FBI boss: 'Memories are not absolutely private in America'

Comey blames Snowden for popularity of encryption


FBI director James Comey has told a cybersecurity conference that any communications – be it with your spouse, your priest, or your lawyer – and any of your memories are up for grabs should a court order it.

Speaking at the Boston Cyber Security Summit, Comey said that America's founding fathers had set down that there is a right to privacy but that the government has a right to intrude in the name of security. It was part of a 200-year old "bargain of ordered liberty," he opined.

"Even our memories are not absolutely private in America," he said.

"Any of us can be compelled – in appropriate circumstances – to say what we remember, what we saw. Even our communications with our spouses, with our clergy members, with our attorneys are not absolutely private in America. In appropriate circumstances a judge can compel any one of us to testify in court about those very private communications."

Comey made this argument as part of a discussion about the FBI's relationship with encryption. He said that encryption had always been part of computer technology, but after Edward Snowden's whistleblowing we had seen a huge rise in the use of encryption, and this was making life difficult for the FBI.

Between October and November last year, the FBI had taken 2,800 devices that it had the lawful right to search. But because of their encryption the FBI wasn't able to break into 1,200 of them. Technology firms have taken strong encryption and given it to everyone, even drug dealers and pedophiles, he complained.

Youtube Video

Given the leak of the CIA's exploit list on Tuesday, that seems difficult to understand. Several of the zero-day attacks on mobile operating systems were listed as coming from the FBI, and the agency can call on the resources of the NSA and private companies as needed.

Comey professed himself a fan of both privacy and strong encryption. On the privacy side of things he has an Instagram account, he said, but it only has nine followers because he blocks everyone but family members. He said he likes that privacy, but would open up the account if compelled to do so under the law.

Similarly with encryption, Comey said the FBI protects its own data with strong encryption and issues encrypted devices to its agents. But if necessary, it can still get around the encryption on those devices and companies need to have a similar approach, he argued.

Presumably this means some kind of shared key exchange, with the government holding one of the keys. We suggest he ask the NSA, CIA, and OPM how well their secrets were protected.

Comey denied that Apple and the FBI had been in conflict over encryption, despite the extensive legal proceedings the agency went through to try to force Cook & Co to do its bidding. He asked again for an adult conversation about the encryption debate.

"We need to stop bumper stickering each other, and tweeting at each other," he said. "There are no evil people in this debate."

Hacktivists more dangerous than terrorists

In his talk, Comey outlined the FBI's top five cybersecurity threats and his ordering might cause some surprise.

Top of the list was nation state hackers, he said, followed closely by international professional hacking groups that worked for money. The next most dangerous threat was employees and staff carrying out insider attacks, he said, followed by hacktivists seeking to use computer crime to advance political aims.

But at the bottom of the FBI's list were terrorists. While terrorist groups have proved adept at using the internet to spread propaganda and recruit new members, they are relatively unskilled and haven't turned to online crime to carry out attacks, Comey said.

To beat these threats the FBI is trying to get better skills by recruiting from the outside. The Feds are looking for people with the right skills, physical fitness, and integrity. There's no point hiring someone who's a whiz at computing and fit enough to pack heat if they "smoke weed on the way to the interview," he joked.

The FBI can't match private industry when it comes to salaries, Comey said, but the FBI is trying to make the organization more tech-friendly. That doesn't mean beanbags and whiteboards he said, but the agency wanted to attract talent and so would have to loosen up a little.

The FBI has also introduced internal competition, he said, so that now an online investigation will be carried out by whoever is most skilled, not by whoever is at the scene of the crime. All field offices will have a cyber specialist and Comey expects the competitive aspect to lead to improvements in skills and conviction rates.

He also appealed for companies to work with the FBI more, saying that if you are a chief security officer and don't know your local FBI officer then you're failing at your job. But he issued a stern warning against companies hacking back against attackers.

"Don't do it, it's a crime," Comey pronounced. "It also runs the risk of creating confusion in a crowded space." ®

Similar topics


Other stories you might like

  • Telegram adds paid tier as it cracks 700 million users
    Without so much as a mention of encryption, but with a pastel-hued emoji-heavy nod to ‘sustainable monetization’

    Messaging app Telegram, which came to prominence for offering end-to-end encryption that irritated governments, has celebrated passing 700 million active monthly users with a pastel-hued announcement: a paid Premium tier of service.

    A Sunday post celebrates the 700 million user milestone by announcing a $4.99/month tier. The Premium tier distinguishes itself from the freebie plebeian tier with the ability to upload 4GB files, unthrottled downloads that come as fast as users' carriers will allow, and the chance to follow up to 1000 channels, create up to 20 chat folders each containing up to 200 chats, and to run four accounts in the Telegram app.

    Paying punters will also get exclusive stickers and reactions and won't see ads once they sign up to hand over coin each month.

    Continue reading
  • Man gets two years in prison for selling 200,000 DDoS hits
    Over 2,000 customers with malice on their minds

    A 33-year-old Illinois man has been sentenced to two years in prison for running websites that paying customers used to launch more than 200,000 distributed denial-of-services (DDoS) attacks.

