Google and Apple can and will unlock smartphones and tablets when ordered to do so by a court, if the devices are not encrypted, a report from the Manhattan district attorney’s office has said.
The report, which details methods for extracting information from smartphones and other Android or iOS devices for law enforcement purposes when the owner does not give permission, explains that Apple can reset a locked phone with physical access to the device and Google can do similar remotely.
For either company to unlock the device without the owner’s permission the smartphone or tablet must not be encrypted, according to the report. Apple has enabled encryption by default in September 2014 with iOS 8 should a user set a passcode, which meant that the company could no longer unlock a device and access the data on it without knowing the user’s passcode.
According to data from Apple, 67% of Apple iPhone, iPad and iPod touch users are running iOS 9, 24% are using iOS 8 leaving 9% of users on iOS 7 or earlier.
Android more at risk
The situation is different for Android. Google’s version of Android, which runs on most Android smartphones and tablets in the western world, only implemented encryption by default with the latest version Android 6.0 Marshmallow released in October 2015.
“Apple’s and Google’s decisions to enable full-disk encryption by default on smartphones means that law enforcement officials can no longer access evidence of crimes stored on smartphones, even though the officials have a search warrant issued by a neutral judge,” said the Manhattan district attorney’s office.
Android’s full-disk encryption, which secures the phone’s entire storage and will not allow the device to start without a passcode, was implemented with Android 5.0 Lollipop but not enabled by default. Some other implementations of device encryption, such as Samsung’s Knox system, were available with earlier versions of Android.
Apart from Google’s Nexus 6, full-disk encryption was only optional until Marshmallow was released. Before then, users would have had to choose to enable encryption.
According to data from Google, Marshmallow is used by 0.3% of Google Android devices worldwide. Lollipop versions 5.0 and 5.1 account for 25.6%, while Android 4.4 KitKat accounts for the largest share of Android users with 37.8%.
The situation also extends to cloud backup services which these companies offer. Should the phone and backed-up data be encrypted, Google and Apple will be unable to access the data without the user’s password, according to the report.
Google contested the district attorney’s findings. Adrian Ludwig, Google’s security lead said: “Google has no ability to facilitate unlocking any device that has been protected with a pin, password, or fingerprint. This is the case whether or not the device is encrypted, and for all versions of Android.”
“There are some devices (far fewer than 75%, although we don’t have an exact number) that have been configured to use a ‘pattern’ to unlock. Until Android Lollipop, ‘pattern’ unlock did provide a recovery option with the Google account. This recovery feature was discontinued with Android Lollipop.”
Forcing tech companies to turn over user data
The Manhattan district attorney’s office argues that Apple and Google, the designers and distributors of the systems which run iPhones and Android devices, should be capable of recovering data from devices if issued with a court order. The attorney’s office says on security of personal data would be negligible.
“Apple and Google have never explained why the prior systems lacked security or were vulnerable to hackers and, thus, needed to be changed. It is therefore unclear why it would be unsafe for Apple and Google to retain the ability to access data on devices pursuant to search warrants,” the Manhattan district attorney’s office said.
New York County district attorney Cyrus Vance, Jr, is currently attempting to force both Apple and Google to change the way the devices are encrypted. The report includes letters addressed to both technology companies, as well as a bill to force the changes through.
“New York can and should lead the nation in protecting its citizens, and in responding to the misguided and dangerous attempts by digital device manufacturers to turn digital devices into virtual safes that, being beyond the reach of law enforcement, are havens for criminals,” said the report.
The message is clear. Apple’s iPhone users are safe from government snooping of their smartphone data if they are using a strong passcode and iOS 8 or above.
Android users on Lollipop or earlier should not use pattern unlock and should enable full device encryption within their device security settings if they wish to remove all potential access to their devices by a court order.
