A Big-Apple Judge Sides with Apple: A Breakdown of Magistrate Judge Orenstein’s Opinion

In March, the Department of Justice (DOJ) officially withdrew its request for an order that would have forced Apple to create software to help law enforcement bypass the security features of an iPhone linked to one of the San Bernardino shooters. After months of insisting that Apple’s assistance was essential, it turns out the FBI was able to hack into the iPhone on its own once an unidentified entity showed them the way. Courts will probably view future claims that the FBI “needs” to conscript Apple to do its own bidding with a highly skeptical eye – and rightfully so. The case also demonstrates why lawmakers should be skeptical of claims that the government must weaken security by mandating an encryption backdoor. Just as no ship is unsinkable, no device is unbreakable – and the government should not be in the business of making our devices any weaker than they already are.

The end of the Apple/FBI case in California is a win for cybersecurity and privacy – but a temporary one. It’s only a matter of time before another judge considers whether or not the All Writs Act (AWA) can be used to force Apple to weaken the security of its devices in aid of ongoing investigations. In fact, less than a month ago, a New York magistrate judge faced a similar legal question involving an iPhone from a drug trafficking case; his answer was an emphatic “no.”

This is CDT’s in-depth breakdown of his opinion, which the government appealed to the District Court.

Factual Distinctions

Although the New York case and the San Bernardino case involved the same legal issue regarding the scope of the AWA, the two are factually distinct. The New York case involves an investigation into an alleged drug trafficking conspiracy, while the California case involved an investigation into a December 2015 terrorist attack on American soil. In addition, whereas law enforcement in the New York investigation are seeking an order to compel Apple to unlock a phone that it has the ability to unlock (an iPhone 5s running iOS7 software), law enforcement in the San Bernardino case asked the court to force Apple to create a software (which does not currently exist) that would override the security features on an iPhone 5c running iOS9, enabling law enforcement to unlock it themselves.

Overview of the All Writs Act

The AWA is part of the Judiciary Act of 1789 (enacted over 220 years ago). It enables all federal judges to issue orders (a.k.a. “writs”), at their discretion, if three requirements are satisfied: 1) Issuance of the order must be “in aid of” the court’s jurisdiction to protect the legal rights of the parties involved; 2) The type of order requested must be “necessary and appropriate” to the provision of such aid; and 3) The order must be “agreeable to the usages and principles of law.”

If these three statutory requirements are met, a court may issue an order under the AWA. The Supreme Court in United States v. New York Telephone Co. (1977) laid out additional factors that courts should consider before exercising their discretionary authority to compel assistance: 1) the closeness of the relationship between the entity to whom the order is directed and the matter at hand; 2) the reasonableness of the burden to be imposed on the entity; and 3) the necessity of the requested order.

Statutory Requirements

1) “In aid of” the court’s jurisdiction and “necessary and appropriate”: Based on the Supreme Court’s reasoning in N.Y. Tel. Co., Judge Orenstein concluded that the government’s requested order satisfied the AWA’s first two statutory requirements. Ordering Apple to assist the government by bypassing the iPhone’s security features would be “in aid of” the court’s jurisdiction to protect the government’s legal rights, given that the government obtained a lawful search warrant for the iPhone but it could not exercise that search warrant because of the iPhone’s security features. In addition, the order would be “necessary and appropriate” because, according to the N.Y. Tel. Co. reasoning, only writs expressly prohibited by Congress can place a judicial action beyond the bounds of what is “necessary and appropriate” under the AWA, and Congress has not explicitly prohibited the type of order requested by the government.

2) “Agreeable to the usages and principles of law”: Even if the first two requirements are met, the order must still satisfy the AWA’s third prong by being “agreeable to the usages and principles of law.” Judge Orenstein analyzed this prong by evaluating whether or not the order would be an appropriate application of the AWA’s gap-filling authority (which enables a court to act within a space where Congress has not acted yet). Based on legislative history and rules of statutory construction, Judge Orenstein concluded that the order would not meet this third requirement.

Legislative History and CALEA: First, Judge Orenstein agreed that the Communications Assistance for Law Enforcement Act (CALEA) explicitly exempts companies like Apple from having to provide the assistance that the government asked for in this case. Enacted in 1994, CALEA requires telecommunications service providers to assist law enforcement by redesigning their networks to make them easier to wiretap. The statute explicitly exempts certain types of businesses, including information service providers such as Apple, from its requirements.

The government did not dispute that CALEA does not apply to Apple, but argued that CALEA was irrelevant because it pertains to data “in motion,” whereas the government was asking for Apple’s assistance with retrieving data stored on a device – data “at rest.” Judge Orenstein replied that even if Congress did not regulate data “at rest” through CALEA, it did so elsewhere through other statutes such as the Stored Communications Act – none of which impose an obligation on Apple to provide the type of assistance that the government asked for in this case. Judge Orenstein agreed with Apple’s position that such an omission reflects a legislative choice, given that CALEA is part of a broader legislative scheme that regulates when law enforcement may access electronic data.

