1
1
2
3 Keynote Address by
4 U.S. Attorney General Janet Reno on
5 High-tech and Computer Crime
6
7
8 Delivered at the Meeting of the P-8 Senior
9 Experts' Group on
10 Transnational Organized Crime
11
12
13 Tuesday, January 21, 1997
14 Chantilly, Virginia
15
16
17
18
19
20
21
22
2
1 P R O C E E D I N G S
2 ATTORNEY GENERAL RENO: Thank you,
3 Mark. I'm very touched by that introduction
4 and I hope I can live up to it. I want to
5 welcome you all to the United States for this
6 first Plenary session of 1997. I am very
7 pleased to be with you today.
8 Not only is this meeting the first
9 P-8 meeting under the U.S. Presidency, it is
10 the first multilateral meeting of President
11 Clinton's second Administration.
12 As you know, yesterday the President
13 took the oath of office for his second term.
14 His re-election brings with it the opportunity
15 for me to continue to work with international
16 and domestic law enforcement to bring security
17 to the citizens of our countries, and I
18 consider this a very special privilege.
19 Besides the historic significance of
20 this day, I want to share with you the
21 excitement and the enthusiasm I feel about and
22 toward the P-8. I view this group like no
3
1 other: The P-8 countries are a special group
2 made up of the world's most powerful
3 democracies. We are global leaders in so many
4 ways -- economically, technologically, legally,
5 and politically. Our small number allows us to
6 act quickly, and our unique membership offers
7 an opportunity to lead the world community that
8 is rarely found in our history. And we are
9 often on the cutting edge -- for example -- in
10 responding to international terrorism, to
11 international money laundering, to precursor
12 chemicals. This group has so much promise.
13 Through your work, giant strides are being made
14 in several critical areas that have significant
15 global implications.
16 No area of criminal activity is more
17 on the cutting edge or has greater global
18 implications than crime involving technology
19 and computers. The importance of emerging
20 technologies and the significance of global
21 computer networks cannot be overstated. If
22 properly developed and properly protected, they
4
1 will be used in virtually all personal
2 communications, financial transactions,
3 information sharing, medical care, and a myriad
4 of other applications. It is, indeed, a very
5 exciting time.
6 But while new technologies allow us
7 to do things that were previously impossible,
8 they can also be misused in creative ways to
9 threaten public safety and national security.
10 The same technologies that facilitate
11 lightning-fast and ultra-reliable transactions
12 between computers can be misused by hackers,
13 that is, by those who access computers without
14 or in excess of authority. They can access
15 confidential information, steal economic data,
16 disrupt telephone networks, and interfere with
17 the delivery of government and other vital
18 services.
19 So while the information age holds
20 great promise, law enforcement has a
21 responsibility to ensure that the users of
22 networks are not victimized in new ways.
5
1 To protect honest, law abiding
2 citizens, law enforcement must keep pace with
3 advances in computer and telecommunications
4 technologies. We must work to ensure that the
5 international law enforcement community can
6 keep pace with the criminals. This is
7 especially true in the case of computer
8 offenses, which differ from traditional crimes
9 in a number of ways and, as a result, create
10 new and very challenging problems:
11 First, international computer crimes
12 are easier to commit. Hackers are not hampered
13 by the existence of international boundaries,
14 since information and property can be
15 transmitted covertly via telephone and data
16 networks. A hacker needs no passport and
17 passes no checkpoints. He simply types a
18 command to gain entry. And there is little
19 need for manpower since a sole hacker, working
20 alone, can effectively steal or erase as much
21 information as he can read, or he can cause
22 extensive damage to global networks.
6
1 Secondly, until recently, computer
2 crime has not received the emphasis that other
3 international crimes have engendered. Even
4 now, not all affected nations recognize the
5 threat it poses to public safety or the need
6 for international cooperation to effectively
7 respond to the problem. Consequently, many
8 countries have weak laws, or no laws, against
9 computer hacking -- a major obstacle to solving
10 and to prosecuting computer crimes.
11 Thirdly, law enforcement faces new
12 procedural challenges, many of which are
13 impossible to address without international
14 consensus and cooperation. Consider, if you
15 will, merely locating a hacker whose
16 transmission passes from his computer to a
17 local service provider, then through a
18 telephone network, then crosses an ocean via
19 satellite, and then passes through a university
20 computer on its way to a corporate victim. To
21 make matters worse, this hacker could be in his
22 car, using wireless communications. How do we
7
1 go about finding this individual? How do we
2 collect the evidence and preserve it in a way
3 that will be useful at trial?
