FBI director James Comey has told a cybersecurity conference that any communications – be it with your spouse, your priest, or your lawyer – and any of your memories are up for grabs should a court order it.
Speaking at the Boston Cyber Security Summit, Comey said that America's founding fathers had set down that there is a right to privacy but that the government has a right to intrude in the name of security. It was part of a 200-year old "bargain of ordered liberty," he opined.
"Even our memories are not absolutely private in America," he said.
"Any of us can be compelled – in appropriate circumstances – to say what we remember, what we saw. Even our communications with our spouses, with our clergy members, with our attorneys are not absolutely private in America. In appropriate circumstances a judge can compel any one of us to testify in court about those very private communications."
Comey made this argument as part of a discussion about the FBI's relationship with encryption. He said that encryption had always been part of computer technology, but after Edward Snowden's whistleblowing we had seen a huge rise in the use of encryption, and this was making life difficult for the FBI.
Between October and November last year, the FBI had taken 2,800 devices that it had the lawful right to search. But because of their encryption the FBI wasn't able to break into 1,200 of them. Technology firms have taken strong encryption and given it to everyone, even drug dealers and pedophiles, he complained.
Given the leak of the CIA's exploit list on Tuesday, that seems difficult to understand. Several of the zero-day attacks on mobile operating systems were listed as coming from the FBI, and the agency can call on the resources of the NSA and private companies as needed.
Comey professed himself a fan of both privacy and strong encryption. On the privacy side of things he has an Instagram account, he said, but it only has nine followers because he blocks everyone but family members. He said he likes that privacy, but would open up the account if compelled to do so under the law.
Similarly with encryption, Comey said the FBI protects its own data with strong encryption and issues encrypted devices to its agents. But if necessary, it can still get around the encryption on those devices and companies need to have a similar approach, he argued.
Comey denied that Apple and the FBI had been in conflict over encryption, despite the extensive legal proceedings the agency went through to try to force Cook & Co to do its bidding. He asked again for an adult conversation about the encryption debate.
"We need to stop bumper stickering each other, and tweeting at each other," he said. "There are no evil people in this debate."
Hacktivists more dangerous than terrorists
In his talk, Comey outlined the FBI's top five cybersecurity threats and his ordering might cause some surprise.
Top of the list was nation state hackers, he said, followed closely by international professional hacking groups that worked for money. The next most dangerous threat was employees and staff carrying out insider attacks, he said, followed by hacktivists seeking to use computer crime to advance political aims.
But at the bottom of the FBI's list were terrorists. While terrorist groups have proved adept at using the internet to spread propaganda and recruit new members, they are relatively unskilled and haven't turned to online crime to carry out attacks, Comey said.
To beat these threats the FBI is trying to get better skills by recruiting from the outside. The Feds are looking for people with the right skills, physical fitness, and integrity. There's no point hiring someone who's a whiz at computing and fit enough to pack heat if they "smoke weed on the way to the interview," he joked.
The FBI can't match private industry when it comes to salaries, Comey said, but the FBI is trying to make the organization more tech-friendly. That doesn't mean beanbags and whiteboards he said, but the agency wanted to attract talent and so would have to loosen up a little.
The FBI has also introduced internal competition, he said, so that now an online investigation will be carried out by whoever is most skilled, not by whoever is at the scene of the crime. All field offices will have a cyber specialist and Comey expects the competitive aspect to lead to improvements in skills and conviction rates.
He also appealed for companies to work with the FBI more, saying that if you are a chief security officer and don't know your local FBI officer then you're failing at your job. But he issued a stern warning against companies hacking back against attackers.
"Don't do it, it's a crime," Comey pronounced. "It also runs the risk of creating confusion in a crowded space." ®