FBI Director Wray says cyber-threats 'bigger than government'

News by Teri Robinson

Nation-state actors may not have brought the same chaos and disruption to bear during the 2018 midterms as Russian operatives did in the 2016 presidential election, but the US is still under a relentless onslaught of cyber-attacks.

Nation-state actors may not have brought the same chaos and disruption to bear during the 2018 midterms as Russian operatives did in the 2016 presidential election, but the US is still under a relentless onslaught of cyber-attacks and malign information efforts by foreign entities, FBI Director Christopher Wray said Tuesday.

"We’ve not seen in the latest midterm elections a material impact from Russia," Wray told an audience at the RSA 2019 Conference in San Francisco. "But what we have seen is this malign information campaign" designed to "pit us against each other [and] undermine democracy [and they’re] gearing up for it to happen in 2020."

Wray was unequivocal in his assessment of the dangers posed by cyber-threats . "Today’s cyber-threat is bigger than any one government agency — in fact it’s bigger than the government itself," he said. "The scope, breadth, depth, sophistication and diversity of the threat we face now is unlike anything we’ve had in our lifetimes."

While much of the attention in the last two years has focused on Russia’s efforts, other state actors like North Korea and particularly China are ramping up their cyber-activities with an uptick in "blended threats" those in which foreign governments join forces with cyber-criminals, Wray said, explaining that the "thing that most shocked him" when he took the helm at the bureau was "the depth, breadth and scale of Chinese espionage."

The FBI has numerous investigations open and issued indictments "four times in the fall" against Chinese nationals for cyber-espionage. Wray dismissed any notion that the FBI’s hot pursuit of China has anything to do with the ongoing tariff war. "It’s not about trade, politics or diplomacy, it’s about the rule of law," he said. "We’re going to follow the facts wherever they lead, to whomever they lead, no matter who doesn’t like it. I don’t really care what some foreign government has to say about it."

He defended the value of indictments against foreign nationals and organisations – while most will never see the inside of a US court, the public charges remove the cloak of anonymity that hackers depend on, compromising their effectiveness.

"One things hackers of all shapes and sizes prize is anonymity. By indicting them publicly we strip them of that. Have become persona non grata, they can't get work," Wray said.

Indictments can also lead to other charges and investigations and sometimes to arrests. "If they aven’t been able to resist the temptation to travel from whatever garden spot they’re in" to a country that has an extradition treaty with the US, then law enforcement can nab them.

Successfully mitigating and preventing cyber-threats rests on partnering with the private sector, the FBI director stressed, claiming some recent successes as the bureau and social media firms work in concert to track and shut down malign information campaigns. "We provide themn with information an they are able to police their own platforms," he said. "That’s a great example of government and the private sector working together."

Those relationships aren’t always so smooth, though, as the ongoing debate over encryption shows. Calling encryption "a provocative subject," Wray said the technology shouldn’t be allowed to provide a safe haven for criminals.

"Just as tech has become a force multiplier for good guys, it has become force a multiplier for bad guys," Wray said. There is "insurmountable impediment hiding with encrypted devices. It can’t be a sustainable end state for there to be an entirely unfettered space that’s utterly beyond law enforcement for criminals to hide."

While he cast himself as a "strong believer in encryption," Wray said the bureau is "duty bound to protect the American people."

Just three years ago, the FBI made that same argument when the FBI pressured Apple to unlock an iPhone used by the San Bernardino shooter. The court case against the iPhone maker was eventually dropped when the agency got a third party to crack the phone, but the debate still looms large with privacy and security advocates warning that pressing companies to provide access to encrypted data – perhaps through backdoors in their products – could dilute encryption’s protections.

"I get frustrated when people think we’re trying to weaken encryption," said Wray, explaining that his first instinct "not to go to war" with detractors. "We’re not. Just like people on other side are not trying to weaken security."

He also dismissed concerns that the morale at the FBI is at an all-time low after the bureau has been caught in the political fray over Special Counsel Robert Mueller’s investigation in the Russian interference in the 2016 election and the interactions between Russian entities and the Trump campaign.

"Rumors about our morale have been grievously overstated," said Wray, pointing to the bureau’s low attrition rate – 0.5 percent in 2018 – and the uptick in recruitment, which saw more applications since October than in the "whole preceding year."

Joking that the "grass is browner" on the FBI’s side of the fence, Wray pitched for the agency, saying, "We’re dealing with most sophisticated cyber-actors in the world.  if you want to take on that, the most formidable adversaries, you’d be in the right place."

This article was originally published on SC Media US.

Find this article useful?

Get more great articles like this in your inbox every lunchtime

Video and interviews

Interview - Everyone has an Achilles heel: The new security paradigm

How can we defend networks now that the perimeter has all but disappeared?
Brought to you in partnership with ExtraHop