Encryption and Evolving Technology: Implications for U.S. Law Enforcement Investigations
Released: 2016-02-18T00:00:00

F ast-changing technology creates a challenging environment for crime-fighting. According to former Attorney General Eric Holder, " [r]ecent technological advances have the potential to greatly embolden online criminals, providing new methods ... to avoid detection. " Technology is a two-faced creature. On the one hand, it has enhanced the speed and ease of communication and legitimate business, providing a bridge across international borders. On the other, it has opened the doors for potential exploitation by a range of malicious actors.

Just as the growth of technology offers advances and challenges, so does its security. The stronger the security features of our technology, the less vulnerable the technology may be. However, if the security is sufficiently strong, the technology and its associated information may become inaccessible to legitimate law enforcement investigations. This is one aspect of the current debate surrounding smartphone and other mobile technology and security.

Smartphone ownership is on the rise, with 64% of adult Americans owning a smartphone as of October 2014. Smartphones have become valuable targets for hackers because, in part, of the breadth of personal information they contain. Because of this, manufacturers regularly update their devices' security features, and experts have encouraged consumers to take advantage of these features—such as locking smartphones with a passcode and encrypting the contents. One current concern is that such strong security measures could not only keep out potential malicious actors, but legitimate individuals as well, including users who forget their passcodes or law enforcement with a lawful search warrant.

This report provides an overview of the perennial issue involving technology outpacing law enforcement and discusses how policymakers and law enforcement officials have dealt with this issue in the past. It discusses the current debate surrounding smartphone data encryption and how this may impact U.S. law enforcement operations. The report also discusses existing law enforcement capabilities, the debate over whether law enforcement is "going dark" because of rapid technological advances, and resulting issues that policymakers may consider.

The Technology Boundary: A Perennial Issue

Technology as a boundary for law enforcement is by no means a new issue in U.S. policing. In the 1990s, for instance, there were concerns that increasing adoption of technologies such as digital communications and encryption could hamper law enforcement's ability to investigate crime. More specifically, concerns have been whether these technologies could interfere with surveillance or the interception and understanding of certain communications.

Communications Assistance for Law Enforcement Act (CALEA)

In the 1990s, there were "concerns that emerging technologies such as digital and wireless communications were making it increasingly difficult for law enforcement agencies to execute authorized surveillance." Specifically, the Government Accountability Office (GAO; then, the General Accounting Office) cited the increasing use of digital, including cellular, technologies in public telephone systems as one factor potentially inhibiting the Federal Bureau of Investigation's (FBI's) wiretap capabilities.

Congress passed the Communications Assistance for Law Enforcement Act (CALEA; P.L. 103-414 ) to help law enforcement maintain its ability to execute authorized electronic surveillance in a changing technology environment. Among other things, CALEA requires that telecommunications carriers assist law enforcement in executing authorized electronic surveillance. There are several notable caveats to this requirement, however:

Law enforcement and officials are not authorized to require telecommunications providers (as well as manufacturers of equipment and providers of support services) to adopt "specific design of equipment, facilities, services, features, or system configurations." Similarly, officials may not prohibit "the adoption of any equipment, facility, service, or feature" by these entities. Telecommunications carriers are not responsible for "decrypting, or ensuring the government's ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication."

A decade after the passage of CALEA, federal law enforcement officials were again concerned that their ability to conduct electronic surveillance was constrained because of constantly emerging technologies. Not all telecommunications providers had implemented CALEA-compliant intercept capabilities. As such, the Department of Justice (DOJ), FBI, and Drug Enforcement Administration (DEA) filed a Joint Petition for Expedited Rulemaking asking the Federal Communications Commission to extend CALEA provisions to a wider breadth of telecommunications providers. Subsequently, the FCC administratively expanded CALEA's requirements to apply to both broadband and VoIP providers.

Notably, CALEA is not viewed as applying to email or data while stored on smartphones and similar mobile devices. Reportedly, there has been "intense debate" about whether it should be expanded to cover this content. For instance, there have been reports over the past several years that the Administration has considered legislative proposals to amend CALEA to apply to a wider range of communications service providers such as social networking companies.

