San Bernardino DA: Clues to Unconfirmed 3rd Shooter, 'Cyber Pathogen' Could Be on iPhone

Official speculates phone could be used to harm infrastructure with computer bug

ByABC News
March 4, 2016, 12:00 PM

— -- The San Bernardino, California, district attorney suspects that shooter Syed Rizwan Farook’s iPhone could hold information about an unconfirmed third gunman in the December shooting spree, or maybe even what he calls a “cyber pathogen” set to harm the local infrastructure.

In an amicus brief lodged Thursday for the court’s consideration, local D.A. Mike Ramos wrote to a U.S. District Court in California, “At the time that the murders were being perpetrated at least two 911 calls to the San Bernardino Police Dispatch center reported the involvement of three perpetrators.”

“Although the reports of three individuals were not corroborated, and may ultimately be incorrect, the fact remains that the information contained solely on the seized iPhone could provide evidence to identify as of yet unknown co-conspirators who would be prosecuted for murder and attempted murder in San Bernardino County by the District Attorney,” the filing says.

Last month ABC News reported that although only two shooters -- Farook and his wife, Tashfeen Malik -- have been confirmed as responsible for the deaths of 14 people in the Dec. 2 massacre, the FBI hasn’t ruled out the possibility of a third suspect. Some eyewitnesses, including Sally Abedlmageed, insisted there were three, telling ABC News in February, “I know what I saw.”

PHOTO: The San Bernardino County Sheriff's Office released photos of weapons and ammunition carried by the suspects accused in an officer-involved shooting on Dec. 2, 2015.
The San Bernardino County Sheriff's Office released photos of weapons and ammunition carried by the suspects accused in an officer-involved shooting on Dec. 2, 2015.

Other officials, however, are skeptical about the existence of a third gunman. Lt. Mike Madden, who was the first officer on the scene, said there was no evidence pointing to a third shooter, and a counterterrorism official involved in the investigation previously told ABC News that witnesses’ brains can play tricks on them in high-stress situations.

Taking another tact in his push to have the phone opened, Ramos also said in his filing, as first reported by Ars Technica, that the iPhone “may contain evidence that can only be found on the seized phone that it was used as a weapon to introduce a lying dormant cyber pathogen that endangers San Bernardino County’s infrastructure.” By using the unusual term “cyber pathogen,” Ramos is likely referring to malware that is more generally described as a computer “worm” or “virus.”

Just a couple weeks after the San Bernardino shooting, malware that targeted infrastructure in Ukraine knocked out power for nearly a quarter million people.

Ramos’ office told ABC News that they do not have any evidence that there is a “cyber pathogen” on the phone. The Department of Homeland Security, whose cyber teams help protect American infrastructure, did not respond to a request for comment about the supposed threat.

Farook’s iPhone, which is actually owned by a county health department for which he worked, is at the center of a contentious national debate over privacy and security that has involved impassioned Congressional testimony from both FBI head James Comey, who wants the courts to compel Apple to develop a method to unlock the phone, and the chief of Apple, Tim Cook, who argues that Apple currently does not have the capability and it would be a security liability to all iPhone users if the company created one.

Allan Lengel and ABC News' James Gordon Meek contributed to this report. This report has been updated.