FBI Director James Comey, speaking at Boston College Wednesday morning, said widespread digital encryption of devices and apps has made the FBI’s work more difficult.
“In October, November, and December, the FBI received to our examiners 2,800 devices for which we had lawful authority to open,” he said. “Twelve-hundred of those devices, so about 43 percent, we could not open with any technique.”
Speaking at BC’s cybersecurity conference, Comey said encryption used to be utilized by “the sophisticated actor.” Now, he said, it is used by drug dealers and other lower-end criminals.
Comey said he was not calling for weaker encryption, and that “strong encryption is a great thing” for cyber security efforts. But should Americans have an expectation of total privacy through encryption? That still needs to be answered, he said.
The FBI director also suggested that he intends to fulfill his ten-year term at the head of the agency: “You’re stuck with me for about another six and a half years,” he said.
The speech came against a fraught political backdrop that has featured various high-profile cyber security issues in recent days.
On Tuesday, WikiLeaks, the international platform that publishes classified government documents, released information, apparently from the Central Intelligence Agency, showing how the spy agency can hack into Internet-connected consumer electronics like smartphones and televisions.
The remarks also came four days after President Trump tweeted that his predecessor, Barack Obama, had wiretapped Trump Tower during the presidential campaign. It remains unclear what the president was referring to or what evidence backs up his claim, and according to media reports, Comey unsuccessfully asked the Department of Justice over the weekend to deny the accusation.
Comey, appointed in 2013, repeated calls he has previously made encouraging Americans to have a robust debate over encryption.
Last year, the FBI and Apple feuded over whether the company should have helped the agency break into the cell phone of one of the San Bernadino terrorists. Apple resisted a court order, arguing it could lead to future privacy violations. The issue was dropped after the FBI found a way to break into the phone.
Comey noted that he did not see Apple as “evil” in its approach to the issue.
“We need to stop bumper-stickering people, we need to stop tweeting at each other. We need to find the space to have a really hard conversation about how we want to be,” Comey said. “We need an understanding that everyone is approaching this debate with an open mind and a genuine respect for the rule of law and for privacy and public safety.”
Comey also highlighted a distinction between traditional cyber espionage and corporate theft.
“Nation states engage in intelligence gathering. They always have, they always will,” Comey said. “What nation states do not do and cannot do is steal stuff to make money. To steal innovation, to steal formulas ... That is criminal behavior. That is very different from the actions of a nation state engaged in espionage.”
In his remarks, which lasted about 45 minutes, Comey urged companies to be in close touch with the FBI about cyber threats. He also outlined the agency’s strategy for dealing with the threat, which includes focusing on recruiting tech talent and fostering internal competition to improve the agency’s tactics.
During the campaign, Comey investigated the private e-mail server used by Democratic candidate Hillary Clinton while she served as secretary of state, a practice that was criticized for putting classified information at risk. Ultimately, he did not recommend criminal charges against Clinton, angering conservatives, but his announcement that he was reopening the investigation — two weeks before the election — caused an uproar on the political left.
Meanwhile, e-mails from the Clinton campaign and the Democratic National Committee were made public during the election. US intelligence officials have attributed the email releases to hacking initiatives directed by the Russian government, fueling calls for investigations into the Trump campaign’s relationship with Russia.
Comey did not speak about these developments in his speech or in a brief question-and-answer session with conference attendees following his remarks. Nor did he speak with reporters. In the speech, he did classify nations, as opposed to hacking syndicates and activist groups, as the top cyber threats, naming Russia as one such country.
“I’m very slippery,” he said. “I’ll avoid talking about things I don’t want to talk about.”
Prior to Comey’s speech, Harold Shaw, the special agent in charge for the FBI’s Boston division, said the region is “a target-rich environment” for cyber criminals, because of the defense contractors, colleges, and tech companies it hosts. -- ADAM VACCARO