F ast-changing technology creates a challenging environment for crime-fighting. According to former Attorney General Eric Holder, " [r]ecent technological advances have the potential to greatly embolden online criminals, providing new methods ... to avoid detection. " Technology is a two-faced creature. On the one hand, it has enhanced the speed and ease of communication and legitimate business, providing a bridge across international borders. On the other, it has opened the doors for potential exploitation by a range of malicious actors. Just as the growth of technology offers advances and challenges, so does its security. The stronger the security features of our technology, the less vulnerable the technology may be. However, if the security is sufficiently strong, the technology and its associated information may become inaccessible to legitimate law enforcement investigations. This is one aspect of the current debate surrounding smartphone and other mobile technology and security. Smartphone ownership is on the rise, with 64% of adult Americans owning a smartphone as of October 2014. Smartphones have become valuable targets for hackers because, in part, of the breadth of personal information they contain. Because of this, manufacturers regularly update their devices' security features, and experts have encouraged consumers to take advantage of these features—such as locking smartphones with a passcode and encrypting the contents. One current concern is that such strong security measures could not only keep out potential malicious actors, but legitimate individuals as well, including users who forget their passcodes or law enforcement with a lawful search warrant. This report provides an overview of the perennial issue involving technology outpacing law enforcement and discusses how policymakers and law enforcement officials have dealt with this issue in the past. It discusses the current debate surrounding smartphone data encryption and how this may impact U.S. law enforcement operations. The report also discusses existing law enforcement capabilities, the debate over whether law enforcement is "going dark" because of rapid technological advances, and resulting issues that policymakers may consider. Technology as a boundary for law enforcement is by no means a new issue in U.S. policing. In the 1990s, for instance, there were concerns that increasing adoption of technologies such as digital communications and encryption could hamper law enforcement's ability to investigate crime. More specifically, concerns have been whether these technologies could interfere with surveillance or the interception and understanding of certain communications. In the 1990s, there were "concerns that emerging technologies such as digital and wireless communications were making it increasingly difficult for law enforcement agencies to execute authorized surveillance." Specifically, the Government Accountability Office (GAO; then, the General Accounting Office) cited the increasing use of digital, including cellular, technologies in public telephone systems as one factor potentially inhibiting the Federal Bureau of Investigation's (FBI's) wiretap capabilities. Congress passed the Communications Assistance for Law Enforcement Act (CALEA; P.L. 103-414 ) to help law enforcement maintain its ability to execute authorized electronic surveillance in a changing technology environment. Among other things, CALEA requires that telecommunications carriers assist law enforcement in executing authorized electronic surveillance. There are several notable caveats to this requirement, however: Law enforcement and officials are not authorized to require telecommunications providers (as well as manufacturers of equipment and providers of support services) to adopt "specific design of equipment, facilities, services, features, or system configurations." Similarly, officials may not prohibit "the adoption of any equipment, facility, service, or feature" by these entities. Telecommunications carriers are not responsible for "decrypting, or ensuring the government's ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication." A decade after the passage of CALEA, federal law enforcement officials were again concerned that their ability to conduct electronic surveillance was constrained because of constantly emerging technologies. Not all telecommunications providers had implemented CALEA-compliant intercept capabilities. As such, the Department of Justice (DOJ), FBI, and Drug Enforcement Administration (DEA) filed a Joint Petition for Expedited Rulemaking asking the Federal Communications Commission to extend CALEA provisions to a wider breadth of telecommunications providers. Subsequently, the FCC administratively expanded CALEA's requirements to apply to both broadband and VoIP providers. Notably, CALEA is not viewed as applying to email or data while stored on smartphones and similar mobile devices. Reportedly, there has been "intense debate" about whether it should be expanded to cover this content. For instance, there have been reports over the past several years that the Administration has considered legislative proposals to amend CALEA to apply to a wider range of communications service providers such as social networking companies. Also in the 1990s, what some have dubbed the "crypto wars" pitted the government against data privacy advocates in a debate surrounding the