The hefty price paid for the software that hacked Syed Farook’s iPhone, which Apple refused to help the FBI break into, signals a growing ‘exploit market’
FBI director James Comey said the cost of breaking to the iPhone was
‘more than I will make in the remainder of this job, which is 7 years
and 4 months’.
Photograph: Drew Angerer/Getty Images
The FBI paid about $1.3m for software to hack into the iPhone of San Bernardino gunman Syed Farook, director James Comey told a London audience on Thursday.
The staggering price illustrates the growth of the so-called “exploit market” for digital spy tools and cyber weapons as governments increasingly use hacker tricks for law enforcement and war. Prices for such software are rarely disclosed, although anything in the seven-figure range is extremely expensive.
Comey made the comments Thursday during an on-stage interview at the Aspen Security Forum in London.
The FBI has previously disclosed it paid a third party outside the US government for a hacking tool to get inside Farook’s locked iPhone 5c. Apple declined to help the bureau because it said it would require weakening the security of one, and potentially many more, of its popular smartphones. The high-stakes court fight was called off when the FBI found its own way into the phone that apparently exploited an unknown Apple security flaw.
When asked Thursday how much the FBI paid for the exploit, Comey replied: “A lot.”
What’s a lot? “More than I will make in the remainder of this job, which is seven years and four months,” Comey said.
The FBI director makes $180,000 a year. That means the FBI paid at least $1.26m, not counting the four months.
Computer security experts have accused governments, including the US, UK, China and Russia, of creating a black market for malicious computer code that puts all consumers at risk.
In order to get inside targets’ machines, governments stock pile security flaws for various gadgets and pieces of software. They then deploy them when they want to get into a specific device.
The catch: keeping those security flaws secret means hiding them from technology companies so they don’t get fixed. But if the flaws aren’t fixed, that means they could be found and used by anyone, not just well-meaning governments.
But as Comey noted, the FBI in this case was able to get inside a terrorist suspect’s phone. “It was, in my view, worth it,” he said.
The FBI paid about $1.3m for software to hack into the iPhone of San Bernardino gunman Syed Farook, director James Comey told a London audience on Thursday.
The staggering price illustrates the growth of the so-called “exploit market” for digital spy tools and cyber weapons as governments increasingly use hacker tricks for law enforcement and war. Prices for such software are rarely disclosed, although anything in the seven-figure range is extremely expensive.
Comey made the comments Thursday during an on-stage interview at the Aspen Security Forum in London.
The FBI has previously disclosed it paid a third party outside the US government for a hacking tool to get inside Farook’s locked iPhone 5c. Apple declined to help the bureau because it said it would require weakening the security of one, and potentially many more, of its popular smartphones. The high-stakes court fight was called off when the FBI found its own way into the phone that apparently exploited an unknown Apple security flaw.
When asked Thursday how much the FBI paid for the exploit, Comey replied: “A lot.”
What’s a lot? “More than I will make in the remainder of this job, which is seven years and four months,” Comey said.
The FBI director makes $180,000 a year. That means the FBI paid at least $1.26m, not counting the four months.
Computer security experts have accused governments, including the US, UK, China and Russia, of creating a black market for malicious computer code that puts all consumers at risk.
In order to get inside targets’ machines, governments stock pile security flaws for various gadgets and pieces of software. They then deploy them when they want to get into a specific device.
The catch: keeping those security flaws secret means hiding them from technology companies so they don’t get fixed. But if the flaws aren’t fixed, that means they could be found and used by anyone, not just well-meaning governments.
But as Comey noted, the FBI in this case was able to get inside a terrorist suspect’s phone. “It was, in my view, worth it,” he said.
