Source: United States Attorneys General 13
Good morning, and thank you, Jim [Lewis], for that kind introduction. I am pleased to be here speaking to you today, and I want to thank the Center for Strategic and International Studies (CSIS) for having me.
Over the past two and a half years, I have had the honor of serving as the Justice Department’s Assistant Attorney General for the Criminal Division – and with that, the responsibility of ensuring that the division and its over 700 prosecutors have the support and authorities they need to fulfill their responsibilities to the American people. I have also had the opportunity to see first-hand the dedication, rigor, intelligence and respect that America’s prosecutors bring to their work every day. As my time as the Assistant Attorney General of the Criminal Division comes to a close, I am incredibly proud of where the division stands today and all that we have accomplished together.
One constant truth about investigating and prosecuting crime is that it is never without its challenges, although the precise nature of the difficulties and obstacles we face changes with the times. Today, some of the most significant hurdles we encounter relate to technology and the Internet.
Innovation in computing, the Internet, and related services has had tremendous benefits for our economy, our ability to connect with others, and the convenience, efficiency, and security of our everyday lives. It has also transformed how we in law enforcement do our jobs by expanding our ability to detect, investigate and prosecute criminal activity.
However, these same innovations permit criminals to more easily victimize Americans, including from afar, while concealing their identities and enabling destruction of evidence. We face an enormous task in responding to these new threats – ranging from botnets and ransomware to online child sexual exploitation and firearms trafficking, to name just a few – and that task is not getting any easier. This morning I will focus on four challenges that have been and must continue to be the center of our work if we intend to succeed:
• First, the growth of sophisticated, global cyber threats;
• Second, dangerous loopholes in our legal authorities;
• Third, the widespread use of warrant-proof encryption; and,
• Fourth, inefficient cross-border access to electronic evidence.
As I will explain in more detail, the past few years have marked some significant progress in some of these areas. We have grown more nimble and effective in cooperative international law enforcement efforts to bring cyber criminals to justice and remediate cybercrime. And we have managed to effect some targeted and common-sense improvements in legal authorities. But in other areas, the challenges remain, and in some cases have become more prominent. Let me begin with the threat. The global nature of the Internet means that criminals now can easily victimize more people within the United States in more dangerous ways, all without ever setting foot here. Some of the most significant criminal activity in recent years is the result of sophisticated criminal groups reaching across our borders from perceived safe harbors. As we rely more and more on network communications to handle virtually every aspect of our lives, the cost of cybercrime will only rise – to over two trillion globally by 2019, according to some estimates – and the United States is a uniquely attractive target.
We have responded first and foremost by aggressively identifying, apprehending, and prosecuting offenders. This past October, for example, the Russian cybercriminal Roman Seleznev was convicted by a jury in Seattle. Seleznev was a hacker who, from the other side of the world, pilfered data for millions of payment cards from the computer systems of small business owners across America – a crime that strikes at the trust and security of our everyday financial transactions. Seleznev was the son of a member of the Russian parliament, and the Russian government filed diplomatic protests and tried to pressure us into releasing him. But that’s not how justice in America works, and he is now in an American prison.
We recognize that we cannot prosecute our way out of cybercrime, but prosecution must remain an integral component of our response to global cyber threats. That is why foreign hackers like “Guccifer” – who hacked into the email and social media accounts of about a hundred Americans, including two former U.S. presidents – as well as Vladimir Drinkman and Dmitriy Smilianets – who, along with co-conspirators, conducted a worldwide hacking scheme that compromised more than 160 million credit card numbers – have likewise found themselves within the reach of American law enforcement. Thanks to the work of our colleagues in the National Security Division, the same holds true for individuals like Su Bin – who conspired with Chinese military hackers to steal cutting-edge U.S. aircraft designs – and Ardit Ferizi – who shared stolen PII belonging to 1,300 U.S. military and government personnel with a member of ISIL, for publication on a hit list. All have now been brought to the United States to face justice.
The department’s strong track record in this area is a critical deterrent to would-be attackers. Over the last twenty years, for example, our Computer Crime and Intellectual Property Section (CCIPS) – the centerpiece of our prosecutorial response to criminal cyber threats – has successfully prosecuted cases involving more than one billion stolen pieces of information, including payment card data, email addresses and social security numbers – more than three pieces of data for every American alive today.
