(Linngreaa at the Haitian ?tatea mashingtun, EOE 311515 April 13, 2018 The Honorable Christopher Wray Federal Bureau of Investigations 935 Avenue, NW Washington, DC 20535 Dear Director Wray, Recently, the Department of Justice?s Of?ce of Inspector General (OIG) released a troubling report on the Bureau?s handling of Syed Rizwan Farook?s iPhone in the aftermath of the San Bernardino attack. The OIG report ?nds that the primary forensics unit responsible for unlocking the iPhone did not consult with third-party vendors, nor did it consult with relevant FBI of?ces, including the Remote Operations Unit (ROU) which already knew of a potential solution. Perhaps most disturbingly, statements made by the Chief of the and Electronic Analysis Unit appear to indicate that the FBI was more interested in forcing Apple to comply than getting into the device. The OIG report ?nds that the lead forensics team working Farook?s iPhone, the and Electronic Analysis Unit (CEAU) did not consult with other FBI experts, such as the ROU or third-party vendors, to determine what capabilities or relationships could be leveraged to unlock the phone. The report concludes that the should have checked with trusted vendors for possible solutions compelling Apple?s assistance. . and that ?no one in CEAU consulted the ROU Chief, a step that we believe should have been taken before making any conclusions whether compelling Apple to provide technical assistance was truly necessary.?2 It was not until the night before suit against Apple, which was predicted ?on the notion that technical assistance from Apple was necessary to search the contents of the device,?3 that the FBI ?rst consulted the third-party vendor that it knew had nearly completed a solution. But even more concerning is the ?nd that the ROU Chief reached out to the vendor on his own volition and was chastised by the CEAU Chief for doing so: The CEAU Chief told the OIG that, after the outside vendor came forward, he became frustrated that the case against Apple could no longer go forward, and he vented his frustration to the ROU Chief. He acknowledged that during this conversation between the 1 Office of Inspector General, Department of Justice, Report: A Special inquiry Regarding the Accuracy of Statements Concerning its Capabilities to Exploit an iPhone Seized During the San Bernardino Terror Attack investigation, page 8 2 id. page 6 3 id. page 9 PRINTED ON RECYCLED PAPER two, he expressed disappointment that the ROU Chief had engaged an outside vendor to assist with the Farook iPhone, asking the ROU Chief, ?Why did you do that for??4 The report also ?nds that the former Executive Assistant Director for Science and Technology, Amy Hess, was concerned that FBI agents were not exhausting all technical options precisely because they wanted the suit against Apple to go forward: Speci?cally, EAD Hess expressed concerns that an OTD unit may have had techniques available to exploit the Farook iPhone that certain unidenti?ed OTD of?cials did not employ and that these of?cials were indifferent to the fact that FBI leadership and others were testifying to Congress, and ?ling af?davits in court, that the FBI had no such capability.5 This report undermines statements that the FBI made during the San Bernardino litigation and consistently since then, that only the device manufacturer could provide a solution. Moreover, recent reports that companies such as Cellebrite6 and GrayShift? have developed tools to cheaply unlock nearly every phone on the market, including every version of raise even more concerns that the FBI has not been forthcoming about the extent of the ?Going Dark? problem. The service offered by Cellebrite, the company alleged to have unlocked Farook?s iPhone, reportedly costs about $1500 per phone to unlock. The second company, Greyshift reportedly offers a device that was recently purchased by the State Department that will unlock phones at a cost of about $50 per phone. According to your testimony and public statements, the FBI encountered 7,800 devices last year that it could not access due to However, in light of the availability of unlocking tools developed by third-parties and the OIG report?s ?ndings that the Bureau was uninterested in seeking available third-party options, these statistics appear highly questionable. Please provide answers to the following questions as soon as possible: . Have you consulted with relevant third-party vendors to understand what tools are available to help the FBI access device content? . Do you agree that there are solutions available to help unlock or nearly every device on the market? If not, why are these solutions, particularly the ones discussed above, insuf?cient? 0 Why can?t the FBI unlock the 7,800 devices? Have you attempted to use tools developed by third-parties to unlock these devices? 4 Id. page 8 5 Id. page 1 (emphasis added) 5 cellebrite[#5f03bdb4667a 7 cracking-tech-graykey . Of these locked phones, how many are equipped with biometrics or how many have data available through a cloud service, which would provide additional means to access data or unlock phones? . For each device that you have not used a third-party tool to unlock, what is the rationale for not doing so? Sincerely, Lo - Darrell lssa ember of on 1 33: Member of Congress MW 3) Jerrold Nadler F. James Sensenbrenner, Jr. Member of Congress: Member of Congress Ava/Ju: Ted W. Lieu Ted 06 Member of Congress Member of Congress Matt Gaetz Member of Congress .1 Jim,an Member of Congress Mem er of Congress