Christopher Wray
FBI Director Christopher Wray testifies before the House Judiciary Committee on July 24, 2024. Image: House Judiciary / YouTube

Encrypted apps still a challenge as FBI probes Trump shooter’s devices, Wray says

The FBI is still collecting information from devices and online accounts belonging to the 20-year-old man who attempted to assassinate former President Donald Trump at a rally earlier this month, Director Christopher Wray told lawmakers Wednesday.

Wray said the bureau is facing challenges with getting into “encrypted messaging applications” used by Thomas Matthew Crooks, who was killed by a Secret Service counter-sniper team after firing at least eight shots toward the stage at the July 13 rally in Butler, Pennsylvania. Reports said officials have identified at least three such accounts.

Speaking to the House Judiciary Committee, Wray said that in some cases, the FBI is waiting on “legal process returns” to get into the accounts. He did not specify what companies or services host them.

The bureau had early success breaking into Crooks’ phone using technology from Cellebrite, a company that specializes in helping law enforcement gain access to data, the Washington Post and other publications reported. The encrypted messaging services have proved more difficult, Wray said. 

"This has unfortunately become very commonplace,” he said. “It's a real challenge not just for the FBI but for state and local law enforcement all over the country." Even with access to a user’s phone, the end-to-end encryption used in many apps would make messages and other data inaccessible even to the app developer.

"Some places we've been able to look, some places we will be able to look, some places we may never be able to see, no matter how good our legal process is,” Wray said.

Investigators still have no firm grip on Crooks’ motive or ideology, Wray said, but he shed light on some of the information collected from the shooter’s devices, which include a laptop.

On July 6, Crooks used a laptop to do a Google search for "how far away was Oswald from Kennedy," Wray said — a reference to the 1963 assassination of President John F. Kennedy in Dallas. Crooks appears to have registered for the Butler rally on the same day, Wray said.

Photos of public figures have been discovered on the devices, Wray said, but so far those have been cached images downloaded as part of news articles. 

Crooks flew a drone in the general area of the stage before the rally, Wray confirmed, but the device did not store any images or video.

It’s possible Crooks livestreamed any drone footage directly to one of his devices but did not store it, Wray said. Technicians were able to reverse-engineer the flight path of the drone, and it was generally about 200 yards away from the stage area, he said.

Get more insights with the
Recorded Future
Intelligence Cloud.
Learn more.
No previous article
No new articles
Joe Warminsky

Joe Warminsky

is the news editor for Recorded Future News. He has more than 25 years experience as an editor and writer in the Washington, D.C., area. He previously he helped lead CyberScoop for more than five years. Prior to that, he was a digital editor at WAMU 88.5, the NPR affiliate in Washington, and he spent more than a decade editing coverage of Congress for CQ Roll Call.