FBI confirms it won't send method used to hack San Bernadino iPhone to a government review that could have forced FBI to share info about the method with Apple
Chris Strohm / Bloomberg :
Context & Ripple Effects
This closes the loop on the San Bernardino standoff. After the DoJ withdrew its legal action against Apple once a third-party tool cracked the shooter's iPhone, the open question was whether the exploit would go through the government's internal equities review — the process that could have obliged the FBI to tell Apple what it bought. Reporting had already suggested the FBI planned to keep the method secret and discourage the White House from reviewing it; today's confirmation makes that official policy.
The stakes are sharpened by what the corpus established about the tool itself: the FBI paid hackers for an undisclosed software flaw rather than using Cellebrite, and confirmed the technique does not work on the iPhone 5s or anything newer. That means the secret concerns a narrow window of vulnerable hardware — but Apple still doesn't know what the flaw was.
First-order effects
- Apple learns nothing: by skipping the review, the FBI forecloses the one mechanism that could have forced disclosure of the flaw, leaving every iPhone owner — including owners of pre-5s models the tool does work on — dependent on Apple discovering the weakness independently.
- The White House review process is bypassed entirely, so no interagency judgment on whether this specific exploit's defensive value outweighs its offensive value ever gets made.
Second-order effects
- Apple must harden future devices against an unknown vector, which pushes it toward broader architectural defenses (the kind of lockdown that made the 5s and later immune to this tool) rather than patching a named bug.
- The gray-market exploit vendors who sold the FBI this capability now have a proven buyer with demonstrated willingness to pay and to shield purchases from scrutiny — strengthening the commercial market for phone-breaking tools aimed at law enforcement.
Third-order effects
- The secrecy is holding up institutionally: a judge has since ruled the FBI need not even name the vendor that unlocked the phone in the FOIA suit brought by Vice, USA Today, and AP — suggesting acquisition of private exploits sits largely outside both disclosure review and public accountability.
- If the pattern holds, the FBI-vs-Apple courtroom fight gives way to procurement: agencies sidestep compelled cooperation with device makers by buying their way in, and the policy battleground shifts from whether companies can be forced to unlock phones to whether exploit purchases should face any equities process at all.
The trend: Law enforcement is shifting from compelling companies to unlock devices toward quietly purchasing private exploits that keep both the flaw and the seller hidden from oversight.