Our international partnerships make this work possible. And they have been key in another way as well. Even when prosecution is not yet an option – for example, because we have been unable to identify or apprehend a criminal target – we have developed operational expertise in disrupting cybercriminal infrastructure in the United States and abroad. For example, we have worked hand-in-hand with our foreign partners to address technical threats like botnets, so-called “bulletproof” hosts, Darknet markets and international hacking forums.
Indeed, just last week, the department led a multinational operation to dismantle a vast network of dedicated criminal servers known as “Avalanche,” which allegedly hosted more than two dozen of the world’s most dangerous and persistent malware campaigns. The Avalanche network served clients operating as many as 500,000 infected computers on a daily basis and is associated with monetary losses in the hundreds of millions of dollars worldwide. We were joined in this effort by investigators and prosecutors from more than 40 jurisdictions across the globe. We must maintain existing international law enforcement cooperation – and develop new mechanisms to work with foreign partners – if we hope to continue these successes.
These efforts have also benefitted from growth in our technical and investigative capacity. The Criminal Division has steadily increased resources for CCIPS, along with its in-house Cybercrime Lab, over the last two years. The Cybercrime Lab has become the go-to resource across U.S. law enforcement for intractable problems in accessing and understanding digital evidence, whether that means uncovering evidence that a defendant accessed online terrorist radicalization materials to rebut a claim of entrapment, or cracking passwords to dozens of devices that hold key evidence of serious crimes.
We have also found that augmenting our own expertise and legal authorities with insight from private sector institutions allows us to identify and develop new, creative responses. For example, in 2014, the FBI, in conjunction with a coalition of nearly a dozen foreign countries and a group of elite computer security firms, dismantled the Gameover Zeus botnet. That botnet, which infected more than one million computers around the world, inflicted over $100 million in losses on American victims alone, and was responsible for the spread of the Cryptolocker ransomware. The Gameover Zeus operation represents what we can achieve when law enforcement agencies collaborate with private sector experts, and indeed, many private organizations provided similar assistance in the recent Avalanche take-down. I hope that it will continue to serve as a model for the department’s future work.
This relationship works in both directions. The investigative experience of our CCIPS prosecutors can offer important lessons for private sector entities. In addition, navigating the federal laws that govern network monitoring practices – laws in which CCIPS specializes – can be fraught for organizations seeking to improve their cybersecurity. That is why, two years ago, we created the Cybersecurity Unit, a group of CCIPS prosecutors who can leverage their case-related experience to develop and share practical cybersecurity advice with the private sector. The Unit has also played an integral role in implementation of the Cybersecurity Information Sharing Act (CISA). So not only have we benefitted from private sector experts for our operational needs, but we have made a practice of sharing our knowledge base as well.
Even as the department addresses technical obstacles to preventing and prosecuting cybercrime, however, we confront a second challenge: arbitrary gaps in the law that frustrate some of our most pressing investigations. One example of such a loophole was the venue provision of Rule 41 of the Federal Rules of Criminal Procedure.
As that Rule existed prior to Dec. 1, 2016, when law enforcement sought court approval for a search warrant, it generally was required to seek authorization from a court sitting in the same geographic district where the property to be searched was located. This Rule made perfect sense in dealing with the physical world. But in the cyber-world, we increasingly face scenarios where criminals use technology to hide the location of their computers, meaning that we could not know where the computers were located. In those circumstances, federal law did not clearly identify which judge could authorize a search.
Similarly, we regularly encounter crimes like mass hacking through botnets that are carried out in multiple districts at once, all across the country. But in order to respond in a timely, comprehensive manner, the prior version of the Rule arguably required authorities to obtain a warrant in each district – up to 94 in all, across 9 time zones, ranging from the Virgin Islands to Guam.
Last week, a three year effort, spearheaded by the Criminal Division, and approved by the U.S. Supreme Court, culminated in a targeted, procedural fix to the venue provisions of the Rule to ensure that technology does not render our investigative abilities obsolete. The update to the Rule does not alter the probable cause or other standards we must meet to obtain a search warrant. What the Rule does change is that now, when criminals hide the location of their computers through anonymizing technology, we don’t have to figure out in which federal district the computers are physically located before we can act to stop criminal activity. Likewise, when a criminal deploys a botnet that indiscriminately infects computers nationwide – as many botnets now do – we don’t have to go to as many as 94 different judges.
