A new filing from the government has struck back at one of the central claims in Apple's San Bernardino defense. One of the most controversial aspects of the case has been FBI handling of Syed Farook's phone in the days after the shooting, particularly the decision to reset the password in an attempt to recover Farook's iCloud account. In doing so, many have argued that the government blew its chance to recover data from Farook's phone through an iCloud auto-backup, which would have been disabled by the password reset process.
But in today's filing, the government pushes back against that claim, arguing that Farook had himself disabled the system, changing his password shortly after the final backup. The passage reads:
The evidence on Farook’s iCloud account suggests that he had already changed his iCloud password himself on October 22, 2015—shortly after the last backup—and that the autobackup feature was disabled. A forced backup of Farook’s iPhone was never going to be successful, and the decision to obtain whatever iCloud evidence was immediately available via the password change was the reasoned decision of experienced FBI agents investigating a deadly terrorist conspiracy
According to an attached FBI statement, Farook's phone was powered down by the time it was recovered which would also have made an auto-backup impossible without the proper passcode. FBI technical experts verified this through technical testing, which was also recorded and attached with the filing (see section E).
The final backup from Farook's phone came on October 19th, roughly six weeks before the San Bernardino attacks took place. Those backups include messaging data and contacts, the bulk of the data that investigators are hoping to retrieve from the phone. Apple had attempted to induce an auto-backup in the aftermath of the attack, but news of the password reset made it clear that such a backup was impossible.
Still, it's never been clear why Farook's phone stopped backing up in October. iCloud backup settings are controlled locally, and simply changing an iCloud password will not by itself stop a phone from backing up. Apple has no central control over whether a phone backs up, so if Farook did turn off the backup function on the 22nd as the government claims, the subsequent password reset would have had no effect on the phone's ability to back up.
The full filing is below. The relevant passage appears at page 29, according to the internal pagination.