近來(lái)隨著關(guān)于智能手機(jī)加密防護(hù)的爭(zhēng)論再次升溫，該領(lǐng)域曾經(jīng)發(fā)生過(guò)的一場(chǎng)重要爭(zhēng)論也再次引起了人們的關(guān)注。據(jù)最新披露的一份報(bào)告顯示，2015年的圣貝綱迪諾恐襲案發(fā)生后，美國(guó)聯(lián)邦調(diào)查局本可不依賴蘋(píng)果公司的協(xié)助，自行解鎖一名槍手使用的iPhone。但這樣做會(huì)大大降低FBI通過(guò)法律途徑向蘋(píng)果施壓的力度，從而無(wú)法為今后要求蘋(píng)果提供協(xié)助創(chuàng)下前例。FBI最終還是訴諸法律途徑，跟蘋(píng)果打起了官司。

這段歷史為什么又引起了人們的注意？因?yàn)樽罱?，特朗普政府試圖強(qiáng)迫智能手機(jī)制造商在手機(jī)中留下“后門(mén)”，以便執(zhí)法部門(mén)讀取用戶的加密信息。多數(shù)專家表示，此舉將弱化所有手機(jī)用戶的敏感信息保護(hù)力度。今年一月，F(xiàn)BI局長(zhǎng)克里斯托弗·雷在講話中表示，F(xiàn)BI需要手機(jī)留下某種形式的后門(mén)，因?yàn)槿ツ暝摼钟?,000多部涉案手機(jī)無(wú)法讀取數(shù)據(jù)，從而造成了“重大的公共安全問(wèn)題”。而一向反對(duì)政府給手機(jī)開(kāi)后門(mén)的參議員羅恩·維頓則表示，F(xiàn)BI局長(zhǎng)的看法是“欲蓋彌彰”，其用心“昭然若揭”。

圍繞圣貝納迪諾恐襲案的涉案手機(jī)解鎖問(wèn)題，2016年FBI曾與蘋(píng)果公司曾爆發(fā)過(guò)一場(chǎng)大規(guī)模的法律戰(zhàn)。就在手機(jī)加密問(wèn)題再次引發(fā)雙方激辯的同時(shí)，不久的一份新報(bào)告卻披露了那場(chǎng)法律戰(zhàn)背后一些不為人知的秘密。

不過(guò)這些信息看來(lái)對(duì)FBI十分不利。

2015年12月2日，兩個(gè)名叫薩伊德·里茲萬(wàn)·法魯克和塔什芬·瑪利克的槍手在加州的圣貝納迪諾炮制了一樁槍擊案，造成14人死亡。案發(fā)后，執(zhí)法部門(mén)發(fā)現(xiàn)了一部屬于法魯克的iPhone 5C手機(jī)，這部手機(jī)設(shè)有密碼。2016年2月，F(xiàn)BI請(qǐng)求法院要求蘋(píng)果公司重寫(xiě)iPhone軟件，以允許FBI破解手機(jī)密碼。當(dāng)時(shí)FBI表示，沒(méi)有蘋(píng)果的幫助，F(xiàn)BI無(wú)法繞過(guò)這部涉案手機(jī)的加密程序。時(shí)任FBI局長(zhǎng)的詹姆斯·科梅伊兩次在國(guó)會(huì)作證時(shí)作了同一表態(tài)。但由于法律程序遷延日久，最終FBI還是在沒(méi)有蘋(píng)果協(xié)助的情況下將這部手機(jī)解鎖了。據(jù)稱它采用的是由外部專家研發(fā)的一種技術(shù)。（解鎖這部手機(jī)的團(tuán)隊(duì)并非之前所傳的以色列安全公司Cellebrite。）

一段秘史

上周二，美國(guó)司法部監(jiān)察長(zhǎng)披露了一份關(guān)于此事的11頁(yè)的報(bào)告，并將報(bào)告的PDF版本公布在了司法部網(wǎng)站上。報(bào)告認(rèn)為，科梅伊和FBI向法院申請(qǐng)強(qiáng)制蘋(píng)果解鎖涉案手機(jī)時(shí)并未撒謊，他們確實(shí)認(rèn)為自己沒(méi)有這個(gè)能力，不過(guò)這僅僅是因?yàn)镕BI高層當(dāng)時(shí)沒(méi)有咨詢?cè)摼肿钕冗M(jìn)的網(wǎng)絡(luò)部門(mén)的意見(jiàn)。后來(lái)FBI的“遠(yuǎn)程操作部門(mén)”（ROU）接到任務(wù)后，聯(lián)系了一家外部“廠商”，最終搞出了能攻破iPhone防護(hù)措施的解決方案。

從報(bào)告中看，F(xiàn)BI在2015年12月3日就獲得了法魯克的iPhone。破解這部手機(jī)的任務(wù)落到了FBI的操作技術(shù)處（OTD），該處包括ROU和CEAU（加密與電子分析部門(mén)）兩個(gè)部門(mén)，其中ROU主要負(fù)責(zé)國(guó)家安全案件，而CEAU主要負(fù)責(zé)一般刑事案件的調(diào)查。不過(guò)那次破解任務(wù)以CEAU為主，破解也沒(méi)有成功，并且當(dāng)時(shí)并未尋求外部協(xié)助。