4 Fourth, law enforcement will be faced
5 with significant technical challenges, such as
6 the widespread use of encryption. In such
7 cases, we will have to find innovative and
8 effective ways to preserve government access to
9 the plain text of encrypted data. We can do
10 this, in part, by supporting international
11 efforts and national policies which promote the
12 development of the emerging key management
13 infrastructure and the use of products which
14 allow for data recovery, as well as by
15 assisting each other in this very difficult
16 area.
17 I think that these threats and these
18 problems call for the particular experience and
19 the expertise of this group. While important
20 work in the high-tech area is being done under
21 the auspices of other organizations, one thing
22 that sets the P-8 apart from other multilateral
8
1 groups is its common-sense focus on practical
2 solutions.
3 And the great thing about practical
4 solutions is that they usually produce real
5 results. Since computer crime is so important
6 to all of our interests, there are several
7 areas that I hope P-8 Experts will address.
8 First, we need adequate laws which will allow
9 us to prosecute hackers and other computer
10 criminals. Second, we need the technical
11 ability to find these individuals, wherever
12 located. Third, we must develop legal
13 procedures that permit timely cooperation in
14 the collection of evidence. And fourth, we
15 need to train law enforcement personnel and
16 devote these technically literate experts to
17 the task at hand.
18 When countries have inadequate legal
19 structures to combat computer crimes, they
20 provide safe havens for computer criminals, and
21 they can create a major obstacle to obtaining
22 international assistance in multijurisdictional
9
1 cases. As you know, in 1990, the Council of
2 Europe recommended that European nations adopt
3 harmonious computer crime laws. As a result,
4 several P-8 countries have enacted new laws and
5 joined international efforts to encourage other
6 countries to enact or to strengthen their
7 computer crime laws. However, much work
8 remains to be done in this area.
9 We need to reach a consensus as to
10 which computer and technology-related
11 activities should be criminalized, and then
12 commit to taking appropriate domestic actions.
13 This would also aid in providing the inevitable
14 legal assistance required to investigate and
15 prosecute these cases. I think it is also
16 important to think about a global legal support
17 regime, which could be used to avoid ad hoc
18 approaches to multiple prosecutions. The
19 unique nature of computer crimes and the
20 unusual problems that can result would make
21 such a regime very useful. Further, it would
22 provide practical solutions as countries
10
1 determine the best place for a prosecution, the
2 order of prosecutions in a case where multiple
3 countries are affected, and the most fair way
4 to vindicate interests when a crime affects a
5 large number of nations.
6 When a hacker attacks, the first
7 investigative step is to locate the source of
8 the attack. To do so requires tracing the
9 electronic trail from the victim back to the
10 attacker. However, in today's communications
11 environment, one telecommunications carrier
12 does not carry a communication from end to end.
13 As in the example I mentioned before, a
14 hacker's communication will pass through an
15 array of carriers, often in less than a second,
16 and tracing the electronic trail from victim
17 back to attacker may be difficult or impossible
18 unless the hacker is actually on-line.
19 One practical solution that our
20 technologically advanced countries should
21 pursue is maintaining access to source
22 information for each link in the chain of
11
1 transmission. Some countries, including the
2 United States, have required that technical
3 standards be adopted which ensure that "call
4 set-up information" for normal telephone calls
5 is accessible, so that the source of the call
6 can be identified. I think it would be
7 productive for P-8 Experts to consider whether
8 all carriers should carry this kind of
9 information, whether other communications
10 technologies should be similarly designed, and
11 what would be required for countries to share
12 this information with one another. This is a
13 critical time for this issue, as all of us are
14 upgrading our telecommunications systems,
15 because it is far easier to build such
16 requirements into new machines rather than to
17 retro-fit existing equipment.
18 Finding a criminal who plies his
19 craft through an array of carriers becomes much
20 more challenging when wireless communications
21 are used. In the past, when a perpetrator used
22 a phone to commit a crime, law enforcement
12
1 could easily find out the exact location that
2 the call came from. They could find out the
3 name of the person who was being billed for the
4 phone line, because the caller would be
5 physically attached to a telephone wire. But
6 today, mobile phones can allow an individual to
7 commit crimes while roaming around a city or
8 even a country.
9 Even identifying the owner of a
10 particular mobile phone may be difficult,
11 because mobile phones can be altered to
12 transmit phony identifying information. Here,
13 as in most of the areas we discuss, governments
14 would be well-served to work on this problem
15 with the help of industry. Our technical
16 experts tell us that there are practical
17 solutions to the problems created by wireless
18 communications, such as encouraging the
19 encryption of cellular electronic identifiers.