The need to update Rule 41 was not theoretical. Today, dozens of websites on Tor – a proxy network – openly distribute images of child rape and sexual exploitation, where they are frequented by tens of thousands of pedophiles. These sites can thrive in the open because proxy networks, like Tor, hide the locations of the criminals’ servers and the identities of their administrators and users. While law enforcement – and the general public – can easily find images of child sexual exploitation by visiting one of these sites, we often cannot locate and shut down the websites or identify and apprehend the abusers. More troubling, the child victims stand little chance of rescue.
The recent investigation of “Playpen,” a Tor site used by more than 100,000 pedophiles to encourage child sexual abuse and trade sexually explicit images of that abuse, illustrates why a Rule 41 fix was necessary. In that case, authorities were able to wrest control of the site from the administrators, and then obtained court approval to use a remote search tool to retrieve limited information, including the user’s IP address, only if a user accessed child pornography on the site. This enabled a traditional, real-world investigation, leading to more than 200 active prosecutions and the identification or rescue of at least 49 American children who were subject to sexual abuse.
Yet in some of the resulting cases, federal courts relying on the language of the prior version of Rule 41 found that even though the probable cause and other standards for obtaining a warrant were satisfied, evidence obtained in searches nevertheless had to be excluded because the judges who issued warrants lacked venue over the computers, which turned out to be physically located outside their geographic districts. This is a perverse result, as it would mean that criminals who are savvy enough to hide their locations – which is not difficult given current technologies – could place themselves beyond the reach of law enforcement.
This is a good example of why the amendments to Rule 41 are such a crucial step forward. They make clear which courts are available to consider whether a particular warrant application comports with the Fourth Amendment, without altering in any way the substantive requirements for – or privacy protections provided by – a warrant. This will ensure that criminals who use anonymizing technologies are not immune from justice, and that threats like botnets are not too big to investigate and remediate effectively.
This fix is a not a cure-all, however. Our response to cyber threats requires revisiting laws that simply did not anticipate and cannot adjust to modern technology. We must continue to move forward – not backward – to ensure that our laws protect Americans from criminals, and not the other way around.
I now want to turn to some challenges that, despite the best efforts of many, will continue to confront policymakers in the years to come. As society’s use of computers and the Internet has grown, so too has the importance of digital evidence in criminal investigations. In nearly every criminal investigation we undertake at the federal level – from homicides and kidnappings to drug trafficking, organized crime, financial fraud and child exploitation – critical information comes from smart phones, computers and online communications, often instead of physical evidence. Yet, these materials are increasingly unavailable to law enforcement as a result of certain implementations of encryption, even when we have a warrant to examine them.
This is because, in an attempt to market products and services as protective of personal privacy and data security, companies increasingly are offering products with built-in encryption technologies that preclude access to data even when a court has issued a search warrant. Service providers with more than a billion user accounts, that transmit tens of billions of messages per day around the world, now advertise themselves as unable to comply with warrants. And device manufacturers that have placed hundreds of millions of products in the market have embraced the same principle. We in law enforcement often describe this sort of encryption as “warrant-proof encryption.”
Let me be clear: the Criminal Division is on the front lines of the fight against cybercrime. We recognize that the development and adoption of strong encryption is essential to counteracting cyber threats and to promote our overall safety and privacy. But certain implementations of encryption pose an undeniable and growing threat to our ability to protect the American people. Our inability to access such data can stop our investigations and prosecutions in their tracks.
Inaction is not a suitable response. Our occasional success in accessing information protected by seemingly “warrant-proof encryption” is unpredictable and inadequate. There are devices in evidence lockers across the country that remain locked.
As the President reminded us recently, the Government has different responsibilities – a different “balance sheet” and different “stakeholders” – than a corporation. There is nothing wrong with companies pursuing profits and marketing strategies, but no one should expect that they will take into account all of the societal interests that are at stake. And that is especially true for our public safety mission. Our ability to protect Americans from crime has become dependent, in thousands of cases, on the business decisions of for-profit corporations. More troublingly, even when companies have the technical ability to reasonably assist us in accessing encrypted information, they have refused to do so for fear of “tarnishing” their image. Regardless of which side of this issue you are on, we can all agree that market-driven decisions are not and have never been a substitute for sound public safety policies.
Business decisions made by for-profit companies have had enormous effects on our public safety in other ways as well. Data held by major Internet service providers can be crucial to identifying and holding accountable the perpetrators of virtually every federal crime we handle. Increasingly, however, American providers and other providers subject to the jurisdiction of the United States are storing such information outside the United States, and not always at rest and in the same location. The data can be partitioned and stored in multiple locations, or moved about on an ongoing basis, and some providers may not even know where all data relating to a particular user is at a given time.