    A US California Central District jury found the Prairie State's Matthew Gatrel guilty of one count each of conspiracy to commit wire fraud, unauthorized impairment of a protected computer and conspiracy to commit unauthorized impairment of a protected computer. He was initially charged in 2018 after the Feds shut down 15 websites offering DDoS for hire.

    Gatrel, was convicted of owning and operating two websites – DownThem.org and AmpNode.com – that sold DDoS attacks. The FBI said that DownThem sold subscriptions that allowed the more than 2,000 customers to run the attacks while AmpNode provided customers with the server hosting. AmpNode spoofed servers that could be pre-configured with DDoS attack scripts and attack amplifiers to launch simultaneous attacks on victims.

    Continue reading
  • Former chip research professor jailed for not disclosing Chinese patents
    This is how Beijing illegally accesses US tech, say Feds

    The former director of the University of Arkansas’ High Density Electronics Center, a research facility that specialises in electronic packaging and multichip technology, has been jailed for a year for failing to disclose Chinese patents for his inventions.

    Professor Simon Saw-Teong Ang was in 2020 indicted for wire fraud and passport fraud, with the charges arising from what the US Department of Justice described as a failure to disclose “ties to companies and institutions in China” to the University of Arkansas or to the US government agencies for which the High Density Electronics Center conducted research under contract.

    At the time of the indictment, then assistant attorney general for national security John C. Demers described Ang’s actions as “a hallmark of the China’s targeting of research and academic collaborations within the United States in order to obtain U.S. technology illegally.” The DoJ statement about the indictment said Ang’s actions had negatively impacted NASA and the US Air Force.

    Continue reading
  • Protecting data now as the quantum era approaches
    Startup QuSecure is the latest vendor to jump into the field with its as-a-service offering

    Analysis Startup QuSecure will this week introduce a service aimed at addressing how to safeguard cybersecurity once quantum computing renders current public key encryption technologies vulnerable.

    It's unclear when quantum computers will easily crack classical crypto – estimates range from three to five years to never – but conventional wisdom is that now's the time to start preparing to ensure data remains encrypted.

    A growing list of established vendors like IBM and Google and smaller startups – Quantum Xchange and Quantinuum, among others – have worked on this for several years. QuSecure, which is launching this week after three years in stealth mode, will offer a fully managed service approach with QuProtect, which is designed to not only secure data now against conventional threats but also against future attacks from nation-states and bad actors leveraging quantum systems.

    Continue reading
  • Stolen university credentials up for sale by Russian crooks, FBI warns
    Forget dark-web souks, thousands of these are already being traded on public bazaars

    Russian crooks are selling network credentials and virtual private network access for a "multitude" of US universities and colleges on criminal marketplaces, according to the FBI.

    According to a warning issued on Thursday, these stolen credentials sell for thousands of dollars on both dark web and public internet forums, and could lead to subsequent cyberattacks against individual employees or the schools themselves.

    "The exposure of usernames and passwords can lead to brute force credential stuffing computer network attacks, whereby attackers attempt logins across various internet sites or exploit them for subsequent cyber attacks as criminal actors take advantage of users recycling the same credentials across multiple accounts, internet sites, and services," the Feds' alert [PDF] said.

    Continue reading
  • Cheers ransomware hits VMware ESXi systems
    Now we can say extortionware has jumped the shark

    Another ransomware strain is targeting VMware ESXi servers, which have been the focus of extortionists and other miscreants in recent months.

    ESXi, a bare-metal hypervisor used by a broad range of organizations throughout the world, has become the target of such ransomware families as LockBit, Hive, and RansomEXX. The ubiquitous use of the technology, and the size of some companies that use it has made it an efficient way for crooks to infect large numbers of virtualized systems and connected devices and equipment, according to researchers with Trend Micro.

    "ESXi is widely used in enterprise settings for server virtualization," Trend Micro noted in a write-up this week. "It is therefore a popular target for ransomware attacks … Compromising ESXi servers has been a scheme used by some notorious cybercriminal groups because it is a means to swiftly spread the ransomware to many devices."

    Continue reading
  • Europe proposes tackling child abuse by killing privacy, strong encryption
    If we're gonna go through this again, can we just literally go back in time?

    Proposed European regulations that purport to curb child abuse by imposing mass surveillance would be a "disaster" for digital privacy and strong encryption, say cybersecurity experts.

    A number of options have been put forward for lawmakers to mull that aim to encourage or ensure online service providers and messaging apps tackle the "detection, removal, and reporting of previously-known and new child sexual abuse material and grooming."

    These options range from voluntary detection and reporting of child sexual abuse material (CSAM) and grooming, to legally mandating that service providers find and report such material using whatever detection technology they wish — essentially scanning all private communications and, if necessary, breaking end-to-end (E2E) encryption for everyone.

    Continue reading

Biting the hand that feeds IT © 1998–2022