Crypto Wars

Also in the 1990s, what some have dubbed the "crypto wars" pitted the government against data privacy advocates in a debate surrounding the use of data encryption. This tension was highlighted by the federal investigation of Philip Zimmermann, the creator of Pretty Good Privacy (PGP) encryption software, the most widely used email encryption platform. When PGP was released, it "was a milestone in the development of public cryptography. For the first time, military-grade cryptography was available to the public, a level of security so high that even the ultra-secret code-breaking computers at the National Security Agency could not decipher the encrypted messages." When someone released a copy of PGP on the Internet, it proliferated, sparking a federal investigation into whether Zimmerman was illegally exporting cryptographic software (then considered a form of "munitions" under the U.S. export regulations) without a specific munitions export license. Ultimately the case was resolved without an indictment. Courts have since been presented with the question of how far the First Amendment right to free speech protects written software code—which includes encryption code.

Law Enforcement Use of Cell Phone Data

As cell phone—and now smartphone—technology has evolved, so too has law enforcement use of the data generated by and stored on these devices. As cell phones have advanced from being purely cellular telecommunications devices into mobile computers that happen to have cell phone capabilities, the scope of data produced by and saved on these devices has morphed. In addition to voice communications, this list can include

call detail records, including cell phone records that indicate which cell tower was used in making or receiving a call; Global Positioning System (GPS) location points, stored both on the device and in some of its applications, indicating the location of a particular device; data—such as email, photos, videos, and messages—stored directly on a mobile device; data backed up to the "cloud" and stored off a mobile device.

Cell phones "are potentially rich sources of evidence" for law enforcement. Where these data are stored varies based on factors such as default smartphone settings, users' personalized settings, and telecommunications providers' policies.

When law enforcement accesses, or attempts to access, this information, it is often gathered through authorized wiretaps or search warrants. Its not always clear, however, exactly how often law enforcement gathers or relies upon these data in their investigations. Data exist on the number of wiretap requests and intercept orders that are issued in investigations of felonies as well as on how often law enforcement encounters encryption in carrying out these orders. These data provide a snapshot of law enforcement use of wiretaps and possible encryption barriers.

In 2014, judges authorized 3,554 wiretaps, of which about 36% (1,279 orders) were under federal jurisdiction. Notably, 96% (3,409) of total authorized intercept orders were for portable devices. From the 1,279 federally authorized intercept orders, they produced an average of 5,724 intercepts, including an average of 886 "incriminating intercepts."

In 2001, the Administrative Office of the U.S. Courts began collecting data on whether law enforcement encountered encryption in the course of carrying out wiretaps as well as whether officials were able to overcome the encryption and decipher the "plain text" of the encrypted information. Law enforcement has reported encountering encryption in at least one instance each year, with the exception of 2006 and 2007. The first known, reported instance of an authorized wiretap being stymied by encryption came in 2011. In 2014, there were 4 such instances—lower than the 10 known instances from 2013 in which encryption foiled officials. From the 3,554 total authorized wiretaps in 2014—of which 25 contained encrypted communications—officials could not decipher the plain text in 4 instances (or 0.11% of authorized wiretaps). Notably, these numbers relate to lawful wiretaps of certain suspected or actual criminal offenses, as authorized by Title III of the Omnibus Crime Control and Safe Streets Act of 1968. The data do not include wiretaps as authorized by the Foreign Intelligence Surveillance Act of 1978 (FISA)—the law which authorizes surveillance primarily of foreign intelligence and international terrorism threats. See Figure 1 for an illustration of the 2014 data.

As noted, law enforcement has reported encountering encryption nearly every year since 2001, though law enforcement has only encountered encryption it could not circumvent since 2011. The number of instances in which this has occurred, however, has fluctuated and has been relatively low, such that analysts cannot make claims as to whether or not this number is on a specific trajectory. The presence of reported surveillance attempts wherein encryption could not be circumvented by law enforcement may have contributed to claims that advances in encryption have outpaced law enforcement's (and others') ability to crack it.

