Remarks as prepared for delivery
Good morning. Thank you, Tyler, for that very kind introduction.
It is a privilege for me to be here, among many of our nation’s leading policymakers and corporate executives. I want to share some thoughts with you. But I am reminded of a story about a young schoolboy who was assigned to describe Socrates. The boy wrote, “Socrates walked around giving people advice. So they poisoned him.” I hope to avoid the same fate. But at the risk of causing offense, I want to take this opportunity to speak to you about three issues: (1) the scope of the cybersecurity threat that confronts our nation; (2) the challenges we face in countering the threat; and (3) the ways that law enforcement can help, before, during, and after a cyber incident.
First, let me discuss the scope of the threat. The fact that so many of you who have such important responsibilities within your organizations are here, demonstrates how critical cybersecurity has become. Attempts to quantify just how big a problem we face vary widely, but everyone agrees that it is significant and growing. One estimate of the annual cost of global cybercrime predicts a doubling from $3 trillion in 2015 to $6 trillion in 2021, according to Cybersecurity Ventures .
This breach is similar to thousands of others where financially-motivated criminals targeted businesses. If you think it won’t happen to your company, you are probably wrong. A private report put the risk of suffering a material data breach at better than one in four — and the odds continue to rise.
Published reports reveal that one major web service provider suffered a breach that affected every one of its 3 billion web accounts. Mass data breaches can be extremely costly to victims. Private reports peg the average cost of a data breach at over $3.6 million. But of course that is an average. One large retailer reported spending $291 million for breach-related expenses, related to one attack on its network. In some cases, smaller businesses declare bankruptcy after a breach.
Even if your company does not hold large quantities of financial information, it almost certainly has valuable intellectual property in its computer systems. The Justice Department has indicted foreign cyber criminals who have broken into systems in the United States looking to steal ideas that make our nation strong and competitive in the global marketplace. The issue is so important that it has become the subject of agreements among the largest nations. The G20 leaders agreed in 2015 that no country should steal trade secrets or other confidential business information with the intent of advantaging its companies or commercial sectors. One of the cases we prosecuted involved the theft of technology that allegedly caused $800 million in losses. That is more than ten times the largest bank robbery.
Breaches that target financial data and intellectual property are serious concerns. But protecting American companies’ data is not the only thing we worry about. Cyber criminals know that many companies cannot do business without access to their networks. As a result, a new business model for cybercrime has emerged. Ransomware is now a global phenomenon.
The FBI estimates that ransomware infected more than 100,000 computers a day around the world. That number continues to grow. The total amount of ransom payments approaches $1 billion annually. Attacks used to be indiscriminate, scattershot attempts to squeeze a few hundred dollars from anyone who happened to be affected. Today, we see more sophisticated and targeted attacks that focus on particular businesses or sectors.
Even if you do everything right and your systems are impregnable you are not necessarily safe. Attackers have used Distributed Denial of Service attacks to go after everything from banks to critical Internet infrastructure. Moreover, the Internet of Things exponentially increases the number of devices connected to the networks we all rely on every day. These devices, too, can be used against us.
Computer disruptions do more than simply grind a business to a halt; they can endanger lives. Even MRI machines and ventilators may run software and be connected to networks.
Individual efforts, while unquestionably important, simply are not enough. Law enforcement is a necessary part of combatting cyber threats. Disrupting and deterring the next attack is far more effective than merely trying to avoid becoming the next victim.
That brings me to what the Department of Justice is doing about the cyber threat. Federal law enforcement focuses primarily on transnational, organized cyber criminals. We have had significant successes. Earlier this year, we dismantled the largest dark market, AlphaBay. It operated for more than two years and was used to sell a host of illicit items, including deadly illegal drugs; stolen and fraudulent identification documents; counterfeit goods; malware and other computer hacking tools; firearms; and even toxic chemicals. Also in 2017, we worked with foreign authorities to arrest the alleged creator of the Kelihos botnet. Over several years, that network was used to steal login credentials, distribute hundreds of millions of spam e-mails, and install ransomware and other malicious software across the globe. We dismantled that pernicious network of tens of thousands of infected computers.
Some of the criminals we pursue around the globe are acting at the behest, or for the benefit, of foreign governments. In March, we indicted four individuals, including two officers of the Russian state security service. They are charged with stealing information from at least 500 million e-mail accounts, conducting economic espionage, and engaging in other criminal offenses in connection with a years-long conspiracy to access a major web service provider's network and the contents of webmail accounts. And within the past few weeks, our government announced significant actions to deter and punish Iranians who used cyberspace to imperil our national security. Drawing on the Justice Department’s criminal investigation, the Treasury Department sanctioned seven hackers and their Revolutionary Guard-affiliated employers for attacking the global financial system. The Justice Department also unsealed charges against other Iranian nationals, accusing them of stealing software and selling it to Iranian military and government entities. Some of the software had military applications and was export-controlled.
So, 2017 has been a busy year for the Department of Justice in the fight against cybercrime. But those successes did not come easily. We face significant challenges.
