Policy —

What is a “lying-dormant cyber pathogen?” San Bernardino DA says it’s made up [Updated]

He now says there's no evidence of cyber doom, wants iPhone unlocked to be sure.

What is a “lying-dormant cyber pathogen?” San Bernardino DA says it’s made up [Updated]

(This post was updated, recasted throughout late Friday to reflect new DA statements.)

One day after the San Bernardino County district attorney said that an iPhone used by one of the San Bernardino shooters might contain a "lying-dormant cyber pathogen," the county's top prosecutor went on the offense again. DA Michael Ramos said Apple must assist the FBI in unlocking the phone because an alleged security threat might have been "introduced by its product and concealed by its operating system."

Ramos' office said the "Companies that introduce dangerous products, and it can be argued that the iPhone with its current encryption is dangerous to victims, are required to fix them. Companies that create environmental damage are required to clean it up," the prosecutor said in a filing Friday afternoon.

The fact no one has heard of a pathogen that might carry devastating qualities has us and others wanting to know exactly what is a "lying-dormant cyber pathogen?" We asked Ramos' office to elaborate. Ars' e-mail and phone messages, however, were not returned.

As the chatter on Twitter and elsewhere could attest, security and forensics experts have never heard of this type of threat. Online commenters called it everything from a "magical unicorn" to a make-believe plot that we might see on the broadcast TV show CSI: Cyber.

But late Friday, Ramos told The Associated Press that his cyber doom suggestion was out of thin air.

"This was a county employee that murdered 14 people and injured 22," Ramos said. "Did he use the county's infrastructure? Did he hack into that infrastructure? I don't know. In order for me to really put that issue to rest, there is one piece of evidence that would absolutely let us know that, and that would be the iPhone."

Ramos had been tight-lipped on exactly what security threat may be on the passcode-protected phone of Syed Farook, a county worker who was one of two shooters in the Dec. 2 massacre that killed 14 and wounded scores of others. The prosecutor suggested in a court filing yesterday that the iPhone—a county phone used by Farook and recovered after the shooting—might be some type of trigger to release a "lying-dormant cyber pathogen" into the county's computer infrastructure. On Friday, the district attorney again demanded that a federal magistrate presiding over the dispute command Apple to help decrypt the phone.

Apple has not advanced a single argument to indicating [sic] why the identification and prosecution of any outstanding coconspirators, or to detect and eliminate cyber security threats to San Bernardino County's infrastructure introduced by its product and concealed by its operating system, and Apple's refusal to assist in acquiring that information, is not a compelling governmental interest.

To the extent that Apple states in its brief at page 33 that there is no compelling state interest because the government "has produced nothing more than speculation that this iPhone might contain potentially relevant information," Apple completely forgets that a United States Magistrate has issued a search warrant based on a finding of probable cause that the iPhone does contain evidence of criminal activity. The reason we search is to find out if the device contains evidence or is an instrumentality of the crime. Such authority is granted by the United States Constitution.

The FBI is demanding that Apple build software that would enable the government to defeat the passcode lock without data being lost on the phone the county issued to Farook. Apple has steadfastly rejected building what the tech company said amounts to an encryption backdoor. Apple says helping would weaken iPhone security overall. Until Ramos' court filings on Thursday and Friday, the authorities have been maintaining that the phone might provide evidence of possible co-conspirators that have escaped justice. The authorities also say there are hundreds of phones in prosecutors' hands that need unlocking to help solve crimes.

Magistrate Sheri Pym has already ordered Apple to build the software. A hearing on Apple's challenge is scheduled for March 22 before Pym in Riverside federal court.

Apple declined comment.

Channel Ars Technica