A federal court in Washington DC has issued a summons to the FBI after a group of media organizations filed a lawsuit compelling them to release details about how they hacked an iPhone belonging to one of the San Bernardino killers.
On Friday, the Associated Press, Gannett newspapers and Vice Media filed a lawsuit to compel the FBI under the Freedom of Information Act (Foia) to reveal details about the way they gained access earlier this year to the phone belonging to Syed Farook, one of perpetrators of the December 2015 attack in which 14 people were killed.
Specifically, the suit asks for the identity of the vendor from whom the FBI purchased the hack which gave them access to Farook’s phone, and how much the bureau paid for it. The suit claims that the public needs to know whether the technique exposes a critical security vulnerability in one of the world’s most popular consumer technology products.
On Monday the FBI was officially served with a summons to appear in court. No hearing date has been set.
In February the FBI asked Apple directly for help in breaking into Farook’s phone. After the company refused, the FBI tried to compel them through to give up access to the phone. Then, in March, they abruptly dropped the suit after having found a third-party exploit, announcing a week later that they had successfully hacked the phone.
Not much is currently known about that exploit or the company from whom the bureau purchased it; but its price may have been upwards of $1m, FBI director James Comey has hinted.
The AP’s lawsuit would give news organizations a valuable insight into law enforcement’s relationship with private companies, many of them operating in legal grey areas, who sell hacks and exploits against technology companies.
“The FBI’s purchase of the technology – and its subsequent verification that it had successfully obtained the data it was seeking thanks to that technology – confirmed that a serious undisclosed security vulnerability existed (and likely still exists) in one of the most popular consumer products in the world,” the complaint states.
It continues: “In order to exploit that vulnerability, the FBI contracted with an unidentified third-party vendor, effectively sanctioning that party to retain this potentially dangerous technology without any public assurance about what that vendor represents, whether the vendor has adequate security measures, whether the vendor is a proper recipient of government funds, or whether it will act only in the public interest.”
“We’re not looking for the tool itself, and not looking for materials related to any ongoing investigation,” Jay Ward Brown, the lawyer representing the AP, said. “We’re just focused on the identity of the third-party vendor and the price paid.”
“Thats the kind of information into government contracting that typically is available to the pub under Foia,” he said, adding that so far the government has only invoked exception 7a, which pertains to ongoing law enforcement investigations, so far.
“It’s difficult to understand how the vendor’s name could impact [an ongoing investigation],” Brown said. “So yes we think there is a very good chance that the records will be released.”
The FBI did not immediately respond to requests for comment.