For one thing, foreign governments use computer intrusions and attacks to advance their foreign policy goals, often at the expense of American companies and individuals. The federal government is not the only target of malicious, state-sponsored activity. And that activity has included damaging cyber attacks that cost millions of dollars to repair — not merely the theft of data. The targeting of private citizens and companies by foreign governments is especially disturbing.
Another disturbing trend that helps explain why data breaches keep occurring is the continued growth of dark markets that facilitate all manner of crime — from narcotics trafficking, to illegal firearms sales, identity theft, child exploitation and computer hacking. Even an unskilled hacker can purchase malware. Almost the entire supply chain for cybercrime can be outsourced, from the coding of malware, to the products that help malware evade security software, to the ultimate delivery of the malware. Dark markets continue to support the sale of data after it is stolen so that others can buy it to perpetrate fraud. Criminals then launder the ill-gotten gains through networks available on the same dark markets. We have to do more to stop dark markets if we want to disrupt the sophisticated underground economy that supports transnational organized cybercrime.
Dark markets are one of the worst examples of a broader problem we call “Going Dark.” Increasingly, technology frustrates traditional law enforcement efforts to collect evidence needed to protect public safety and solve crime. For example, many instant-messaging services now encrypt messages by default, thereby blocking the police from reading those messages — even if an impartial judge authorizes their interception. Or, to take another important example: for years, companies that make smartphones maintained the ability to access data stored on those phones, when ordered by a court to do so. But some of those companies made a conscious decision to engineer that critical capability away.
Encryption is valuable. It is a foundational element of data security and authentication. It is essential to the growth and flourishing of the digital economy. We in law enforcement have no desire to undermine encryption. But the advent of “warrant-proof” encryption is a serious problem. It threatens to destabilize the constitutional balance between privacy and security that has existed for over two centuries. Our society has never had a system where evidence of criminal wrongdoing was totally impervious to detection, even when officers obtain a court-authorized warrant. But that is the world that technology companies are creating. Those companies create jobs, design valuable products, and innovate in amazing ways. But, in a democratic society, the decision to reset the constitutional balance should involve review by citizens and their elected representatives. We should have a candid public debate about the pros and cons of allowing companies to create lock boxes that cannot be opened by police and judges.
You should think broadly about your companies’ interests in this area, not only in how to secure your data, but also whether the means of doing so can prevent you from seeing what is happening on your networks, and preclude law enforcement from effectively protecting you and your data. Security is not necessarily binary. Something need not be either absolutely secure or hopelessly insecure. We can have managed security that permits fair and effective enforcement of laws rather than absolute, black box security that conceals criminal activity.
Finally, let me turn to how law enforcement can help. Despite all of our tools and relationships and efforts, some companies are reluctant to report cyber incidents to law enforcement. When deciding whether to notify law enforcement about a cyber incident or whether to cooperate fully in an investigation, organizations weigh the anticipated benefits of a pro-active approach against legal, business, reputational, and other practical concerns. I know there are many considerations in making these decisions, but I want to emphasize how important it is to report cyber incidents as quickly as possible.
Law enforcement provides many benefits to victims of cyber intrusions and attacks. We can help you understand what happened; we can share context and information about related incidents or malware, thereby helping you shore up your defenses should the actors return; we can ensure proper investigation and preservation of evidence; we can inform regulators about cooperation, which the FTC and SEC view favorably; and we are uniquely situated to pursue the perpetrators, through criminal investigation and prosecution. In appropriate cases, we also can pursue economic sanctions, diplomatic pressure, and intelligence operations.
Let me address one myth in particular. It is not pointless to report cybercrime. Law enforcement has tools not available to the private sector to investigate crime, and we strive to work cooperatively with victim companies to ensure they are not further victimized during our investigation. We also maintain relationships throughout the world that can help us find perpetrators, and bring them to justice.
Even where we may be unable to arrest or prosecute the hackers, we leverage our criminal investigations by supporting the tools of other agencies, many of which can reach beyond our borders. When you are up against the military or intelligence services of a foreign nation-state, you should have the federal government in your corner.
Before I conclude, I want to offer a concrete recommendation that you can take back to your colleagues. Software and hardware vulnerabilities are one means by which your networks are compromised. Finding and eradicating those vulnerabilities is an important aspect of cybersecurity. All companies should consider promulgating a vulnerability disclosure policy, that is, a public invitation for white hat security researchers to report vulnerabilities found on your system. Many organizations find that the amount you can learn from “crowdsourcing” your search for vulnerabilities in a controlled way is well worth it. The Department of Defense runs such a program. It has been very successful in finding and solving problems before they turn into crises. Within the Department of Justice, our Criminal Division’s Cybersecurity Unit recently put out a paper to help companies think through creating such a program. It is available on our website. I encourage you to ask your team to look at that document and consider implementing its suggestions.
I want to thank you for your attention. I know that my job here is to talk, and your job is to listen. I need to finish my job before you finish yours!
Let me close by saying thank you very much for having me, and thank you for your commitment to improving our collective cyber security. We can maximize our security only if we continue to work together. You have my commitment that the Department of Justice will work with you to that end. I hope that we can count on each of you to do the same.