It is this last challenge – foreign-stored digital evidence – that I will close with today. The department has worked diligently to increase the cross-border availability of data, through mechanisms like the 24/7 Network, which facilitates the preservation of digital evidence, as well as mutual legal assistance treaties and the Budapest Convention on Cybercrime, which enhance international cooperation in obtaining that evidence. The Criminal Division has also directed additional resources toward a dedicated cyber mutual legal assistance unit in our Office of International Affairs, which has seen a 1,000 percent increase in incoming requests for computer records since 2000.
But while these are important crime-fighting tools, they have significant shortcomings. The United States has mutual legal assistance treaties with less than half the countries in the world, some of which place limitations on when assistance is available or the types of evidence that can be obtained. Even then, obtaining evidence can take months, if not years. Ireland, for example, reports that in routine cases it takes 15 to 18 months to execute a request for assistance from a foreign country. In less experienced or less cooperative countries, the process can take even longer. Sometimes we never receive a response at all.
Recently, the difficulties caused by foreign-stored data for public safety have become more acute. In July, the Second Circuit Court of Appeals, in the so-called “Microsoft Ireland” case, held that U.S. authorities cannot use a search warrant issued by a U.S. court pursuant to the Stored Communications Act (SCA) to compel a U.S. service provider, such as Microsoft, to produce data that it chooses to store for its own business purposes (and typically without the knowledge or input of its subscribers) outside the United States.
So, what is already a difficult and time-consuming process of gathering electronic evidence may now also become an impossible one, for both the United States and our partners. Since the Microsoft decision was handed down, U.S. providers such as Google, Microsoft and Yahoo! have refused to produce information that they have chosen to store abroad in response to search warrants issued by courts even outside the Second Circuit. This has been the case even in instances where the account-holder was an American citizen residing in the United States, and when the crime under investigation is carried out on American soil. And this includes warrants obtained on behalf of foreign countries pursuant to mutual legal assistant requests.
U.S. law generally does not require our providers to store this data in a particular location or make it accessible in any particular way. But as a result, the ability of law enforcement to effectively investigate serious crime may now be determined entirely by a provider’s data management practices, well-intentioned or not. One major American provider, for example, is unable to determine the country in which foreign-stored data is located; and even if it could, the data is frequently moved and may not be in the same country from day to day. Under the Second Circuit’s decision, a SCA warrant is not available. But sending an MLAT request to a foreign country could result – after months of delay – in a notification that the relevant data is no longer there.
It is for this reason that, in October, the department filed a petition for the case to be reheard by the entire Second Circuit en banc. It is also why we intend to submit legislation to Congress to address the decision’s significant public safety implications. This issue must be resolved before we move to other important initiatives, such as legislation to implement a cross-border data agreement with the United Kingdom.
Looking forward, I cannot predict how the rehearing petition, or the broader concerns implicated by the Microsoft decision, will play out. And I suspect that, whether the issue relates to warrant-proof encryption or cross-border access to evidence, reaching a resolution will be challenging. But these decisions must be made in the policy arena, not by the private sector alone. We cannot allow changing technologies or the economic interests of the private sector to overwhelm larger policy issues relating to the needs of public safety and national security. And we must let government fulfill its fundamental responsibilities to protect the American people.
I know that the panel to follow will focus on some of these challenges for the future, but let me offer my own thoughts here. In each of these areas, we must proceed thoughtfully and balance multiple different legitimate interests. Yet several basic principles should be obvious. First, sitting back and doing nothing is not an acceptable option. The world is changing around us, and those seeking to do harm are evolving with it; if those responsible for ensuring public safety do not have the same ability to adapt, public safety will suffer. Second, these changes pose policy challenges, and we need to develop policy responses. Rather than let evolutions in technology dictate our responses, we must think ahead as a society and develop appropriate frameworks to address new and upcoming challenges before they become crises. And finally, when there are multiple interests at stake – public safety, cybersecurity, international comity and civil rights and civil liberties – we cannot allow the most consequential decisions to be made by a single stakeholder, or leave them to the whim of the commercial marketplace. We would never tolerate that approach in other areas of importance to society, and we should not do so here. Thank you.
MIL Security OSI –