FBI Asked for Password Reset on Shooter's iPhone

In the chaotic aftermath of the shootings in San Bernardino, California, in December, FBI investigators seeking to recover data from the iPhone of one of the shooters asked a technician in the California county to reset the phone's iCloud password.

But that apparent fog-of-war error foreclosed the possibility of an automatic backup to the Apple iCloud servers that might have turned up more clues to the origins of the terrorist attack that killed 14 people.

"The county and the FBI were working together cooperatively to obtain data, and at the point when it became clear the only way to accomplish the task at hand was to reset the iCloud password, the FBI asked the county to do so, and the county complied," David Wert, a spokesman for San Bernardino County, said in an email.

(Also see:  Apple Ordered to Aid FBI in Unlocking California Shooter's iPhone 5c)

The Justice Department disclosed the misstep in a court filing Friday, which is part of a larger, high-stakes battle over whether the government can use the courts to force Apple to create software to help it unlock a customer's iPhone - in this case, one used by Syed Rizwan Farook. Farook, a county health worker, and his wife were killed in a firefight with police hours after the December 2 attack.

"This was happening hours after the worst terror attack since 9/11, and there were still credible reports of a third shooter," said a federal law enforcement official, speaking on the condition of anonymity to discuss an ongoing investigation. "It was a very dynamic time, and the number one priority was figuring out what happened and if there were more attacks coming."

According to senior Apple executives, the FBI's first call to Apple for help came on Saturday, December 5, at 2.46 a.m. With a subpoena, the bureau obtained subscriber data and other details. On Sunday, the FBI, with a warrant, obtained data from Farook's iPhone that had been backed up to iCloud. That backup contained information only through October 19, six weeks before the attack.

(Also see:  Why Even the FBI Can't Hack the iPhone)

The same Sunday, the FBI asked the county for help in retrieving data from the phone, Wert said in an interview. "So the county said we could get to the information on the cloud if we changed the password or had Apple change the password," he said. "The FBI asked us to do that, and we did."

It is not clear why the FBI needed to reset the password if it was able to obtain the backed-up data from Apple. The FBI did not immediately respond to a request for comment.

(Also see:  Apple vs. FBI: Is Your iPhone Safe?)

Nonetheless, by resetting the password, the county, which owned Farook's phone, and the FBI eliminated the possibility of seeing whether additional data beyond Oct. 19 might be recovered from the phone through the auto-backup feature, experts said.

The FBI in a court filing said Farook "may have disabled" the auto-backup. But, tech experts said, there might be other reasons the phone did not back up: It was not near a WiFi network it was familiar with, such as his home or workplace, or it was not turned on long enough to back up. With the password changed, it is impossible to know.

"Even though it has been reported that the iCloud backups were disabled, there still is data that may have been recoverable," said security expert Dan Guido, chief executive of Trail of Bits. Depending on the phone's settings, it might have synched notes, emails, address books - perhaps geolocation data - with the company's network.

"This could have resulted in nothing," Guido said. "Or it could have resulted in all the data on the phone."

The showdown between Apple and the government arises out of the FBI's inability to recover data from Farook's phone, especially for the weeks prior to the attack. The Justice Department on Tuesday got a federal judge to order Apple to build software to override an auto-wipe feature on the phone that deletes data after 10 failed tries to enter a password. The FBI could then try to crack the phone's password by "brute force," making many attempts without risking the wiping of the data.

Apple chief executive Tim Cook said the firm would challenge the order, warning that it would set a "chilling" precedent that could lead to more invasive requests for data. On Friday, the Justice Department fired back, charging that Apple's stance was motivated by "marketing"concerns as it promotes itself as a protector of consumer privacy.

© 2016 The Washington Post