ROU直到2月11日才知道這件事，這時(shí)離政府檢察官向法庭申請(qǐng)強(qiáng)制蘋(píng)果解鎖只有不到一個(gè)星期了。不過(guò)當(dāng)時(shí)ROU已經(jīng)知道有一家外部廠商擁有攻克蘋(píng)果安全防護(hù)的技術(shù)，而且這項(xiàng)技術(shù)的完整度已達(dá)90%。ROU要求該廠商全力完成破解方案，到了3月16日，這項(xiàng)技術(shù)已經(jīng)可以使用了。不到一周后，政府的律師就撤銷了對(duì)蘋(píng)果的指控。

該報(bào)告認(rèn)為，司法部監(jiān)察長(zhǎng)“未發(fā)現(xiàn)任何證據(jù)表明，在時(shí)任FBI局長(zhǎng)科梅伊向國(guó)會(huì)作證以及向法庭申請(qǐng)強(qiáng)制執(zhí)行時(shí)，OTD已擁有了破解法魯克的iPhone手機(jī)的能力。因此我們認(rèn)定，F(xiàn)BI的國(guó)會(huì)證詞以及向法院提交的申請(qǐng)并非是失實(shí)的?！?

不過(guò)故事到這里還不算完，報(bào)告還指出：

不過(guò)，F(xiàn)BI對(duì)國(guó)會(huì)和檢察官辦公室所作的關(guān)于其沒(méi)有能力破解法魯克iPhone數(shù)據(jù)的證詞，乃是基于OTD的部門(mén)和人員已經(jīng)進(jìn)行過(guò)有效溝通協(xié)調(diào)，而且CEAU已經(jīng)窮盡了所有技術(shù)方案的前提。然而我們認(rèn)為，這種理解和假設(shè)并無(wú)事實(shí)支持。

該報(bào)告還指出，當(dāng)?shù)弥槍?duì)蘋(píng)果的指控已經(jīng)撤銷后，CEAU的負(fù)責(zé)人還很不高興?！巴獠繌S商介入后，他對(duì)針對(duì)蘋(píng)果的訴訟無(wú)法繼續(xù)進(jìn)行而感到沮喪，甚至向ROU的負(fù)責(zé)人發(fā)泄了自己的不滿。他坦承，在與ROU負(fù)責(zé)人交談過(guò)程中，他公開(kāi)表達(dá)了自己對(duì)聘請(qǐng)外部廠商破解法魯克iPhone的失望，并質(zhì)問(wèn)ROU的負(fù)責(zé)人：‘你為什么要那樣做？’”

沖突本可避免

報(bào)告指出，問(wèn)題的癥結(jié)在于，F(xiàn)BI在嘗試所有可能的解決方案之前，本不應(yīng)該動(dòng)用法律手段解決問(wèn)題。“我們認(rèn)為，CEAU應(yīng)該已經(jīng)向它信任的各家廠商咨詢了可能的解決方案，在被告知無(wú)果后，才向OTD和FBI高層（乃至美國(guó)聯(lián)邦檢察官辦公室）表示，沒(méi)有其他替代的技術(shù)方案能攻破法魯克的iPhone，必須請(qǐng)求蘋(píng)果的技術(shù)援助?！?

蘋(píng)果拒絕向《財(cái)富》就這份報(bào)告發(fā)表評(píng)論。不過(guò)蘋(píng)果早先曾就美國(guó)政府要求手機(jī)廠商給手機(jī)留“后門(mén)”一事發(fā)表過(guò)聲明。蘋(píng)果公司高級(jí)副總裁克雷格·費(fèi)德里吉在聲明中稱：“用戶依靠我們的產(chǎn)品來(lái)保護(hù)他們的個(gè)人信息，運(yùn)營(yíng)他們的企業(yè)，甚至是管理電網(wǎng)、交通系統(tǒng)等重要基礎(chǔ)設(shè)施。鑒此，削弱手機(jī)的安全性是沒(méi)有道理的。保護(hù)別人的隱私，就是保護(hù)我們所有人的隱私，所以我們應(yīng)當(dāng)摒棄保護(hù)隱私必然妨害安全的錯(cuò)誤思維。實(shí)際上，這是一個(gè)安全對(duì)安全的問(wèn)題?！?

在與該報(bào)告一并發(fā)布的一封信中，F(xiàn)BI也強(qiáng)調(diào)了報(bào)告的結(jié)論，稱FBI在此案中并沒(méi)有作任何虛假證詞，并承諾將在OTD部門(mén)內(nèi)部進(jìn)一步加強(qiáng)“溝通協(xié)調(diào)”。（財(cái)富中文網(wǎng)）

譯者：樸成奎

With the debate over encryption on smartphones heating up yet again, one of the most important past controversies in the area needs to be revisited. According to a new report, the FBI could have unlocked the iPhone used by one of the San Bernardino shooters without Apple’s help possibly more quickly than it did. But that would have undercut the bureau’s legal efforts to force Apple’s hand and set a precedent requiring future assistance.

