In the summer, when even top law enforcement officials acknowledged that Congress was unlikely to force U.S. technology firms to make their phones and apps wiretappable, one senior intelligence official noted that the tide could turn “in the event of a terrorist attack.”
The horrific Islamic State assault on Paris that claimed 129 lives may be that event, some federal and local officials say.
It is not yet clear whether the plotters of the terrorist attacks that killed 129 civilians in the French capital used encrypted channels of communication. That hasn’t stopped some U.S. lawmakers and a number of state and local officials from calling on Congress to act.
Sen. John McCain (R-Ariz.), chairman of the Armed Services Committee, said his panel would hold hearings and “have legislation.” The status quo, he said Tuesday, was “unacceptable.”
On Wednesday, Manhattan District Attorney Cyrus R. Vance Jr., who has been outspoken on how encrypted communications have stymied criminal investigations, will call on Congress to pass a law requiring the unencrypted content of any smartphone made or sold in the United States to be accessible to law enforcement officers with a search warrant.
“This week, every law enforcement entity in every major city around the world is intensifying its [efforts] against terrorism,” Vance said Wednesday in New York. “Every tip will be investigated, every lead will be followed, but every time one of those trails leads to an encrypted cellphone, it may go cold.”
Vance’s proposal, outlined in a white paper obtained by The Washington Post, was in the works for months, and it deals with data stored on a suspect’s phone — not, say, intercepting instant messages. But it seizes the moment.
Images of the Paris attacks and warnings that the Islamic State is planning more attacks have rekindled a debate that seemed to have waned last month when the Obama administration decided it would not call for legislation.
The administration so far shows no sign of changing its stance. It has not drafted legislation, and officials say there are no plans — at least for now — to do so. Some congressional staff doubt that even the Islamic State rampage would prompt a change.
“I don’t think the attack in Paris, even of this magnitude, is going to provide the level of political impetus to push something, especially with the White House, that is not supportive” of legislation, said one aide who closely follows the issue who was not authorized to speak for the record. That is not to say that the attack “won’t generate some debate” on the issue, he said. But, he added, especially in the House, where liberal Democrats and libertarian Republicans are equally hostile to efforts to ease surveillance capabilities, “their positions haven’t changed.”
Nonetheless, state and local law enforcement officials are calling for fresh scrutiny of the issue.
“The terrorism attacks just highlight” the need to find a solution for the encryption challenge, said Terrence Cunningham, police chief in the Boston suburb of Wellesley and president of the International Association of Chiefs of Police. “All law enforcement is asking for is the ability, with judicial authorization, to be able to intercept data and communications. Without that, I don’t see how we keep our communities safe.”
Cunningham cited a drug trafficking case this year in which his detectives had a suspect, a heroin dealer, under physical surveillance and saw him talking on his phone and meeting with other dealers. They retrieved the suspect’s phone with a search warrant but could not unlock it. “No question about it,” he said. “With the evidence in the phone, we could have prosecuted the case.” Instead, he said, the man is free.
The police chiefs group, along with the National District Attorneys Association, has also been working on the issue, and they say that only a federal law will do.
“A state statute is not going to have the clout to affect multinational corporations like Apple and Google,” said Bill Fitzpatrick, NDAA president and the district attorney for Syracuse, N.Y.
Apple fired up the debate last year when it announced that its operating system, iOS 8, encrypted data in such a way that only the user could unlock it. Google, not wanting to be outdone, announced its Android operating system would do the same. But because of technical reasons, Google backtracked, and today, only a small fraction of Android phones use such “full-disk encryption.”
Vance, who has gained national exposure through congressional testimony and op-eds in major newspapers, reserves his criticism for the two firms, whose operating systems he said are used by 96 percent of smartphones around the world. His proposal does not address millions of newer iPhones that are already in use. It focuses on law enforcement’s ability to gain access to data stored on personal devices — the issue that bedevils local police the most.
His proposal does not cover data in transit, such as phone conversations or text messages, the types of communications that intelligence agencies would have wanted to monitor to detect the Paris plots. Nor does it address encrypted apps that can be downloaded onto a phone. A number of these chat platforms — including four of the five most popular with terrorist groups — are made not by companies but by volunteer developers who are often dispersed among different countries. It would be impractical for law enforcement to serve an order on one that’s enforceable on all.
Vance’s white paper outlines the difficulties law enforcement has faced in the past year — ever since Apple’s announcement, and it tries to counter the major arguments made by proponents of strong encryption.
Between September 2014 and October 2015, Vance’s office was unable to execute 111 search warrants for smartphones because the devices were running iOS 8. The cases for which the warrants were issued included murder, sexual abuse of a child and sex trafficking, the report said.
The report also conveyed part of a phone call recorded by prison authorities earlier this year between a prison inmate and a friend who were discussing phone security. “If our phone is running on the iOS 8 software, they can’t open my phone,” he said, according to the report, which noted that inmates are advised their calls are recorded. “That might be another gift from God.”
Civil liberties advocates said Wednesday that Vance’s report offered no definitive evidence that encrypting devices has hurt law enforcement officials’ ability to fight crime.
“Calls to force private companies to weaken the security of their devices and software to ensure law enforcement access are misguided,” said Neema Singh Guliani, legislative counsel at the American Civil Liberties Union. “This weakening will compromise the security of Americans by making their personal information and communications more vulnerable to cyberattack and theft.”
Renae Merle in New York contributed to this report.