San Bernardino Shooter's iCloud Password Reset With FBI Consent, Agency Says
The agency says it "worked cooperatively" with county officials to gain access.
— -- Federal investigators worked with San Bernardino County technicians to reset the password for the Apple iCloud account associated with the iPhone issued to one of the shooters involved with the Dec. 2 attack at a county facility that left 14 people dead.
The FBI released a statement late Saturday refuting a federal official who had said the agency was unaware the password was reset until after it had occurred on the iCloud account associated to Syed Rizwan Farook's iPhone. The official had said Friday a county information technology employee executed the reset without being asked to do so by federal authorities.
"Since the iPhone 5C was locked when investigators seized it during the lawful search on December 3rd, a logical next step was to obtain access to iCloud backups for the phone in order to obtain evidence related to the investigation in the days following the attack," said the FBI statement.
The FBI added it worked with county technicians to reset the iCloud password on December 6, which differed from court filings made by the Justice Department that said "the owner [San Bernardino County Department of Public Health], in an attempt to gain access to some information in the hours after the attack, was able to reset the password remotely, but that had the effect of eliminating the possibility of an auto-backup."
Farook and his wife Tashfeen Malik launched an assault on a holiday party on Dec. 2, 2015, killing 14 of Farook's coworkers.
The FBI stressed in its statement that the iCloud password reset didn't impact Apple's ability to assist in unlocking the iPhone left behind by Farook. The Justice Department has urged a federal judge to compel the tech giant to help the FBI crack open the iPhone.
"Even if the password had not been changed and Apple could have turned on the auto-backup and loaded it to the cloud, there might be information on the phone that would not be accessible without Apple's assistance as required by the All Writs Act order, since the iCloud backup does not contain everything on an iPhone," read the FBI statement. "As the government's pleadings state, the government's objective was, and still is, to extract as much evidence as possible from the phone."
The Justice Department has asked Apple to turn off the feature that erases an iPhone's data after 10 failed attempts to unlock the device so that investigators can run all possible combinations to break the four-digit passcode on Farook's phone. A federal judge ordered Apple to help the FBI but the company has said it plans to fight the order.
Prosecutors said Farook's device could be encrypted to the point that its content would be "permanently inaccessible," and, "Apple has the exclusive technical means which would assist the government in completing its search."
After the court order, Apple quickly vowed to challenge the decision.
"The United States government has demanded that Apple take an unprecedented step which threatens the security of our customers," Apple CEO Tim Cook said in a statement to customers Tuesday. "[T]his order ... has implications far beyond the legal case at hand."
"The FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on [the shooter's] iPhone," Cook added. "In the wrong hands, this software -- which does not exist today -- would have the potential to unlock any iPhone in someone’s physical possession."
In addition, all of the personal and sensitive information on customers' phones "needs to be protected from hackers and criminals who want to access it, steal it, and use it without our knowledge or permission," Cook wrote.
If the battle between the FBI and Apple continues, it's a matter that could work its way up to the U.S. Supreme Court.