FBI Deputy Director David Bowdich’s Remarks at Press Conference on China-Related Cyber Indictments
FBI Deputy Director David Bowdich delivered the following remarks during a press conference in Washington, D.C. with Deputy Attorney General Jeffrey Rosen and other officials announcing charges against seven international cyber defendants, including APT 41 actors, in connection with computer intrusion campaigns against more than 100 victims globally. (Remarks as delivered)
Good morning. I’ve been up here all too often with my partners from the Department of Justice talking about hackers—in particular, Chinese hackers—and here we are again. We’re here today to tell these hackers and the Chinese government officials who turned a blind eye to their activities that their actions are once again unacceptable, and we will call them out publicly.
We’ve been fighting the cyber threat for years now, and all too often, it’s been a game of whack-a-mole. We investigate one hacker group, and we quickly uncover another hacker group. We disrupt one nation-state adversary targeting our infrastructure and our intellectual property, and very quickly we are often times exposing another side of that nation-state actor or another nation-state actor as well. Some days, it seems like a never-ending battle.
But cyber is one of our highest priorities. In fact, the FBI’s new enterprise strategy highlights how important it is to us. The FBI’s priority #2 is to protect the United States against foreign intelligence, espionage, and cyber operations. Our # 3 priority is to combat significant cyber criminal activity.
And we’ve been taking a closer look at what the FBI can bring to this fight. Our cyber strategy, in a nutshell, is designed to impose both risk and consequences on our adversaries. In plain English, we want to make it more difficult and more painful for hackers and criminals to do what they’re doing. And the best way for us to do that is by leveraging our unique authorities, our unique capabilities, and our enduring relationships—not just in the U.S., but throughout the world.
We want to build on the innovation that has helped the FBI and our partners adapt and evolve to meet the evolution of threats throughout the past century. We’ve got to change the cost-benefit analysis of criminals and nation-state actors who believe they can compromise United States networks, steal U.S. financial and intellectual property, and hold our critical infrastructure at risk—all without imposing risks to themselves.
Indictments are only one way in which we do that. But often, that’s all we can do—we indict the criminals, we come up here on stage, and we call them out publicly. But this time, as the deputy attorney general stated earlier, due in large part to the efforts of our folks here but also in large part to our Malaysian law enforcement counterparts, we have two people in custody. And we are seeking their extradition to bring them to the U.S. to face these charges.
The cyber threat is not a problem that any one agency can address by itself. So central to our strategy is the role the FBI plays as an indispensable partner to our federal counterparts, our foreign partners, and our private sector partners. We want to make sure we’re doing everything we can to help our partners do what they need to do. And the private sector, and the partnerships that have been developed over time cannot be overstated. They’re an incredibly important component in the cyber fight. That means using our role as the lead federal law enforcement agency with law enforcement and intelligence responsibilities to not only pursue their actions, but those of the adversaries overseas. To enable our partners to defend networks, to attribute malicious activities, to sanction bad behavior, and to take the fight to our adversaries overseas as much as we possibly can.
To that end, later today we will be distributing a FLASH message to our private sector partners and our foreign partners. The FLASH message essentially provides the expertise necessary and the technical expertise necessary for them to defend their own networks. We believe it will be helpful in not only detecting but mitigating APT 41’s malicious activities.
Before I wrap up, I want to remind you what I’ve said time almost every time we’ve been up here at the podium when it comes to an indictment of Chinese hackers. Our concern is not with the Chinese people. Our concern is not with the Chinese Americans. But specifically, our concern is with the Chinese Communist Party. Confronting this threat effectively does not mean we should not do business with the Chinese. It does not mean we should not host Chinese students. And it does not mean we should not welcome Chinese visitors, or co-exist with China on the world stage as a country. What it does mean is that when China violates our criminal laws and our international norms, we will call them out. We’re going to work together with our partners at home and abroad, in law enforcement and in the private sector, to stop brazen cyber crime and hold people accountable.
The cyber threat is daunting—but with the tailored approaches that we’ve put together in each situation to bring together the right talent and the patriotic people, their tools, and the authorities we’ve been provided at the right times, we have the ability to understand and combat the cyber threat.
So let me talk about those people. I want to quickly call out our special agents, our analysts, our computer scientists, and, quite frankly, the prosecutors that worked on this case—and work on these cases on a day-to-day basis. These cases are tedious, they are detailed, they require a significant level of expertise, and they require, more than anything, tenacity. And I want to thank them for their work for the American people.
To the hackers, I want to tell you: Whether you are in the U.S. or whether you are overseas, just because you have not yet seen an indictment does not mean that there is not a prosecutor working with a group of agents and supporting cast putting together an indictment for you as we speak.