Current Debate

In September 2014, Apple released a major update to its mobile operating system, iOS 8. In the accompanying privacy policy, Apple noted that personal data stored on devices running iOS 8 are protected by the user's passcode. Moreover, the company stated, " Apple cannot bypass your passcode and therefore cannot access this data. So it 's not technically feasible for us to respond to government warrants for the extraction of this data from devices in their possession running iOS 8. " The company has also stated with respect to certain communications—namely, iMessage and FaceTime—that "Apple has no way to decrypt iMessage and FaceTime data when it's in transit between devices ... Apple doesn't scan your communications, and we wouldn't be able to comply with a wiretap order even if we wanted to."

Similarly, Google 's Android 5.0 mobile operating system, which launched in November 2014, includes default privacy protections such as automatic encryption of data that is protected by a passcode. When devices running Android 5.0 are locked, data on them are only accessible by entering a valid password, to which Google does not have a key. Thus, like Apple, Google is not able to unlock encrypted devices.

Enhanced data encryption, in part a response to privacy concerns following Edward Snowden's revelations of mass government surveillance, has opened the discussion on how this encryption could impact law enforcement investigations. Law enforcement officials have likened the new encryption to "a house that can't be searched, or a car trunk that could never be opened." There have been concerns that malicious actors, from savvy criminals to terrorists to nation states, may rely on this very encryption to help conceal their illicit activities. There is also concern that law enforcement may not be able to bypass the encryption, their investigations may be stymied, and criminals will operate above the law. Critics of these concerns contend that law enforcement maintains adequate tools and capabilities needed for their investigations.

Major Components: Communications and Stored Data

Developments in encryption—and companies' implementation of enhanced data protections—have reinvigorated the debate regarding the balance between privacy needs and information access. Most recently, the conversation has largely been in the context of smartphones and mobile devices. These devices present a unique discussion point because they bridge the realms of communications and stored data.

Real-Time Access to Encrypted Communications

CALEA requires that telecommunications carriers (including broadband Internet access and VoIP providers) assist law enforcement in executing authorized electronic surveillance of real-time communications. However, some developments in the communications landscape have allowed some communications to be exempt from being wiretap-ready, as is otherwise mandated by CALEA.

First, some companies, for instance Apple, have implemented text messaging systems—Apple's is the iMessage—that are not readable by telecommunications (or broadband or VoIP) providers. Therefore, these communications fall outside of CALEA mandates. Also, Apple has implemented end-to-end encryption of messages sent through the iMessage system between Apple devices and does not maintain a key to decrypt these messages. CALEA exempts from its requirements encrypted communications for which telecommunications carriers (as well as manufacturers and service providers such as Apple) do not have a key.

As evolving technology changes how communication takes place, not all communications may be readily accessible to law enforcement, regardless of whether law enforcement presents a warrant for a wiretap. If technology companies do not retain the ability to decrypt certain communications, they, in turn, may be unable to help law enforcement conduct court-authorized electronic surveillance of these communications.

Encryption of Data Stored on Smartphones

In addition to encryption's effect on access to communications data generated and received by smartphones, encryption also directly affects access to data stored on these mobile devices (as well as data stored elsewhere that may be retrieved via the mobile device). If companies like Apple and Google provide for encryption of data on locked mobile devices—and do not maintain the keys to unlock these devices—the companies may be unable to assist law enforcement in carrying out court-authorized searches of content stored on the device—even if the police possess a warrant. As these companies have noted, because they cannot break the encryption of a locked device, they also cannot provide decrypted information to authorities.

Some have questioned how challenges for police in cracking encryption to obtain information on smartphones compare to those in obtaining information stored in other types of containers such as home safes and safe deposit boxes.

Master Keys

Technology companies like Apple and Google are not required under federal law to maintain a key to unlock the encryption of their devices sold to consumers. If they did maintain a key, however, they may be required to provide this key to unlock devices for law enforcement presenting a valid search warrant.

Similarly, safe manufacturers are not required under federal law to maintain the combination or key to safes sold to consumers. However, if manufacturers voluntarily maintained such a master key, they, too, may be required to provide assistance to law enforcement to access the safe. In addition, if law enforcement presents a warrant to search an individual's safe deposit box, a bank may assist law enforcement by providing a master key for the box.

