…from: http://arstechnica.com/tech-policy/2016/02/apple-we-tried-to-help-fbi-terror...
Apple: We tried to help FBI terror probe, but someone changed iCloud password Exec: No other country has asked Apple for what US is asking for now. by Cyrus Farivarhttp://arstechnica.com/author/cyrus-farivar/ - Feb 19, 2016 8:05pm CST
On Friday, an Apple executive explicitly confirmed what was stated in a government court filinghttps://www.documentcloud.org/documents/2715997-Apple-iPhone-Access-MOTION-to-COMPEL.html earlier in the day: that in the early hours of the San Bernardino terrorism investigation, county officials may have inadvertently compromised their ability to access the data on the seized iPhone 5C.
Earlier this week, Apple was given an unprecedented court orderhttp://arstechnica.com/tech-policy/2016/02/judge-apple-must-help-fbi-unlock-san-bernardino-shooters-iphone/ to create custom firmware for the iPhone 5C that was used by Syed Rizwan Farook. That new firmware would remove a possible automatic wipe feature on the phone if a passcode is incorrectly entered 10 times and would remove a delay between passcode attempts intended to make brute-force entry more difficult. If Apple does comply, it would allow the government to enter PIN codes in rapid succession until it gained access to the phone. Apple CEO Tim Cook has publicly said it will resist this attempt, calling it a significant “overreach.” A court hearing has been scheduledhttps://www.documentcloud.org/documents/2716342-Apple-iPhone-Access-Scheduling-ORDER.html for March 22, 2016, in nearby Riverside, California.
During the Friday call, the unnamed Apple executive said the company has been diligently working with the FBI to try to aid the terrorism investigation. After days of working with the FBI, Apple proposed one final attempt to recover roughly six weeks of data that was locked on the phone.
The idea was to force the iPhone 5C to auto-backup to Farook’s iCloud account. With a legal court order, Apple can and does turn over iCloud data. For some reason, Farook had not backed up the phone for roughly six weeks prior to the attack. The executive said Apple does not know whether the auto-backup was disabled or enabled, but he did say that the previous iCloud backups, which were handed over to investigators, were sporadic.
Apple suggested that the FBI take the iPhone 5C, plug it into a wall, connect it to a known Wi-Fi network and leave it overnight. The FBI took the phone to the San Bernardino County Health Department, where Farook worked prior to the December 2, 2015 attack.
When that attempt did not work, Apple was mystified, but soon found out that the Apple ID account password had been changed shortly after the phone was in the custody of law enforcement, possibly by someone from the county health department. With no way to enter the new password on the locked phone, even attempting an auto-backup was impossible. Had this iCloud auto-backup method actually functioned, Apple would have been easily able to assist the FBI with its investigation.
The executive only revealed this detail to reporters now because it had thought it was under a confidentiality agreement with the government. Apple seems to believe this agreement is now void since the government brought it up in a public court filing.
Given that this iCloud backup tactic could not even be attempted, the Department of Justice pulled out all the stops, and asked a judge to order that Apple re-write the firmware. The Apple executive also made a point of saying that no other government—not even China or Russia—has ever asked what American prosecutors have asked the company to do this week.
On the call, Apple's press representative refused to articulate why the company would not go on the record with its call with journalists.
Also on Friday, the House Committee on Commerce invited both FBI Director James Comey and Apple CEO Tim Cook to testify on the issue of encryption.