The FBI doesn’t know how the hack used to unlock the San Bernardino shooter’s iPhone 5C works, and yet it paid in the region of $1m for the mechanism, which can used again to unlock any other iPhone 5C running iOS 9, according to reports.
Several US government sources told Reuters that the amount paid for the hack, bought from professional hackers, was substantially less than previous reports indicating a value over $1.3m. The technique can also be used as many times as needed without further payments.
The FBI director, James Comey, said last week that the agency paid more to get into the iPhone 5C than he will make in the remaining seven years and four months he has in his job, suggesting the hack cost more than $1.3m, based on his annual salary.
The Justice Department unlocked the iPhone in March with the help of the hackers, leading the FBI to drop its attempt to force Apple to create software to unlock the iPhone 5C, which the company fought, saying it would compromise the security of all iPhones.
The FBI bought a physical mechanism used to unlock the phone, but does not know the details of the hack that makes it work. The identity of the hackers who made it is also such a closely guarded secret within the US law enforcement agency that its director does not know who it is.
The FBI said it was still examining the contents of the iPhone 5C. Investigators are looking into whether the shooters, Syed Rizwan Farook and his wife Tashfeen Malik, had associates or co-conspirators, while trying to understand what the shooters were doing during an 18-minute gap in a timeline investigators have put together tracking their movements on the day of the shootings.
The FBI confirmed that it would not tell Apple about the security flaw exploited in the hack, partly because the law enforcement agency does not know how it works. It is unknown whether the hackers sold the flaw to any other agencies or third-parties, but if it is not disclosed to and fixed by Apple, it could leave anyone with an iPhone without a fingerprint sensor at risk of having their smartphone hacked.
