May 20, 2015

Director Discusses Encryption, Patriot Act Provisions

FBI Director James Comey discusses cyber threats with interviewer Benjamin Powell at the Cybersecurity Law Institute at Georgetown Law Center.

FBI Director James Comey discusses cyber threats with interviewer Benjamin Powell at the Cybersecurity Law Institute at Georgetown Law Center on May 20, 2015.

FBI Director James Comey spoke to legal professionals and scholars this week about cyber threats and the FBI’s abilities to counter and investigate those evolving threats.

In remarks at the American Law Institute on Tuesday and at a cyber security summit on Wednesday at Georgetown University Law Center, Comey said the group calling itself the Islamic State, or ISIL, represents the FBI’s most urgent threat. He described the organization’s use of social media to motivate troubled people in the United States to engage in acts of violence—either by traveling to the so-called caliphate or killing where they are. Comey said ISIL reaches out to individuals on Twitter and elsewhere, then moves their more sensitive communications to encrypted platforms.

“The threat we face has morphed,” Comey said on Wednesday. “It’s a chaotic spider web through social media—increasingly invisible to us because the operational communications are happening in an encrypted channel.”

Comey later elaborated on the issue of encryption, which is a process of encoding messages—on mobile phones for example—that only authorized parties can access. While it can be effective at thwarting digital thieves, strong encryption also limits the amount of information—or evidence—that law enforcement can effectively gather from a device.

“Increasingly we’re finding ourselves unable to read what we find, or unable to open a device,” Comey said, “and that is a serious concern.”

The issue of “going dark,” as the Bureau calls it, is worthy of a larger public conversation about the balance between privacy and public safety, Comey said. Momentum toward universal encryption, he explained, may have unintended consequences.

“As all of our lives become digital, the logic of encryption is all of our lives will be covered by strong encryption, and therefore all of our lives—including the lives of criminals and terrorists and spies—will be in a place that is utterly unavailable to court-ordered process,” he said. “And that, I think, to a democracy should be very, very concerning.”

The Director also pointed to provisions of the Patriot Act of 2001 that, if allowed to expire on June 1, could hobble the FBI’s investigative abilities. One of the provisions is Section 215, which authorized the National Security Agency’s database of telephony records and metadata.

Comey said the FBI relies on that provision fewer than 200 times a year—in particular cases to get particular records. “If we lose that authority,” Comey said, “we can’t get information that I think everybody wants us to attain.”

Two other provisions include:

  • Roving wiretaps. The FBI has had authority since the 1980s to use legally authorized roving wiretaps in criminal cases—allowing authorities to follow surveillance targets rather than their phones, which can be easily trashed and replaced. The Patriot Act extended that authority to terrorism and counterintelligence cases.
  • The Lone Wolf provision. In 2004, Congress amended the Foreign Intelligence Surveillance Act to authorize intelligence gathering on individuals not affiliated with any known terrorist organization.

“These three are going to go away June 1,” Comey said, “and I don’t want them to get lost in the conversation about metadata.”