Wednesday, February 24, 2016

James Ramsey

The recent relationship between Apple, Inc. and the FBI presents challenges to our concepts of law enforcement, security and privacy. The main function of homeland security is, and always has been, the defense of Liberty and the protection of the free flow of people and commerce. This, plus the ideal that Democratic societies are always in tension between the will of the majority and the needs of the minority, provides a convenient jumping off point.

On one hand, Apple Inc. (and other corporations like it) have a fiduciary obligation to their customers and shareholders to provide "adequate" security in order to prevent identity theft, financial loss, etc. If one's personal identifying information were (relatively) easy to hack, people would be less inclined to buy or use the product - a critical point given how our society has evolved in the last 25 years. We need to appreciate the how deeply entrenched and dependent we are on digital transactions. Consider that for many, payroll, healthcare, and even retirement and savings are routinely done digitally and particularly on smart devices like the iPhone. This is a major reason Apple built the encryption logic as securely as they did; they want to protect the 10s of millions of people using their devices from financial ruin and identity theft. This is not only a very legitimate business strategy, I would submit that is is also an incredibly necessary one to the health of our economy and, by extension, our privacy and national security.

On the other hand, the FBI has a fiduciary and Congressional charter to protect the U.S. population as a federal law enforcement agency. And within this role they are considered the lead U.S. agency in counter-terrorism efforts. Authorities, as well as the reasonable person, suspect that the San Bernardino terrorists quite likely have personal information and other connections/networking/data on their phone (as so many of us do today). Speedy access to this information would add depth of understanding to not only what they did, but how they did it, and more importantly, who they worked with, hung out with, and with whom they networked and conspired. Such data may also provide clues as to how we might prevent a similar incident from occurring.

In this case, as in all such cases, such information is central to both investigation and prevention efforts. As such, the FBI is completely legitimate in their need for such information and their request to Apple, Inc. We might consider such a request to be materially no different than getting a search warrant and going through personal belongings in one’s home.  

The quandary is the way in which such potentially critical information is protected. People no longer hide things in ceilings or under mattresses. And while the Internet has greatly enhanced the quality of life and the convenience of business for many, it has also provided safe havens and ways for nefarious people and organizations to connect and hide from the law. In this same way, modern encryption on smart devices makes our lives more convenient and enjoyable, but also provides great challenges — both legally and technologically — for absolutely normal and vital law enforcement activities to take place.

In my view, we want society to trust the good work and intentions of law enforcement. We also want to trust the integrity and privacy of our personal information on the devices we depend for many activities of daily living.   

There remains no doubt as to the guilt and culpability of the San Bernardino perpetrators; there's no question about what they did, their guilt and there's no trial forthcoming where a presumption of innocence would exist. So the exceptional request placed by the FBI on to Apple, Inc. comes down to this: Do the needs of law enforcement to protect and serve greater society outweigh the societal good that comes from encrypted privacy?

As a security professional, I can see both sides of the debate. This case seems unprecedented to me because of the challenges that modern society places on personal information and the ways in which our society is mended together through the Internet and smart devices. It appears likely that this case will be debated and resolved in court. Ultimately, and however difficult the future of this debate becomes, it is imperative that we remain a nation governed by the rule of law and not corporations, agencies, or individuals - that is, I wonder how such a case might be resolved in China or Russia.

Professor James Ramsay, Ph.D., M.A., CSP, joined UNH Manchester in 2015 where he developed a new bachelor of science program in homeland security. Ramsay came to UNH from Embry-Riddle Aeronautical University, where he served as the founding chair of the department of Security Studies and International Affairs after creating the homeland security program in 2006. 

Ramsay is widely recognized as one of the nation’s foremost authorities on homeland security education, with expertise in a wide range of health, emergency management planning and evaluation issues, as well as occupational safety and environmental health. His research areas of interest focus on the relationship between environmental and human security, resilience, and national security strategic planning, as well as the design and economic evaluation of health, safety, and prevention programs.