use of data encryption. This tension was highlighted by the federal investigation of Philip Zimmermann, the creator of Pretty Good Privacy (PGP) encryption software, the most widely used email encryption platform. When PGP was released, it "was a milestone in the development of public cryptography. For the first time, military-grade cryptography was available to the public, a level of security so high that even the ultra-secret code-breaking computers at the National Security Agency could not decipher the encrypted messages." When someone released a copy of PGP on the Internet, it proliferated, sparking a federal investigation into whether Zimmerman was illegally exporting cryptographic software (then considered a form of "munitions" under the U.S. export regulations) without a specific munitions export license. Ultimately the case was resolved without an indictment. Courts have since been presented with the question of how far the First Amendment right to free speech protects written software code—which includes encryption code. As cell phone—and now smartphone—technology has evolved, so too has law enforcement use of the data generated by and stored on these devices. As cell phones have advanced from being purely cellular telecommunications devices into mobile computers that happen to have cell phone capabilities, the scope of data produced by and saved on these devices has morphed. In addition to voice communications, this list can include call detail records, including cell phone records that indicate which cell tower was used in making or receiving a call; Global Positioning System (GPS) location points, stored both on the device and in some of its applications, indicating the location of a particular device; data—such as email, photos, videos, and messages—stored directly on a mobile device; data backed up to the "cloud" and stored off a mobile device. Cell phones "are potentially rich sources of evidence" for law enforcement. Where these data are stored varies based on factors such as default smartphone settings, users' personalized settings, and telecommunications providers' policies. When law enforcement accesses, or attempts to access, this information, it is often gathered through authorized wiretaps or search warrants. Its not always clear, however, exactly how often law enforcement gathers or relies upon these data in their investigations. Data exist on the number of wiretap requests and intercept orders that are issued in investigations of felonies as well as on how often law enforcement encounters encryption in carrying out these orders. These data provide a snapshot of law enforcement use of wiretaps and possible encryption barriers. In 2014, judges authorized 3,554 wiretaps, of which about 36% (1,279 orders) were under federal jurisdiction. Notably, 96% (3,409) of total authorized intercept orders were for portable devices. From the 1,279 federally authorized intercept orders, they produced an average of 5,724 intercepts, including an average of 886 "incriminating intercepts." In 2001, the Administrative Office of the U.S. Courts began collecting data on whether law enforcement encountered encryption in the course of carrying out wiretaps as well as whether officials were able to overcome the encryption and decipher the "plain text" of the encrypted information. Law enforcement has reported encountering encryption in at least one instance each year, with the exception of 2006 and 2007. The first known, reported instance of an authorized wiretap being stymied by encryption came in 2011. In 2014, there were 4 such instances—lower than the 10 known instances from 2013 in which encryption foiled officials. From the 3,554 total authorized wiretaps in 2014—of which 25 contained encrypted communications—officials could not decipher the plain text in 4 instances (or 0.11% of authorized wiretaps). Notably, these numbers relate to lawful wiretaps of certain suspected or actual criminal offenses, as authorized by Title III of the Omnibus Crime Control and Safe Streets Act of 1968. The data do not include wiretaps as authorized by the Foreign Intelligence Surveillance Act of 1978 (FISA)—the law which authorizes surveillance primarily of foreign intelligence and international terrorism threats. See Figure 1 for an illustration of the 2014 data. As noted, law enforcement has reported encountering encryption nearly every year since 2001, though law enforcement has only encountered encryption it could not circumvent since 2011. The number of instances in which this has occurred, however, has fluctuated and has been relatively low, such that analysts cannot make claims as to whether or not this number is on a specific trajectory. The presence of reported surveillance attempts wherein encryption could not be circumvented by law enforcement may have contributed to claims that advances in encryption have outpaced law enforcement's (and others') ability to crack it. In September 2014, Apple released a major update to its mobile operating system, iOS 8. In the accompanying privacy policy, Apple noted that personal data stored on devices running iOS 8 are protected by the user's passcode. Moreover, the company stated, " Apple cannot bypass your passcode and therefore cannot access this data. So it 's not technically feasible for us to respond to government warrants for the extraction of this data from devices in their possession running iOS 8. "