FBI Director Christopher A. Wray gave the keynote at the Jan. 9 opening session of the Fordham-FBI 2018 International Conference on Cyber Security. He spoke of “the Going Dark problem” of protected electronic devices, and the lapse of part of the Foreign Intelligence Surveillance Act (FISA), should Congress fail to renew it this month.

Due to an industry practice of encrypting cell phones, computers, and other electronic consumer products, Wray said that last year the FBI was unable to access the content of nearly 7,800 devices, even though “there is lawful authority to do so.”

“Each one of those devices is tied to a specific subject, a specific defendant, a specific victim, a specific threat.,” said Wray, who was appointed last year following President Trump’s firing of then-director James Comey. “We are not looking for a ‘back door’ . . .[but]the ability to access the device once we’ve obtained a warrant from an independent judge, who has said we have probable cause.”

“it’s an urgent public safety issue.”

He also called for the immediate extension of Section 702 of the FISA, which allows the government warrantless monitoring of internet and phone communications to gather foreign intelligence information.

Wray, a former federal prosecutor who was in private practice when tapped for the director’s position, gave his talk from the “fresh perspective” of someone returning to law enforcement after approximately a decade.

“Back then, ‘tweeting’ was something only birds did. Now…well, let’s just say it’s something that’s a little more on my radar,” Wray said.

Wray defended the agency’s impartiality, saying that it is the honest process, not the result, that his FBI agents are passionate about.

“If the bureau starts chasing results, that’s fool’s gold. There is always going to be somebody unhappy about something that we do,” he said. “[We] let the facts go where they go.”

Higher Stakes, More Complexities

Since he last worked in law enforcement, Wray said “the [cyber]threats are growing more complex, and the stakes are higher than ever.” In fact, he noted that the term “cybercrime” is nearing redundancy, as nearly all crimes today—from terrorism to human trafficking to gangs to organized crime—involve some technological or digital component.

The FBI has been successful in infiltrating and destroying some major global operations: Wray mentioned the takedown last summer of AlphaBay, an online black market for drugs, malware, stolen identities, and more. Yet upcoming challenges incorporating more AI and cryptocurrencies will require new approaches and collaborations.

To those ends, he said, one of the main challenges facing the FBI today is finding persons who are high-end cyber-proficient, and to raise the game to stay ahead of threats. “The sad realization is that there are too few people in this country—in any country—who have that expertise. It’s a great place to be, if you are a college kid right now.”

Joseph M. McShane, S.J., president of Fordham, introduced Wray and fielded questions to him following his talk. Citing the foreign meddling in the 2016 U.S. presidential election, Father McShane emphasized cybersecurity’s vital contribution to world institutions.

“The work the FBI does has never been more important, not merely to the security of democratically-elected governments, but to world markets and to the infrastructure of civilization itself.”

(Read Director Wray’s full remarks.)

READ MORE ICCS DAY 1 COVERAGE:

To Take Out Dark Net Marketplace, Luck, Skill, Cooperation Required

Operation Harbor: an Insider’s Look at the Hunt for a German Router Hacker

There’s No Hiding

“We are moving to a place where our devices are absolutely private,” he said.

Comey made the remarks on July 27 at the International Conference on Cyber Security sponsored by Fordham and the FBI.

He said that the nation’s founders had struck a bargain when it came to ensuring privacy, and that the agreement allowed the government to intervene “with the appropriate oversight” when there is probable cause of a threat, such as terrorism.

“Judges even have the ability to force us to say what’s in our heads,” he said. “They can force to testify to what we saw, what we heard, we witnessed.”

Currently, “huge swaths of American life are out of reach” to the FBI, and that this could lead to a “major event” that the bureau would be helpless in preventing, he said. Referencing the iPhone encryption dispute from earlier this year, in which the bureau attempted to have a court order for Apple to unlock a terrorist’s iPhone, Comey said the conversation got diverted.

“The case was entirely about that investigation but it became a rallying point of so much emotion,” he said.

Comey said that after this year’s presidential election, the country would have to grapple with the questions of encryption, privacy, and terrorism. He said that it was not the job of the FBI to decide what to do, but it’s a debate that will have to happen—and one that he doesn’t want to have after an attack.

“We will not be able to have this conversation if something terrible happens,” he said. “This is a hard conversation. It’s conflict of two values we all share. It does not fit in a tweet.”

In the meantime, he said, it’s the bureau’s duty to make sure the public understands the dangers of unlimited privacy. He said that he recognized the tech companies’ concerns for their customers, but if the FBI cannot do its job, then it is the Bureau’s responsibility to make sure the nation understands the danger.
“If the tools don’t work we need to shout from the rooftops the costs of absolute privacy,” he said.

The director also said that the FBI needs to be more “predictive and less reactive” to cyber attacks, but with the realization that it can’t prevent “all manner of cyber intrusion.” He said that the Bureau encourages healthy competition between its offices. Where the “physical manifestation” of a cyber attack occurs is not important, he said. The best-qualified office should address the crisis.

“If Little Rock has the chops, it will be worked there, if Pittsburgh has the chops, it’ll be worked in Pittsburgh,” he said.

He added that the competition for talent is fierce and the FBI can compete better with its mission than with money.

“We have to start to make sure the talent sees what we’re about,” he said.

He added that the requirement for agents on a cybersecurity team may have to adapted from the bureau’s current requirement that all agents be able “run, fight, and shoot,” as well maintain integrity and be highly intelligent. He said the average cybersecurity squad at the bureau consists of eight special agents, but in the future a mix of non-agent talent with agent talent might better serve the cause.

He told the audience they also need to do their part as private companies and be prepared before a breach happens. He encouraged them to form similar relationships with their local FBI office as they have with their local fire department to be prepared before a fire breaks out.

“You’ve made sure that the fire department doesn’t need to be figuring out how many floors you have, how many exits you have, or where your stand pipes are during a fire,” he said. “You haven’t shown them anything secret, but they’re able to operate in smoke and save lives.”

“It’s very, very smart for you to make sure we know who you are, and like your fire department, we have general sense of what help you might need in the event of a fire.”