Encrypted apps still a challenge as FBI probes Trump shooter’s devices, Wray says

The FBI is still collecting information from devices and online accounts belonging to the 20-year-old man who attempted to assassinate former President Donald Trump at a rally earlier this month, Director Christopher Wray told lawmakers Wednesday.

Wray said the bureau is facing challenges with getting into “encrypted messaging applications” used by Thomas Matthew Crooks, who was killed by a Secret Service counter-sniper team after firing at least eight shots toward the stage at the July 13 rally in Butler, Pennsylvania. Reports said officials have identified at least three such accounts.

Speaking to the House Judiciary Committee, Wray said that in some cases, the FBI is waiting on “legal process returns” to get into the accounts. He did not specify what companies or services host them.

The bureau had early success breaking into Crooks’ phone using technology from Cellebrite, a company that specializes in helping law enforcement gain access to data, the Washington Post and other publications reported. The encrypted messaging services have proved more difficult, Wray said. 

"This has unfortunately become very commonplace,” he said. “It's a real challenge not just for the FBI but for state and local law enforcement all over the country." Even with access to a user’s phone, the end-to-end encryption used in many apps would make messages and other data inaccessible even to the app developer.

"Some places we've been able to look, some places we will be able to look, some places we may never be able to see, no matter how good our legal process is,” Wray said.

Investigators still have no firm grip on Crooks’ motive or ideology, Wray said, but he shed light on some of the information collected from the shooter’s devices, which include a laptop.

On July 6, Crooks used a laptop to do a Google search for "how far away was Oswald from Kennedy," Wray said — a reference to the 1963 assassination of President John F. Kennedy in Dallas. Crooks appears to have registered for the Butler rally on the same day, Wray said.

Photos of public figures have been discovered on the devices, Wray said, but so far those have been cached images downloaded as part of news articles. 

Crooks flew a drone in the general area of the stage before the rally, Wray confirmed, but the device did not store any images or video.

It’s possible Crooks livestreamed any drone footage directly to one of his devices but did not store it, Wray said. Technicians were able to reverse-engineer the flight path of the drone, and it was generally about 200 yards away from the stage area, he said.