Cryptanalytic Attack

Since some companies may not retain a key to open a locked mobile device, one option for law enforcement in attempting to obtain information on a device for which they have a valid search warrant may be to use a cryptanalytic attack. One such form of cryptanalytic attack has been referred to as "brute force." Using this method, law enforcement would likely use software to try every possible combination of keys in an attempt to unlock the device. The success of this method may depend, among other things, on the amount of time available to try and unlock a device and on the number of keys used in the passcode. FBI Director Comey has cited barriers to law enforcement relying upon brute force tactics to break encryption. One challenge he has noted is increasingly advanced encryption techniques that even "supercomputers" may not be able to crack. In addition, "some devices have a setting whereby the [data] is erased if someone makes too many attempts to break the password, meaning no one can access that data."

Just as police may use brute force to try and break encryption when executing a search warrant, they are authorized to break other locks—such as those to physical buildings—in order to carry out a lawful search with a warrant. The Supreme Court has noted that "[i]t is well established that law officers constitutionally may break and enter to execute a search warrant where such entry is the only means by which the warrant effectively may be executed."

Going Dark or Going Forward?

As modern technology has developed, there has arguably been an evolving gap between law enforcement's investigative authorities and capabilities to carry out authorized activities. This is not a new phenomenon; rather, as experts have noted, " [l]aw enforcement has been complaining about 'going dark' for decades now. " The FBI, for instance, established a Going Dark i nitiative in an attempt to maintain law enforcement's ability to conduct electronic surveillance in a rapidly changing technology environment.

Originally, the "going dark" debate centered on law enforcement's ability to intercept real-time communications. As communications technologies evolved, so did questions about whether or how law enforcement could work within existing electronic surveillance laws to carry out court-authorized surveillance on real-time communications. Experts, officials, and stakeholders debated whether certain laws such as CALEA should be expanded to require additional entities—such as all VoIP and Internet service providers—to assist law enforcement in accessing this real-time information. The most recent encryption enhancements by companies like Apple and Google "highlight the continuing challenge for law enforcement in responding to new technologies. Other innovations, such as texting, instant messaging and videogame chats, created hurdles to monitoring communication," though some contend that law enforcement has found means to overcome many of these technological challenges. Others, however, are concerned about law enforcement's ability to keep pace with advancing technology, particularly "the expansion of online communication services that—unlike traditional and cellular telephone communications—lack intercept capabilities because they are not required by law to build them in."

Concerns over "going dark" have become two–pronged. More recent technology changes have potentially impacted law enforcement capabilities to access not only communications, but stored data. As a result, current law enforcement concerns around "going dark" now involve how, in practice, encryption of stored data as currently implemented by technology companies may affect law enforcement investigations. Analysts have not yet seen data on whether or how encryption has affected law enforcement access to stored data or influenced the outcome of cases. In the past, Congress has requested that similar information be collected and reported. P.L. 106-197 required the Administrative Office of the U.S. Courts to report on whether law enforcement encountered encryption in the course of carrying out wiretaps, as well as whether officials were prevented from deciphering the "plain text" of the encrypted information. While current data collection and reporting requirements on encryption relate to real-time communications , policymakers may debate the potential utility of asking law enforcement to report on encryption relating to stored data as well.

While some contend that law enforcement is "going dark," others have argued that law enforcement and intelligence agencies are in a "golden age of surveillance," with more robust surveillance capabilities. They contend that police access to location data, information about individuals' contacts, and a host of websites that collectively create "digital dossiers" on a person all enhance law enforcement surveillance. Those who see the current technology environment as a golden age of surveillance may believe that, while technology advances (such as encryption) may slow or stymie law enforcement access to certain information, these advances can also create alternate opportunities for information access that law enforcement can learn to harness.

One particular case has recently highlighted this debate. Following the December 2, 2015, terrorist attack in San Bernardino, CA, investigators recovered a cell phone belonging to one of the suspected shooters. FBI Director Comey testified before Congress two months later and indicated that the bureau was still unable to unlock the device. On February 16, 2016, the U.S. District Court for the Central District of California ordered Apple to provide "reasonable technical assistance to assist law enforcement agents in obtaining access to the data" on the cell phone. The outcome of this case may have implications for how law enforcement and policymakers respond to the broader conversation on enhanced encryption.

