By Sadie Gurman and Dustin Volz
WASHINGTON -- A Saudi aviation student who killed three people last year at a naval base in Florida had extensive ties to al Qaeda, top U.S. law-enforcement officials said on Monday as they accused Apple Inc. of stalling the probe by refusing to help unlock the shooter's phones.
The gunman, Second Lt. Mohammed Alshamrani, a member of the Saudi air force, had been communicating with a number of al Qaeda in the Arabian Peninsula operatives for years, even before he began training with the U.S. military, officials said, a discovery that was made based on information recovered from his two locked iPhones.
"We received effectively no help from Apple" to access the phones, Federal Bureau of Investigation Director Christopher Wray said. The struggle to unlock the encrypted phones delayed the probe for months and potentially jeopardized public safety, he said.
The FBI, bypassing Apple's security features, was ultimately able to access information on both phones belonging to the gunman, but there is no guarantee that law enforcement could do that in a future case, Attorney General William Barr said. The information on the devices led to a counterterrorism operation against an associate of Alshamrani in Yemen, Abdullah al-Maliki, Mr. Barr said.
The remarks were the government's strongest yet against Apple's stance on encryption, and escalated pressure on the company to provide law enforcement access to its technology and on Congress to consider legislation that could mandate technology companies to do so.
Apple said it had responded within hours to the FBI's first requests for help in December and provided "every piece of information available to us," including iCloud backups, account information and transactional data, while also lending continuing technical expertise to agents working the case.
"The false claims made about our company are an excuse to weaken encryption and other security measures that protect millions of users and our national security," Apple said. "It is because we take our responsibility to national security so seriously that we do not believe in the creation of a backdoor -- one which will make every device vulnerable to bad actors who threaten our national security and the data security of our customers."
The company and other major Silicon Valley firms, including Facebook, have said for years that undermining their security protocols would make all of their users vulnerable to malicious cyberactivity, a view most independent experts share.
Mr. Barr, a former top lawyer at Verizon, has said he finds it absurd that tech companies would be exempt from laws like the ones that requires telecom companies to enable their services and equipment to comply with law enforcement surveillance requests, and has made the issue a top priority.
Yet despite the sharp tone on Monday, the Justice Department refrained from taking the more forceful step of seeking a court order to Apple to help break open the phones, as it did four years ago after two terrorists killed 14 people and wounded 22 in San Bernardino, Calif. But that case prompted a backlash from throughout the technology industry, and the Justice Department withdrew its case when the FBI contracted a third-party vendor that unlocked the iPhone.
The result now in the Pensacola case is effectively the same: Despite condemnations of Apple, the Justice Department is no closer to finding a solution to a problem that has bedeviled it for years. Despite some interest largely among Republicans in Congress to re-examine the encryption debate, legislation to mandate weaknesses in technology products remains unlikely to garner substantial support.
"Every time there's a traumatic event requiring investigation into digital devices, the Justice Department loudly claims that it needs backdoors to encryption, and then quietly announces it actually found a way to access information without threatening the security and privacy of the entire world," said Brett Max Kaufman, a senior staff attorney at the American Civil Liberties Union. "The boy who cried wolf has nothing on the agency that cried encryption."
Messrs. Barr and Wray didn't provide details about how they were initially unable to unlock the phones.
Alshamrani posted anti-U.S. messages on social media about two hours before he opened fire in a classroom at Naval Air Station Pensacola on Dec. 6, killing three and wounding eight more before he was fatally shot, officials have said. He had been communicating with al Qaeda operatives shortly before the attack, but Mr. Wray said his communications and radicalization dated back to as early as 2015.
"The evidence we've been able to develop from the killer's devices shows that the Pensacola attack was actually the brutal culmination of years of planning and preparation by a longtime [al Qaeda] associate," Mr. Wray said.
The gunman described a desire to learn about flying years ago, about the same time he talked about attending the Saudi Air Force Academy in order to carry out what he described as a "special operation," Mr. Wray said.