Statutory construction: Judge Orenstein also examined whether the AWA can be used for any order not expressly authorized or prohibited by the legislature (as the government argued) or if it only reaches powers that the legislature has not yet considered (as Apple argued). Based on the rules of statutory construction, which give meaning to all statutory words and clauses and prohibit interpretations that lead to absurd results, Judge Orenstein demonstrated that Apple’s interpretation of the AWA made more sense.

In evaluating whether or not the government’s requested order was “agreeable to” the “usages” and “principles” of “law,” Judge Orenstein pointed out that if Congress had wanted the AWA to merely require that a court’s orders not conflict with the laws on the books, it would have written the AWA to mandate that the order be “agreeable to the law.” Instead, it required that orders be “agreeable” to the “usages and principles” of the law, which must mean something else. In addition, if the AWA’s third requirement was only meant to require that an order not conflict with existing law, then it would be redundant given the second, “necessary and appropriate” requirement. To avoid this result, rules of statutory construction require that judges give separate meaning to each clause.

More importantly, Judge Orenstein maintained that the AWA cannot be used as a way for “the executive branch to achieve a legislative goal that Congress has considered and rejected” but not expressly prohibited, because such a use would lead to absurd results. For example, if the President were to send Congress a bill that compelled a certain action, and every member of Congress rejected the bill, under the government’s view of the AWA a court could issue an order compelling that action anyway because Congress did not explicitly prohibit it from doing so. In this case, it would enable courts to ignore the fact that Congress had already debated whether to expand CALEA’s requirements to companies like Apple, but chose not to do so. In other words, the government’s interpretation of the AWA would lead to absurd results because it would confer legislative authority of epic proportions on all federal courts.

Discretionary Factors

The N.Y. Tel. Co. case provided three additional factors that judges should consider when deciding whether and how to exercise their discretion under the AWA, and Judge Orenstein concluded that the factors counseled against issuing the government’s proposed order.

1) The closeness of the relationship between Apple and the underlying crime: Unlike the telephone company in N.Y. Tel. Co., Apple did not have any ownership interest in anything that the defendant in the current case used to commit his crime, and Apple was not involved in the commission of the crime.

2) The burden on Apple: Judge Orenstein concluded that the reasons for which the Supreme Court found a lack of an unreasonable burden in N.Y. Tel. Co. were all absent in the Apple case. Apple is not a “highly regulated public utility with a duty to serve the public;” it is a private company with no more of a duty to serve the public than any other private company. Moreover, Apple convinced Judge Orenstein that it was in its interest to not provide the assistance that the government asked for, because doing so would tarnish Apple’s brand as a leader in protecting its customers’ data. The government’s request in this case would compel Apple do something it found “offensive” to its business of providing secure devices to its customers, unlike the pen register that the government requested in N.Y. Tel. Co. case, which would have recorded information the company collected anyway in the normal course of business. In addition, Judge Orenstein was convinced that bypassing the iPhone’s passcode security would divert time and technology from advancing Apple’s normal business operations in this case and in the countless cases that would follow.

Finally, Judge Orenstein concluded that the government’s order posed a threat to Apple’s autonomy in a way that did not exist in the N.Y. Tel. Co. case. The order before Judge Orenstein contained no limiting principle that would constrain the lengths that a court may go to in the future in order to carry out its jurisdiction. Judge Orenstein asked the government whether, for example, the AWA could be used to force a drug maker to create lethal injection drugs to carry out a court’s death sentence despite the drug maker’s staunch moral beliefs against the death penalty. Without a limiting principle, there’s no telling what a court could compel Apple to do next – turn on an iPhone’s microphone to enable law enforcement officials to listen in on nearby conversations? Remotely activate a laptop’s web cam? Enable location tracking capabilities that have been deactivated by the user?

Given the time, financial, and moral burdens that the government’s order would impose on Apple, Judge Orenstein concluded that the AWA’s gap-filling function could not be used to convey such authority.

3) Necessity of the requested order: Judge Orenstein was not convinced that the government could access the iPhone’s contents only if Apple itself bypassed the phone’s passcode security.  Some evidence in the record suggested the government could achieve the same results by other means, leading Orenstein to conclude that the government had not proven that the order was necessary. Given that the FBI found a way to hack into the San Bernardino iPhone without Apple’s assistance, Judge Orenstein’s analysis of this “necessity” factor appears correct.

What’s Next

Prosecutors agreed with Apple’s request to delay this case given the FBI’s then-ongoing attempt to unlock the San Bernardino iPhone without Apple’s assistance. The DOJ committed to informing the court no later than April 11th whether or not it will be moving forward with the case, which may depend on whether the technique used to unlock the San Bernardino iPhone could work on the phone in Brooklyn, as well.

If the case goes forward, Judge Margo Brodie will consider the DOJ’s appeal and decide whether to accept, reject, or modify Judge Orenstein’s opinion. The opinion will be tough to reject, given the fact that it is logically sound, well-organized, and supported by case law and legislative history. However, even if Judge Orenstein’s opinion is struck down in New York, it may influence the hundreds of additional cases that will be brought by federal, state, and local law enforcement in the future. We can only hope that cybersecurity and privacy come out on top when (or if) the dust settles.