GWC Injury Lawyers Partner Lance Northcutt recently spoke with NBC News about iPhone-hacking software that may currently be used by law enforcement officials.
Hide UI Logs iPhone Passcodes
Apple has spent years and millions of dollars opposing an industry that works to help law enforcement agencies break into iPhones. But according to a report by NBC News, another tool currently being employed by the agencies may already be allowing them to log passcodes as users type them in.
The software, known as Hide UI, was created by Grayshift, a company that makes iPhone-hacking devices for law enforcement. It can track a suspect’s passcode when it is entered into a phone, according to two people in law enforcement who spoke to NBC News.
The software has been available for approximately a year, but its existence has been kept secret, partly because of the nondisclosure agreements that police departments sign when they buy a device from Grayshift known as GrayKey.
GrayKey is a small box with two iPhone lightning cables sticking out of it. A law enforcement official can plug any recent model of iPhone into the cables to install an “agent” – a piece of software – onto the device. The agent will then attempt to crack the passcode. It can take minutes to crack a four-digit passcode and less than a day to crack a six-digit passcode. Eight- and ten-digit passcodes can take weeks or years. Hide UI, however, can provide a way to gain access to an iPhone more quickly.
“If the standard agent doesn’t work, we can move to Plan B, which is Hide UI,” said a law enforcement officer.
In order for the software to work, a law enforcement official must install Hide UI onto an iPhone and then contrive a scenario to put it back into the hands of a suspect. For example, a police officer could tell the suspect to call a lawyer or pull numbers off the phone. Once the suspect has done this, Hide UI will have stored the passcode in a text file that can be extracted the next time the phone is plugged into GrayKey. Law enforcement can then use that passcode to unlock the phone and extract the data from it. Hide UI can also reportedly disable airplane mode and prevent anyone from wiping the device.
Software Hidden by Nondisclosure Agreements
NBC News did not find search warrants that outlined the capabilities of Hide UI, although GrayKey has occasionally been mentioned in court documents, including a search warrant of an iPhone 11 Pro Max, Apple’s most recent phone.
Nondisclosure agreements have helped to keep Hide UI under wraps. Because of the lack of public scrutiny of the software and its covert behavior, defense attorneys, forensic experts, and civil liberty advocates are concerned that Hide UI could be used without giving iPhone owners due process under the law, such as with warrants.
“Failure to disclose what they are doing in terms that would be understood by the court is a huge problem constitutionally,” said Mr. Northcutt. “That’s assuming there are no abuses going on, which seems ludicrous to me.”
“It’s great technology for our cases, but as a citizen I don’t really like how it’s being used,” added one law enforcement official. “I feel like sometimes officers will engage in borderline and unethical behavior.”
Both of the law enforcement sources who spoke with NBC News said that they would only plug an iPhone into GrayKey if they had a search warrant. But forensic experts working with defense attorneys said that they worry that Hide UI could be being used without a warrant by officers looking for shortcuts, though NBC News has not confirmed that the software has been utilized in that manner.
While it is not clear how often Hide UI is used, hundreds of state and local law enforcement agencies, the FBI, the DEA, the Secret Service, Customs and Border Protection, and other organizations have access to GrayKey devices. Even if a warrant is sought to search an iPhone, it remains uncertain whether the subterfuge required to get the passcode from the suspect has been outlined to the prosecutor or the judge.
GrayKey’s marketing materials do not publicly refer to Hide UI. It and other intelligence-gathering features are only explained to potential customers if they sign a nondisclosure agreement. One GrayKey nondisclosure agreement from 2018 requires law enforcement to notify Grayshift if details of the technology are likely to be disclosed during the judicial process, such as through a subpoena, a summons, or an order, so that the company has the opportunity to “obtain a protective order or otherwise oppose the disclosure.”
Mr. Northcutt said that this was “pretty shocking” because it suggests that the private interests of a third-party vendor might be interfering with due process.
“You can’t just have law enforcement say, ‘we have this magic box, plug your phone in, extract evidence, and you have to trust us that this is accurate and that we are giving you all the stuff that’s exculpatory,’” said Mr. Northcutt. “Not when the end product will result in the deprivation of people’s liberty.”
Have Your Civil Rights Been Violated?
As an American, you have civil rights, and they do not end just because you have been accused of a crime. When your constitutional protections are disregarded by law enforcement, whether through failure to observe due process, unlawful search and seizure, improper surveillance, or excessive force, you can seek financial compensation for the wrongs that you have suffered. If you believe your civil rights have been violated, contact GWC Injury Lawyers LLC.
With over $2 billion recovered in verdicts and settlements, GWC is one of the leading Personal Injury and Workers’ Compensation law firms in Illinois. Our Chicago civil rights lawyers can help you and your family get the justice you deserve.
To schedule a free, no-obligation consultation with one of GWC’s attorneys, please call our office at (312) 464-1234 or click here to chat with a representative at any time.
<< BACK TO BLOG POSTS