Barr, the first cabinet-level official to address the 10-year-old conference, began his talk by comparing stark advances in technology that have occurred since his previous tenure as attorney general from 1991 to 1993. He singled out encryption technology as particularly praiseworthy.
“Encryption provides enormous benefits to society by enabling secure communications, data storage and on-line transactions,” said Barr. “We can now better protect our personal information, more securely engage in e-commerce and internet communications, obtain secure software updates, and limit access to sensitive computers, devices, and networks.”
He pivoted quickly though. Like many FBI directors who have spoken at ICCS in the past, the attorney general focused on the frustration that law enforcement officials encounter when trying to gain time-sensitive information from encrypted devices.
“We welcome these improvements to privacy and security, and will work to preserve and strengthen them,” he said. “But at the same time, we must recognize that our citizens face an array of threats to their safety far broader than just cyber threats. Hackers are a danger, but so are violent criminals, terrorists, drug traffickers, human traffickers, fraudsters, and sexual predators—you name it.”
Barr pointed to one particular Mexican drug cartel as one of the looming threats the country faces.
“The cartel started using WhatsApp as their primary communication method, preventing U.S. law enforcement from conducting wiretaps that would enable us to locate fentanyl shipments and seize them at the border,” he said.
“We also found that the cartel had established a WhatsApp group chat for the specific purpose of coordinating the murders of Mexico-based police officials.”
The attorney general also laid out his legal reasoning for tech developers to provide access to encrypted messages.
“The Fourth Amendment strikes a balance between the individual citizen’s interest in conducting certain affairs in private, and the general public’s interest in subjecting possible criminal activity to investigation,” he said.
At the founding of the nation, an individuals’ “zone of privacy” was primarily considered one’s home. Technology changed the definition of this zone, he said. The introduction of the automobile created a new sphere of privacy. He noted that, like digital technology, the rise of the automobile facilitated economic growth and prosperity. But if the zone of privacy was extended to automobiles, it would be difficult for law enforcement to get a warrant before conducting a search. By the time police could have obtained a warrant the suspect would’ve driven away.
“[This] brings us back to today’s topic, data encryption,” he said. “With each of these earlier examples, our society has ensured that the traditional balance between individual privacy and public safety was maintained, as reflected in rulings from the Supreme Court.”
By creating a “warrant proof” environment, Barr argued that service providers, device manufacturers, and application developers are creating a space that may protect customers, but they are doing it in a way that “eviscerates society’s ability to defend itself against other types of criminal threats.”
If tech companies continue to resist efforts to work with law enforcement, he said, they run the risk that a drastic cyber-attack that might sway public opinion toward more law enforcement access to encrypted information. In the meantime, he advised that companies should be prepared to change and to bear the cost of that change.
“Some who resist lawful access complain it places an unreasonable burden on companies, who must spend time and resources on developing and implementing a compliance mechanism. To that, I first say, ‘Welcome to civil society,’” he said, later adding, “’If my business plan is to sell sawed-off shotguns,’ That’s tough. We as a community have a right to say, ‘No, we don’t care if that’s your business plan, the barrel has to be this long.’”
He said that like the automobile, the telephone, and more recently, cable companies, all technologically advanced companies must come to terms with unintended consequences associated with their products.
“In the tech sector, for example, we have seen a significant voluntary response to address the integrity of political elections in the United States following revelations about foreign interference,” he said.
He cited his own tenure as general counsel at ATT when the Communications Assistance for Law Enforcement Act imposed a “statutory duty on telecommunications carriers to maintain the capability to provide lawful access to communications over their facilities.” The same rules should apply to physical and digital media alike.
“I think it is absurd to think that we would preserve lawful access by mandating that physical telecommunications facilities be accessible to law enforcement for the purpose of obtaining content, while allowing tech providers to block law enforcement from obtaining that very content.”
He ended with by paraphrasing Microsoft’s Bill Gates’ saying that “there’s no question of ability; it’s the question of willingness” of the tech companies in “exploring solutions that will provide lawful access.”
“It is time for the United States to stop debating whether to address it and start talking about how to address it,” he said.
