Can the FBI force a company to break into its own products?

SAN FRANCISCO  — Can the FBI force a company like Apple to extract data from a customer’s smartphone? In the fight over an iPhone used by an extremist killer in San Bernardino, some legal experts say Congress has never explicitly granted that power. And now a federal judge agrees in a similar case.

In a New York drug case that echoes the much higher-profile San Bernardino dispute, US Magistrate James Orenstein has ruled the government doesn’t have authority to make Apple pull information off a suspect’s iPhone. The judge said in his ruling that Congress has already considered, but rejected, extending the government’s authority in this fashion.

Orenstein cited the history of a 20-year-old federal law — one that requires phone companies to assist police in conducting court-authorised wiretaps. Congress has resisted attempts over the years to extend that authority to tech companies like Apple, according to experts who have studied the law, known as the Communications Assistance for Law Enforcement Act, or CALEA.

Federal prosecutors have argued that a much older law known as the All Writs Act allows courts to compel private parties to assist law enforcement. But Orenstein said that shouldn’t apply when, in his words, “Congress has considered legislation that would achieve the same result but has not adopted it.”

The New York ruling isn’t binding on the magistrate in the San Bernardino case. And federal authorities said Monday they’ll appeal Orenstein’s decision. But a senior Apple executive, who spoke on condition that he wouldn’t be named, said Apple believes Orenstein’s ruling is both persuasive and relevant to the issues at stake in San Bernardino.

In that case, the FBI wants Apple to create software that would bypass some iPhone security features, making it easier to guess the passcode that would unlock it. Prosecutors say they’re only seeking what amounts to routine cooperation; Apple and its supporters say the request is unprecedented and would make other iPhones vulnerable to hacking by authorities and criminals alike.

By contrast, US phone carriers have long been required to design and build their networks in ways that allow federal wiretaps of digital phone calls. That government authority stems from CALEA, a 1994 law that drew heated debate before it passed, and even more controversy on occasions when federal officials sought to expand its scope. Tech industry and civil liberty groups have mostly succeeded in blocking those efforts.

Even before Orenstein’s ruling, some legal experts said in recent weeks that the history of CALEA suggests that authorities are overreaching in the San Bernardino case.

The law was narrowly focused and “the product of years of public debate, with many compromises on both sides of that debate,” said Ahmed Ghappour, a visiting professor who focuses on tech issues at the University of California, Hastings School of the Law. “That’s what Congress is for.”

As with the iPhone dispute today, the 1994 law was enacted at a time when the nation’s police agencies were struggling to keep up with new technology. Authorities feared that a switch from old-fashioned copper wire to digital phone networks would hinder their eavesdropping capabilities.

CALEA intentionally covers only telecommunication carriers and specifically excludes “information service providers” — including Internet companies such as Apple and Google. Extensive negotiation produced a law that preserved the wiretapping ability authorities already had without adding new types of surveillance capabilities, said Deirdre Mulligan, co-director of the Centre for Law & Technology at the University of California, Berkeley

The Federal Communications Commission updated CALEA-related regulations in 2005 to extend the government’s sway to voice-over-Internet phone services. Moves to expand it further, however, have fizzled, according to a report by the Congressional Research Service, which cited proposals for extending the law to “a wide range of technology services”, including instant messaging and video game chats.

“This is a power that Congress has had numerous opportunities to extend and has chosen not to,” said Mulligan.

Federal authorities argued that CALEA isn’t relevant to either iPhone case. But Apple and its supporters are likely to cite CALEA in the San Bernardino case, said Alex Abdo, an ACLU attorney who is helping draft a “friend-of-the-court” brief on Apple’s behalf. He said the All Writs Act can only be used to enforce authority the government already has, such as a legal search warrant.

The history of CALEA shows that if Congress wanted the government to have the authority it’s invoking against Apple, “it would have given it already,” said Abdo, echoing the New York magistrate’s ruling.