A special master clears Apple twice to read 14 agencies' smartphone policy files

The phrase carrying the weight here is "part of the United States for purposes of party discovery" ^[6]. Subpoena a stranger and the requesting side has to argue about burden, which is why the Justice Department told the special master that under Rule 45 a non-party gets more protection than a party ^[8]. Linares answered that he is familiar with Rule 45, that the department was simply incorrect, and that the DOJ itself was the reason Apple had to issue subpoenas at all ^[8]. His stated reason for the finding: the definition of the United States takes in agencies that inform the policies, rules and regulations the executive branch sets, so no third-party burden analysis was owed ^[7]. He also noted that the department's claim of minimal relevance came without citation to any support ^[9].

What Apple gets for winning that argument is buyer evidence. Its defense holds that some practices the DOJ challenged are legitimate security and privacy safeguards, and the way it proposes to test that is by reading how federal agencies weigh security and privacy when they set smartphone policies and make purchasing decisions ^[3]. Most product teams skip this step: every restriction ships with a story about the security-conscious customer who asked for it, and that story is usually assembled from sales calls and a champion's enthusiasm rather than from the actual paperwork. Apple is going after the artifacts instead.

The sample is broader than the marquee names suggest. Five of the 14 agencies are cabinet departments; four sit in intelligence or law enforcement; the remaining five are management or independent agencies ^[12]. I would rather read the Office of Personnel Management's mobility policy than the NSA's, because OPM buys phones the way any large employer does, and a requirement that survives in an ordinary HR-scale fleet is worth more to Apple's argument than one written for classified work ^[2].

There is a real limit on what those files can carry. Requirement documents record what a buyer asked for and stay quiet about the implementations the buyer never got to compare. A policy demanding tight control over how software reaches a managed device establishes that the customer wanted control; it does not establish that the specific practice the DOJ challenged was the only way to deliver it. Apple has to close that gap with something other than paperwork, and the paperwork is the cheap part.

Sorting this in your own product comes down to two things: whether the customer wrote the requirement down somewhere your sales team never touched, and whether their live configuration shows the control switched on. A requirement that is both written and switched on is one you can defend in front of anyone. Written but switched off is usually compliance paperwork someone filed and forgot about. If it is unwritten but switched on, that is a real need you have not documented yet, and you want it documented before a regulator or a renewal asks. If it is neither, and you shipped it anyway, the requirement is really your own preference wearing the customer's badge. This discovery fight went two rounds ^[11] because only insiders at those 14 agencies, and not Apple itself, could say for certain which of those categories their files fall into.