iPhone Could Identify Unknown San Bernardino Attacker, Says Prosecutor

Information contained in an encrypted iPhone could help finally answer whether there was a third assailant in the San Bernardino terror attack that killed 14 people, according to court papers filed by the county’s district attorney.

San Bernardino Police Chief Jarrod Burguan said Friday that the question of a third attacker has nagged investigators despite no supporting evidence.

“We’ve never been able to completely eliminate it,” he said. “We know we have some witnesses that said they thought they saw three … some saw two, some saw one. The majority said two, and the evidence we have up to this point only supports two.”

Still, he said investigators would like to definitively answer the question, and unlocking the phone could help do that.

Syed Rizwan Farook and his wife, Tashfeen Malik, opened fire December 2 at an annual training of his San Bernardino County co-workers. They died hours later in a shootout with police. The 14 people killed marked the deadliest terror attack on US soil since September 11, 2001.

In a brief filed in federal court Thursday, San Bernardino County District Attorney Michael Ramos cited two 911 calls reporting three perpetrators during the attack.

“The information contained solely on the seized iPhone could provide evidence to identify as of yet unknown co-conspirators …” according to Ramos’ brief.

The brief also suggested that the county-owned iPhone used by Farook may have introduced a “lying-dormant cyber pathogen” endangering the county’s computer network.

Burguan said he’s never heard that theory and knew of no problems.

Such a breech is technically possible but unlikely, said David Meltzer, a computer security expert and chief research officer at TripWire, a commercial IT security firm.

If an employee wanted to introduce malicious software into the county’s network, Meltzer said they would be more likely to use a desktop or laptop PC because it’s easier to download and manipulate malicious code on a PC’s operating system.

The district attorney is among many weighing in on the fight between Apple and the government ahead of a March 22 hearing in which Apple is asking a judge to reverse an order requiring the company to create a software program that overrides iPhone security features.

Apple says unlocking Farook’s phone would make all other iPhones more vulnerable to future attacks.

(Also see:  Apple Resisting Magistrate Order to Share iPhone Information)

In a letter to Apple CEO Tim Cook cited in another court brief, Mark Sandefur – the father of one of the men killed in the terror attack – also cited reports of three attackers, saying the phone must be unlocked.

“Several of the survivors tell me bone-chilling stories of where they were, and what they saw,” Sandefur wrote. “Some of them describe in precise detail, laying on the floor, hiding under furniture and the bodies of their co-workers, that they saw three assailants, not two, walking around in heavy boots as they carried out their murders.

“What if there is evidence pointing to a third shooter?” Sandefur wrote. “What if it leads to an unknown terrorist cell? What if others are attacked, and you and I did nothing to prevent it?”

(Also see:  Husband of San Bernardino Attack Victim Takes Apple’s Side in FBI Spat)

Among those backing Apple are civil liberties advocates and some of the company’s biggest competitors, including Google, Facebook and Microsoft.

(Also see:  Some San Bernardino Victims to Oppose Apple)

The last of the 22 surviving victims of the attack was released from the hospital Thursday, the Press Enterprise reported.