Evaluating a Need for Action

If there is evidence that investigations are hampered or that lives are at risk because of law enforcement's inability to access critical encrypted information, will there need to be some sort of compromise between law enforcement and the technology industry? What might be the congressional role? Policymakers may weigh whether aiding federal law enforcement will involve incentives or requirements for communications and technology companies to provide specified information to law enforcement, enhanced investigative tools, bolstered financial and manpower resources to help law enforcement better leverage existing authorities, or combinations of these and other options.

Requirements for Communications and Stored Data Access

In debating law enforcement's need to access certain real-time communications and stored data, Congress could move to update CALEA and related laws to cover a broader range of communications and data. Currently, requirements under CALEA apply to telecommunications carriers as well as facilities-based broadband Internet access and interconnected Voice over Internet Protocol (VoIP) providers. Proposals have reportedly been floated that would extend CALEA requirements to apply to a wider range of technology services and products such as instant messaging, video game chats, and real-time video communications like Skype. Proponents of expanding CALEA mandates may believe that it would enhance law enforcement's abilities to carry out existing authorities to intercept real-time communications. Opponents to CALEA expansion proposals, however, may contend that mandating other communications services and technology manufacturers to build in intercept capabilities could be costly, both financially and in terms of security. Financially, companies may need to dedicate resources to reengineer their products; they may need to add or allocate personnel to liaise with law enforcement to facilitate wiretap requests. On the security front, companies would necessarily need to build in a "back door" to allow for authorized access, and any means of access necessarily opens the doors to exploitation.

If policymakers are interested in requiring technology companies to assist law enforcement carry out authorized surveillance and searches, legislators may consider options other than amending CALEA. One such option may be to directly mandate that technology companies build in "back door" access for law enforcement into specified communications products sold in the United States. One unintended consequence of this could be that U.S. consumers, in search of privacy, might buy more products from overseas, and consumers outside the United States might decline to buy certain U.S. products that conform with these requirements.

Law Enforcement Tools

While placing requirements on technology companies may be one route to assisting law enforcement, policymakers may also debate options that could enhance the tools available to law enforcement. These could include making it a crime for an individual (when presented with a court authorized warrant) to fail to turn over his passcode or other information that would allow law enforcement to decrypt a given device. However, those in support of encryption note that a search warrant is "an instrument of permission, not compulsion." In other words, individuals need not proactively reveal or open hiding places for investigators presenting a search warrant. Additionally, judges may in some cases be able to hold individuals in contempt for failure to turn over information that would help law enforcement unlock certain electronic devices.

Although technology companies like Apple and Google may not have the ability to unlock and thus reveal some information stored on locked, encrypted smartphones, they generally retain the ability to turn over information on unencrypted communications and data stored off the devices in locations such as the "cloud." As such, some supporting encryption may contend that regardless of what data in motion may be encrypted or what data is encrypted on locked devices, law enforcement still has effective tools to retrieve digital data. Encryption proponents may also suggest that stronger digital security could benefit law enforcement by helping prevent malicious activity, including hacks and data breaches.

Law Enforcement Capabilities

Combating malicious actors (including cybercriminals and those who exploit technology to conceal their crimes) is an issue that cuts across the investigative, intelligence, prosecutorial, and technological components of law enforcement. Because clear data on how technological advances such as enhanced encryption of communications and stored data on mobile devices may impact law enforcement capabilities to combat these bad actors do not exist, policymakers may be hesitant to take any significant legislative actions to "fix" a problem of an unknown magnitude. Even if policymakers believe there is a significant problem with law enforcement's ability to carry out authorized activities, they may debate whether expanding requirements for certain technology companies and communications services or adding to law enforcement's toolbox of authorities may be the more appropriate options. Some have argued that another option may be to enhance law enforcement's financial resources and manpower. This could involve enhancing training for existing officers or hiring individuals with bolstered technology expertise.