20 I hope that P-8 Experts will work to see that
21 law enforcement is not overtaken by technology
22 in this area, but instead uses technology to
13
1 thwart crime.
2 As the globalization of computer
3 networks continues, and as computer criminals
4 become more sophisticated, law enforcement
5 increasingly will need timely access to
6 computer or telecommunications information in
7 all our countries. Up until this point, our
8 regime of mutual legal assistance has served
9 our countries well. But in a hacker case, the
10 trail of evidence sometimes ends abruptly and
11 permanently as soon as the hacker goes
12 off-line. We should consider whether mutual
13 legal assistance treaties and letters rogatory
14 need to be supplemented with procedures that
15 will facilitate the immediate collection and
16 review of evidence, or whether other avenues
17 should be explored. As mechanisms are
18 developed, specially trained lawyers within
19 countries' Central Authorities may be necessary
20 to ensure rapid response to requests for
21 assistance, particularly while a hacker is
22 on-line. Again, the experience and the
14
1 expertise of the P-8 makes it well-suited to
2 tackle these very difficult problems.
3 Practical solutions are out there -- we must
4 work together to find them.
5 One idea I believe worthy of
6 consideration is formalizing international
7 expedited procedures that protect electronic
8 evidence on foreign soil from alteration or
9 destruction. These could be in the form of
10 "preservation of evidence requests," or
11 "protected seizures," whereby an international
12 request freezes a scene until a domestic
13 judicial search mechanism can be used. Just
14 like technological advances are the product of
15 creativity and ingenuity, our legal work in
16 this area must likewise be imaginative and
17 forward-leaning.
18 Also in the area of evidence
19 collection, I encourage this group to address
20 the issues involved in analyzing electronic
21 evidence -- evidence which can be easily
22 altered or destroyed. We must be able to
15
1 analyze this evidence in ways that preserve its
2 integrity and make its authenticity
3 irrefutable, both for purposes of domestic
4 prosecution and international cooperation. The
5 ease with which digital evidence can be
6 manipulated has already led to the development
7 of scientific protocols for searching computers
8 and for analyzing data. But we now must strive
9 to ensure that such procedures are
10 internationally accepted.
11 None of the advances I have discussed
12 are possible without ensuring that law
13 enforcement personnel are capable of addressing
14 high-tech crime by understanding two emerging
15 and converging technologies simultaneously:
16 Computers and telecommunications. The
17 complexity of these technologies, and their
18 constant and rapid change, suggest that
19 countries need to designate investigators and
20 prosecutors to receive appropriate and ongoing
21 training. They, in turn, need to work these
22 cases on a full-time basis, immersing
16
1 themselves in computer-related investigations
2 and prosecutions. Efforts along these lines
3 will dramatically expand enforcement
4 capabilities to solve high-tech crimes. I hope
5 that when you return home, each of you will
6 strongly advocate devoting significant
7 resources to this area, and that we can share
8 our expertise through international training
9 and coordination efforts.
10 The issues confronting us are very,
11 very difficult, but we can solve them. What
12 will make it all come together in a cohesive
13 way is law enforcement's continued willingness
14 to recognize the new challenges that lay ahead
15 in cyberspace. Whether the challenge is
16 protecting trade secret information, defending
17 intellectual property rights, prosecuting an
18 international hacker, if we do our job right,
19 the people of the world will enjoy the benefits
20 of the information age without becoming its
21 victims.
22 In closing, I pledge to you my full
17
1 support in this very critical area. I consider
2 high-tech crime to be one of the most serious
3 issues demanding my attention, and I am doing
4 everything in my power to ensure that the
5 United States actively responds to these
6 challenges. I have instructed Mark Richard to
7 keep me apprised of your work, and I would
8 enjoy the opportunity to contact my
9 counterparts in your countries, if and when the
10 need arises. In fact, this past November, I
11 discussed the threat of high-tech crime with
12 the British Home Secretary, Michael Howard, and
13 he enthusiastically pledged his support to P-8
14 efforts in this area. Likewise, our Deputy
15 Attorney General had a similar meeting with the
16 German State Secretary of the Interior,
17 Professor Doctor Kurt Schelter, in October of
18 last year. It's an old cliche, but united we
19 stand; divided we fall, and we look forward to
20 working with you in every way we can to address
21 this very important and very complex issue.
22 Thank you.