This week I signed the Electronic Frontier Foundation’s amicus (friend-of-the-court) brief in the Apple/FBI iPhone-unlocking lawsuit. Many prominent computer scientists and cryptographers signed: Josh Aas, Hal Abelson, Judy Anderson, Andrew Appel, Tom Ball (the Google one, not the Microsoft one), Boaz Barak, Brian Behlendorf, Rich Belgard, Dan Bernstein, Matt Bishop, Josh Bloch, Fred Brooks, Mark Davis, Jeff Dean, Peter Deutsch, David Dill, Les Earnest, Brendan Eich, David Farber, Joan Feigenbaum, Michael Fischer, Bryan Ford, Matt Franklin, Matt Green, Alex Halderman, Martin Hellman, Nadia Heninger, Miguel de Icaza, Tanja Lange, Ed Lazowska, George Ledin, Patrick McDaniel, David Patterson, Vern Paxson, Thomas Ristenpart, Ron Rivest, Phillip Rogaway, Greg Rose, Guido van Rossum, Tom Shrimpton, Barbara Simons, Gene Spafford, Dan Wallach, Nickolai Zeldovich, Yan Zhu, Phil Zimmerman. (See also the EFF’s blog post.)
The technical and legal argument is based on the First Amendment: (1) Computer programs are a form of speech; (2) the Government cannot compel you to “say” something any more than it can prohibit you from expressing something. Also, (3) digital signatures are a form of signature; (4) the government cannot compel or coerce you to sign a statement that you don’t believe, a statement that is inconsistent with your values. Each of these four statements has ample precedent in Federal law. Combined together, (1) and (2) mean that Apple cannot be compelled to write a specific computer program. (3) and (4) mean that even if the FBI wrote the program (instead of forcing Apple to write it), Apple could not be compelled to sign it with its secret signing key. The brief argues,
By compelling Apple to write and then digitally sign new code, the Order forces Apple to first write a message to the government’s specifications, and then adopt, verify and endorse that message as its own, despite its strong disagreement with that message. The Court’s Order is thus akin to the government dictating a letter endorsing its preferred position and forcing Apple to transcribe it and sign its unique and forgery-proof name at the bottom.
There are millions of iPhones that rely on Apple’s considered opinion about whether it’s a good idea to install a software update. Or, if you like, there are millions of iPhone owners who rely on Apple’s considered opinion about what software updates are safe and advisable to install on their phones, and who have deliberately purchased phones that implement this personal reliance by the mechanism of public-key authentication. The FBI seeks to force Apple to sign a statement in contradiction with its values. But “compelled speech doctrine prevents the government from forcing its citizens [and corporations] to be hypocrites.”
Regarding whether (1) computer programs are a form of speech, the EFF’s brief cites three previous Federal cases where appellate courts have upheld this principle:
It is long settled that computer code, including the code that makes up Apple’s iOS operating system and its security features including encryption, is a form of protected speech under the First Amendment. Universal City Studios, Inc. v. Corley (2d Cir. 2001); Junger v. Daley (6th Cir. 2000); Bernstein v. DOJ (9th Cir. 1999). Code consistently receives First Amendment protection because code, like a written musical score, “is an expressive means for the exchange of information and ideas.” (Junger, 209 F.3d at 484.) In Corley, which similarly considered code that could be used to undermine security, the Second Circuit held that “[c]ommunication does not lose constitutional protection as ‘speech’ simply because it is expressed in the language of computer code. Mathematical formulae and musical scores are written in ‘code,’ i.e., symbolic notations not comprehensible to the uninitiated, and yet both are covered by the First Amendment.” (273 F.3d at 445–46.) [citations abridged.]
I am proud to have participated in each of these three cases. In Bernstein v. Daley I wrote this declaration in 1996 (a form of written testimony about facts), saying, “yes, we scholars publish computer programs just like we publish natural-language papers; I have been publishing open-source software since 1988.” In Junger v. Daley I wrote this similar declaration in 1997. These two cases were the foundation of the 1990s victories in “freedom of cryptography” in the United States.
In Universal City Studios, Inc. v. Corley I not only wrote a declaration, I testified as a witness in Federal Court in New York. The “DMCA police” mostly won that case, unfortunately, but even so, the judges at both levels (district court and appellate court) agreed that source code is speech.
Professor Richards has argued that the “Code=Speech” argument is problematic, that this is not the best argument in favor of Apple’s position. He says, even if Code is Speech, there are other restrictions on speech that (the courts have held) are consistent with freedom of expression. But he does agree with the digital-signature argument:
“making Apple write and disseminate this particular code—making it lie to one of its customers—could be seen as a kind of compelled speech, and that could violate the First Amendment. But this wouldn’t be the case merely because (as Apple assumes) Code = Speech and the FBI was compelling the creation of code. Instead, it would be offensive to the First Amendment because the particular act being compelled—authenticating a security update as true when it was false—would be compelled false communication in a relationship of trust. The law on this narrow question is underdeveloped, but it could allow Apple to win on free speech grounds.”
Other amicus briefs in support of Apple focus on other important and excellent arguments. The brief from Stanford, signed by Dino Dai Zovi, Dan Boneh, Charlie Miller, Hovav Shacham, Bruce Schneier, Dan Wallach and Jonathan Zdziarski, argues that “[f]orcing device manufacturers to create forensic capabilities for U.S. investigators creates security risks” and “security breaches are all but certain when law mandates government access.” I agree completely with this brief as well (but one can’t sign every brief!).
The ACLU’s brief argues, “The All Writs Act does not authorize the government” to compel Apple to do this, in part because “Congress has deliberately withheld the authority sought here;” and that “the order the government seeks violates the Fifth Amendment.” I quite agree with the ACLU, of which I have been a member since 1988; but I am a computer scientist, not a lawyer, so on that amicus brief my computer-security and computer-science expertise does not specifically apply.
