CBS News: FBI paid more than $1M for San Bernardino iPhone “hack”

April 21, 2016
Alex Hagan
Digital Forensics

Originally published by CBS News.

FBI Director James Comey alluded to the fact the bureau paid more than $1 million for the method used to disable the security feature of the San Bernardino shooter’s iPhone.

At an Aspen Institute discussion in London, Comey said the FBI paid more money than he would make in the time left as FBI director. He has over seven years left on his term and makes roughly just under $200,000 a year based on public files.

“How much did you pay for this software?” Comey was asked.

” A lot,” he said

“Really?”

“More – let’s see. More than I will make in the remainder of this job, which is seven years and four months, for sure,” Comey said.

” Wow.”

“And so it’s a – but it was in my view, worth it, because it’s a tool that helps us with a 5c running iOS9, which is a bit of a corner case, increasingly as the devices develop and move on to the 6 and 6s and whatnot and iOS’s change, but I think it’s very, very important that we get into that device.” Comey said.

He did not give a more specific figure.

A law enforcement source told CBS News last week that so far nothing of real significance has been found on the San Bernardino terrorist’s iPhone, which was unlocked by the FBI last month without the help of Apple.

It was stressed that the FBI continues to analyze the information on the cellphone seized in the investigation, senior investigative producer Pat Milton reported.

Investigators spent months trying to gain access to data on the locked iPhone used by San Bernardino gunman Syed Rizwan Farook, believing that it might hold information on the plans or contacts of the attackers, who killed 14 people on December 2, 2015.

Apple was fighting a court order to assist the FBI in bypassing the phone’s security measures. On March 28, the FBI announced that it had managed to unlock the phone and was dropping the court fight with Apple.

The FBI has not disclosed what method it used to access the data on the iPhone but the method is believed to have been developed by a third party, a private entity, the government has refused to identify.

Comey said two weeks ago that the bureau has not decided whether to share details with Apple about how it hacked into Farook’s iPhone 5c.

“If we tell Apple, they’re going to fix it and we’re back where we started,” Comey said. “As silly as it may sound, we may end up there. We just haven’t decided yet.”

The bureau has told local police departments that it will help them unlock cellphones in cases where it could provide evidence, CBS News John Blackstone reported.

But cracking the code is easier said than done.

When the FBI launched its search for a way to unlock Farook’s iPhone 5c, the technicians at a California company called Drivesavers were among those who took up the challenge. They have plenty of experience rescuing broken iPhones.

“You know, we see anywhere from a 100 to 300 iPhones a month right now,” Michael Cobb, Drivesavers’ director of engineering, told CBS News.

Cobb said his team can remove the chip that holds a phone’s encrypted data — but they can’t just read what is on it.

“The encryption is not simple to retrieve,” he said.

A company the FBI has not identified found a way around Apple’s encryption. The effort at Drivesavers shows what they had to overcome. Try the wrong password too many times and the phone wipes its memory clean.

“In the case of the 5c, you only have 10 attempts before the iPhone gets erased,” Cobb explained.

To make sure the chip doesn’t get erased, they copy it. Then put it in a device they’ve created that simulates an iPhone but lets them reset the chip’s password counter to zero after every ten attempts.

“It all depends on how fast you would be able to pull the data off, make that copy, do your 10 attempts,” Cobb said.

Drivesavers hasn’t yet defeated Apple’s password protection, but over the past 30 years, they have retrieved information from computers that have been burned, broken and deliberately smashed.

While law enforcement comes looking for evidence, many of Drivesavers’ clients are family members trying to recover the messages and photographs of a loved one who has died — leaving behind their phone, but not their password.