"And he then pressed his plans forward, joining the Air Force and bringing his plot here," he said.
Among other information that investigators found in Alshamrani's iPhone was a final will purporting to explain himself, Mr. Wray said. Al Qaeda's leader in the Arabian Peninsula released the will two months later, claiming responsibility for the attack. Officials wouldn't say whether al Qaeda directed the shooting, but described his relationship with the group as deep and complex.
"It is certainly more than just inspired," Mr. Wray said.
During the December gunbattle, Alshamrani paused to open fire at his iPhone, damaging it and causing investigators to believe it held critical clues about his planning. The second phone was also badly damaged. Some mobile-phone security experts said at the time that the FBI could likely work with a third-party vendor to unlock the phone, as it had done in previous cases, but Mr. Wray said on Monday that option had been exhausted and that no outside parties consulted had a solution.
"Unfortunately, the technique we developed is not a fix for our broader Apple problem," Mr. Wray said.
Investigators secured a court order for information from the gunman's devices within a day of the shooting but remained unable to get into his encrypted phones. In January, Mr. Barr criticized Apple publicly for what he labeled a refusal to provide any substantial assistance in the investigation, and said investigators were unable to gain entry into the phones.
At the time, however, senior Justice and FBI officials privately told congressional staff that there was nothing Apple could do to unlock the iPhones in question, The Wall Street Journal reported at the time, though the officials criticized Apple for not having created a method for doing so.
Mr. Barr on Monday also accused the iPhone maker of cooperating with China and Russia to move data centers within their borders, saying the company was more willing to work with authoritarian regimes than the U.S. Apple said it deployed strong security protections in its data centers to ensure there are "no backdoors in our systems" and said such practices applied to its operations in every country.
"There is no reason why companies like Apple cannot design their consumer products and apps to allow for court-authorized access by law enforcement, while maintaining very high standards of data security," Mr. Barr added. "Striking this balance should not be left to the corporate boardrooms. It is a decision that must be made by the American people through their representatives."
There was no immediate response from the Saudi government to the FBI's latest findings. The kingdom was quick to condemn the attack at the time, amid elevated tension between Washington and Riyadh.
Alshamrani's brother, Abdullah, reached by phone on Monday, declined to comment. "The topic is over," he said. His father told a Saudi-owned television channel in December there had never been any suspicions about his son.
The revelation comes as the FBI has been focused on preventing terrorist attacks inspired by Islamic State, though Mr. Wray told Congress in February that al Qaeda remains a top concern, even as U.S. counterterrorism efforts have degraded the group's leadership in the Afghanistan-Pakistan region and in Yemen.
The attack raised questions about how the Defense Department screens potential Saudi trainees. The shooting also prompted the expulsion of 21 Saudi military students from the training program in which the gunman took part. They were immediately returned to Saudi Arabia on other violations. While some of them possessed jihadist or anti-U.S. material, there was no evidence they participated in the attack.
"Based on the FBI findings, and in addition to already executed protective measures, the department will take further prudent and effective measures to safeguard our people," Defense Secretary Mark Esper said on Monday.
The department suspended operational training programs for nearly three months for all of the roughly 850 Saudi military students training in the U.S. Mr. Esper also approved new restrictions on the use of firearms and access to government facilities for such students, who he said would be continually monitored while enrolled in U.S.-based training programs.
The FBI's findings are likely to reignite criticism in the U.S. and Europe of Saudi Arabia, which has struggled to improve public opinion about its day-to-day ruler, Crown Prince Mohammed bin Salman, who has promised to promote a more-moderate form of Islam.
On top of the Yemen war and repression of domestic critics, including the 2018 killing of journalist Jamal Khashoggi, U.S. lawmakers have slammed Saudi Arabia for launching an oil-price war with Russia just as the coronavirus pandemic sapped global demand.
(MORE TO FOLLOW) Dow Jones Newswires