Law Enforcement is Using a 226-Year-Old Law to Force Tech Companies to Unlock Mobile Phones

UPDATE [2/22/16]: The ACLU filed a follow-up FOIA request today, a week after the government asked a California court for an order requiring Apple to create and “sign” software that could be used to disable certain security features on an iPhone connected to the San Bernardino shootings. Given that this type of assistance goes beyond helping to unlock a mobile phone, we wanted to make sure we get records on all instances where the government has invoked the All Writs Act to force a technology company to assist a law enforcement investigation, including by creating software that does not exist.

The government is increasingly relying on an 18th-century law to compel third parties to unlock mobile devices and circumvent an important public debate about its right to do so.

The ACLU, along with the ACLU of Northern California and the Stanford Center for Internet and Society, filed a Freedom of Information Act request today seeking records related to the government’s use of the All Writs Act to force device manufacturers to unlock mobile devices and give law enforcement access to the data stored on them. We filed this FOIA request so that the public can know the full extent of the government’s use of this statute to seek such extraordinary authority.

After years of secrecy, the battle over when law enforcement can force device manufacturers and other technology companies to bypass the security measures on their products is finally playing out in court. Last month, Apple challenged the government’s attempt to get a court order compelling Apple to unlock and make available personal data stored on a passcode-protected iPhone. The government argued that the All Writs Act authorizes such an order, but as we argued in an amicus brief we filed, it does no such thing. The All Writs Act permits a court to issue an order to give effect to a prior lawful order or an existing grant of authority, and has been used for such things as ordering a prisoner be brought before a court. The Act does not allow a court to invest law enforcement with investigative tools that Congress has not authorized — like the extraordinary and unconstitutional conscription of a third party into obtaining information the third party does not possess or control.

While the power the government seeks in Apple’s case is troubling, it’s even more troubling to consider that the government, by its own admission, has invoked it successfully in at least 70 cases.

We know little to nothing about those 70 cases, which is why we’re filing the FOIA request. The government has sought individual, often sealed orders in unrelated cases, creating a patchwork of public and non-public documents that are difficult to track down and identify. When we submitted our amicus brief, we were aware of only three cases in which the government had applied for and obtained an order under the All Writs Act to compel a third party to unlock a mobile device. In its brief, the government cited three additional cases in which it had obtained similar orders. But for each case the government cited as a prototypical example of its use of the All Writs Act to compel Apple to unlock a device, the public had little or no notice that the government sought and obtained such an order. Even for the six known cases, many documents — including the government’s reasons and justifications — remain under seal.

This secrecy is especially insidious because the government has used the All Writs Act to get what it wants without regard to the current public debate about whether tech companies should be required to build technological “backdoors” into secure devices. Given that this debate is ongoing and robust, and that even the Obama administration previously publicly shelved its pursuit of legislation mandating the creation of backdoors, law enforcement’s shortcut by way of the All Writs Act should be scrutinized.

The American people deserve to know more about the government’s parallel and largely hidden effort to implement a policy that co-opts technology companies into law enforcement work.