for GrayKey in March. According to cybersecurity firm Malwarebytes, Grayshift’s $15,000 of- fering allows a customer to unlock up to 300 phones. There is also a $30,000 option that does not cap the number
of phones that can be unlocked with the tool.
The Drug Enforcement Administra- tion and FBI issued separate requests for quotations looking for technology similar to GrayKey’s in March. The FBI’s Electronic Device Analysis Unit determined that GrayKey meets the Computer Analysis Response Team’s mandatory requirements to “provide adequate capability against an ever- growing spectrum of mobile devices.”
Furthermore, FBI Director Christo- pher Wray recently called his agency’s inability to access the content of 7,800 devices in fiscal 2017 a major public safety issue. At the Boston Conference on Cyber Security in March, Wray said the number doesn’t take into account
state, local and foreign law enforce- ment agencies. “This problem impacts our investigations across the board — human trafficking, counterterrorism, counterintelligence, gangs, organized crime, child exploitation and cyber,” he added.
“Service providers are required to let law enforcement know about the capabilities of their devices under the Stored Communications Act,” said Nate Cardozo, a senior staff attorney at the Electronic Frontier Foundation. “Service providers also have the abil- ity to voluntarily share information if there is a situation with a ticking time bomb like a kidnapping, but it is the Wild West when it comes to case law for unlocking phones.” •
GCN APRIL/MAY 2018 • GCN.COM 7
MIRTMIRT/SHUTTERSTOCK