The history is suddenly relevant again as the Trump administration is trying to revive proposals to force smartphone makers to add a “backdoor” for law enforcement agencies to get access to users’ encrypted information. Most outside experts warn that approach would weaken the protection of sensitive data for all phone users. The new plans follow a speech in January by FBI director Christopher Wray, who said the bureau needed some kind of backdoor because it was locked out of almost 8,000 phones last year creating “a major public safety issue.” Senator Ron Wyden, who has long opposed weakening encryption, blasted Wray’s view as “ill-informed” and “debunked.”

But just as both sides are reengaging in well-worn arguments, detailed information emerged on Tuesday shedding new light on the massive legal battle between the FBI and Apple in 2016 over the difficulties of decrypting an iPhone used by one of the San Bernardino shooters.

And the new information doesn’t look good for the FBI.

After the December 2, 2015 shooting by Syed Rizwan Farook and Tashfeen Malik in San Bernardino, Calif. during which 14 people were killed, law enforcement officials found an iPhone 5C belonging to Farook. The phone was locked with a passcode. In February, 2016, the FBI went to court seeking to force Apple to rewrite the software running on iPhones to allow the bureau to crack the passcode. Without Apple’s aid, the FBI said it had no way to get past the phone’s encryption. Then-FBI-director James Comey repeated that story twice in Congressional testimony. But as the legal efforts dragged on, the FBI ultimately was able to unlock the phone without Apple’s help by relying on a technique developed by outside experts. (Though not, as was once rumored, Israeli security firm Cellebrite.)

A Secret History

On Tuesday, the Inspector General of the Justice Department released an 11-page report on the incident and posted a PDF version on the department’s web site. The report concluded that Comey and the FBI’s court filing told the truth about the bureau’s inability to unlock the phone. But that was only because top FBI officials hadn’t asked one of the bureau’s most sophisticated cyber units for help. As soon as the group, known as the Remote Operations Unit or ROU, was asked, it connected with an outside “vendor” that created a solution to crack the iPhone’s security.

According to the timeline uncovered by the Inspector General, the FBI seized Farook’s iPhone on December 3, 2015. The task of cracking the encryption fell to the bureau’s Operational Technology Division, including both the Remote Operations Unit, which tends to focus on national security matters, and a section called the Cryptographic and Electronic Analysis Unit, or CEAU, which aids most criminal inquiries. But only CEAU started working on the phone, failed to crack it, and did not seek outside assistance.

The ROU wasn’t informed about the challenge until February 11, less than a week before government prosecutors went to court in their effort to force Apple to help. And the ROU already knew about an outside vendor who had a technique to crack the iPhone that was 90% complete. Once the ROU asked the vendor to prioritize finishing the cracking scheme, it was ready to use by March 16. Less than a week later, government lawyers dropped the case against Apple.

The Inspector General “found no evidence that OTD had the capability to exploit the Farook iPhone at the time of then-Director Comey’s Congressional testimony and the Department’s initial court filings,” the new report concludes. “We therefore determined that neither the Congressional testimony nor the submissions to the Court were inaccurate when made.”

But that wasn’t the whole story, the report continues:

However, FBI statements in Congressional testimony and to the (U.S. Attorney’s Office) regarding its capabilities to access the data on the Farook iPhone were based on understandings and assumptions that people and units in OTD were effectively communicating and coordinating from the outset and that CEAU had searched for all possible technical solutions, points that were not borne out by the facts, as we determined them

And, according to the report, the head of the CEAU unit wasn’t happy that the case against Apple had to be dropped. “After the outside vendor came forward, he became frustrated that the case against Apple could no longer go forward, and he vented his frustration to the ROU Chief,” the report says. “He acknowledged that during this conversation between the two, he expressed disappointment that the ROU Chief had engaged an outside vendor to assist with the Farook iPhone, asking the ROU Chief, ‘Why did you do that for?'”

The Confrontation Could Have Been Avoided

The bottom line was that the FBI should not have gone to court against Apple before comprehensively checking for possible solutions, the Inspector General noted. “We believe CEAU should have checked with OTD’s trusted vendors for possible solutions before advising OTD management, FBI leadership, or the (U.S. Attorney’s Office) that there was no other technical alternative and that compelling Apple’s assistance was necessary to search the Farook iPhone,” the report concludes.

Apple declined to comment to Fortune on the new report. The company had earlier issued a statement on the government’s renewed efforts at forcing backdoors in phones. “Weakening security makes no sense when you consider that customers rely on our products to keep their personal information safe, run their businesses or even manage vital infrastructure like power grids and transportation systems,” Apple senior vice president Craig Federighi said in the statement. “Ultimately protecting someone else’s data protects all of us so we need to move away from the false premise that privacy comes at the cost of security when in truth, it’s a question of security versus security.”

In a letter accompanying the report, the FBI highlighted the conclusion that no inaccurate testimony had been given and committed to improve “communication and coordination” within the bureau’s Operational Technology Division.