How Apple became the encryption champ – and an FBI target | McClatchy Washington Bureau

The Justice Department’s legal offensive to force Apple to unlock the iPhone of San Bernardino shooter Syed Farook can be traced to one reality: Apple simply offers far better encryption capabilities than its smartphone competitors.

“If Farook used an Android phone, then it likely would not have disk encryption turned on at all,” said Dan Guido, co-founder of the Trail of Bits information security consultancy.

Without such encryption “all of the data from the phone would be immediately accessible without the passcode,” Guido said.

The court fight between Apple and the FBI erupted not just because California terrorist Farook happened to use an iPhone, but also because Apple has taken mainstream digital security to an unprecedented level in the past two years.

The FBI’s attempt to force Apple to unlock the phone used by Farook, who along with his wife killed 14 people in the San Bernardino terror attack, has turned Silicon Valley’s push for encryption into a national debate.

That debate, in turn, traces its origins to another major controversy – Edward Snowden’s revelations in 2013 that the National Security Agency was collecting information on every cell phone in use in the United States and eavesdropping on Internet communications as well.

That made improving encryption – the process by which data are scrambled so they can’t be read without the proper codes – a top priority for Silicon Valley.

“Tech companies have become much more sensitive to whether they are perceived as being an advocate and protector of security post-Snowden,” said Christopher Budd, global threat communications manager for security firm Trend Micro.

And Apple is winning the smartphone security race, Budd said.

“Most security people I know have iPhones rather than Androids,” he said.

While there might seem to be a lot of smartphones to choose from, the market fundamentally is Apple versus Google’s Android. Eighty-three percent of smartphone users worldwide have the Android operating system running on smartphones that are nearly all made by companies other than Google. Samsung, Motorola, LG, Sony, HTC and Huawei produce a wide range of Android devices that vary in price and quality.

An unlocked iPhone 6S starts at $649 while a Motorola Moto G can be had for less than $200.

Android controls 51 percent of the U.S. market, where it is often a cheaper alternative to Apple. Forty-four percent of Americans use Apple’s iOS operating system, which runs only on the company’s own devices.

Microsoft has 3 percent of the American market share. Blackberry, once the industry standard for digital security, is down to just 1.3 percent of the market.

“If you walk into a Best Buy, most of the Android phones on the shelf will not be encrypted by default,” said Chris Soghoian, principal technologist at the American Civil Liberties Union. “If you walk into the store and come out with an Apple iPhone, the data on it is encrypted by default – with a key that Apple doesn’t have – so Apple is not able to unlock for law enforcement, and a criminal or identity thief who steals your phone isn’t able to get anything off of it.”

Text messages between iPhones are also encrypted so Apple can’t access them, Soghoian said. So are video or voice calls made using Apple’s FaceTime function.

Apple began encrypting FaceTime and iMessage in 2009. But the big leap came in September of 2014 when Apple announced that its iPhone operating system would have automatic encryption and the company itself could not access the data.

Once that happened, the conflict with law enforcement was inevitable.

How Apple made the leap is a tribute not just to engineering prowess but to the competition fostered by the very law Congress is now considering changing as a result of the San Bernardino phone. U.S. Rep. Robert Goodlatte, a Virginia Republican, takes credit for the enabling Apple to make those technological advances.

“Over 15 years ago, I led congressional efforts to ensure strong encryption technologies and to ensure that the government could not automatically demand a back-door key to encryption technologies,” Goodlatte said. “This enabled the U.S. encryption market to thrive and produce effective encryption technologies for legitimate actors, rather than see the market head completely overseas to companies that do not have to comply with basic protections.”

Google quickly followed Apple, saying in 2014 that the newest Android phones would be encrypted by default. The problem is – unlike Apple – Google doesn’t make the chips or the phones and did not have the power to force phone manufacturers to encrypt.

That became an issue when it turned out that phones lacking more expensive chips slowed when Android encryption was turned on, said the ACLU’s Soghoian.

“The Android market is very competitive,” Soghoian said. “Samsung couldn’t sell a phone that was half as fast as the previous year’s model. No one would buy it.”

The result was that most Android phones don’t have automatic encryption. Android users generally have the option to turn on encryption but that doesn’t mean they know how to do so.

Google does require encryption by default on high-performing devices such as Samsung’s new Galaxy S7 that use Android’s latest Marshmallow operating system. But just 1.2 percent of Android smartphones on the global market are running on Marshmallow at this point.

Google’s own Nexus phones also have automatic encryption.

There are social consequences to Android dominating the bargain end of the market, Soghoian said, with minorities and the poor far more likely to have an Android than an iPhone.

“Those in our society who are the greatest targets of surveillance by the authorities are using devices that protect them the least,” Soghoian said. “The middle class and the rich already have iPhones.”