​Prosecutor: iPhone could ID unknown San Bernardino attacker

LOS ANGELES -- Information contained in an encrypted iPhone could help finally answer whether there was a third assailant in the San Bernardino terror attack that killed 14 people, according to court papers filed by the county's district attorney.

The district attorney is among many weighing in on the fight between Apple and the government ahead of a March 22 hearing in which Apple is asking a judge to reverse an order requiring the company to create a software program that overrides iPhone security features.

San Bernardino Police Chief Jarrod Burguan said Friday that the question of a third attacker has nagged investigators despite no supporting evidence.

"We've never been able to completely eliminate it," he said. "We know we have some witnesses that said they thought they saw three... some saw two, some saw one. The majority said two, and the evidence we have up to this point only supports two."

Still, Burguan said investigators would like to definitively answer the question, and unlocking the phone could help do that.

Syed Rizwan Farook and his wife, Tashfeen Malik, opened fire Dec. 2 at an annual training of his San Bernardino County co-workers. They died hours later in a shootout with police. The 14 people killed marked the deadliest terror attack on U.S. soil since Sept. 11, 2001.

In a brief filed in federal court Thursday, San Bernardino County District Attorney Michael Ramos cited two 911 calls reporting three perpetrators during the attack.

"The information contained solely on the seized iPhone could provide evidence to identify as of yet unknown co-conspirators..." according to Ramos' brief.

The brief also suggested that the county-owned iPhone used by Farook may have introduced a "lying-dormant cyber pathogen" endangering the county's computer network.

Burguan said he's never heard that theory and knew of no problems.

Such a breech is technically possible but unlikely, said David Meltzer, a computer security expert and chief research officer at TripWire, a commercial IT security firm.

If an employee wanted to introduce malicious software into the county's network, Meltzer said they would be more likely to use a desktop or laptop PC because it's easier to download and manipulate malicious code on a PC's operating system.

Apple says unlocking Farook's phone would make all other iPhones more vulnerable to future attacks.

In a letter to Apple CEO Tim Cook cited in another court brief, Mark Sandefur -- the father of one of the men killed in the terror attack -- also cited reports of three attackers, saying the phone must be unlocked.

"Several of the survivors tell me bone-chilling stories of where they were, and what they saw," Sandefur wrote. "Some of them describe in precise detail, laying on the floor, hiding under furniture and the bodies of their co-workers, that they saw three assailants, not two, walking around in heavy boots as they carried out their murders.

"What if there is evidence pointing to a third shooter?" Sandefur wrote. "What if it leads to an unknown terrorist cell? What if others are attacked, and you and I did nothing to prevent it?"

Relatives of five people who were killed, along with one survivor of the attack, filed a brief supporting the FBI, saying its request is lawful and calling Apple's concerns "speculative." The relatives argued the phone might contain useful leads or even "explain the motive for this senseless tragedy."

But the husband of another survivor submitted a letter on Apple's behalf, saying he believes the order would set a bad precedent and adding that he doesn't believe the phone has any useful information.

Among those backing Apple are civil liberties advocates and some of the company's biggest competitors, including Google, Microsoft and Facebook. Though some were initially hesitant about seeming to oppose an investigation of violent extremists, they decided in the end to file a joint brief on Apple's behalf.

The companies echo Apple's concern that despite the FBI's claim that its request applies to only one individual iPhone, a government victory would set a "dangerous" precedent. "Make no mistake: If the government succeeds in this case, it will seek many such decisions," they write.

A group of 17 smaller tech firms, including Twitter, LinkedIn, Airbnb and Reddit submitted a separate joint filing.

The last of the 22 surviving victims of the attack was released from the hospital Thursday, the Riverside Press Enterprise reported.