“We are moving to a place where our devices are absolutely private,” he said.
Comey made the remarks on July 27 at the International Conference on Cyber Security sponsored by Fordham and the FBI.
He said that the nation’s founders had struck a bargain when it came to ensuring privacy, and that the agreement allowed the government to intervene “with the appropriate oversight” when there is probable cause of a threat, such as terrorism.
“Judges even have the ability to force us to say what’s in our heads,” he said. “They can force to testify to what we saw, what we heard, we witnessed.”
Currently, “huge swaths of American life are out of reach” to the FBI, and that this could lead to a “major event” that the bureau would be helpless in preventing, he said. Referencing the iPhone encryption dispute from earlier this year, in which the bureau attempted to have a court order for Apple to unlock a terrorist’s iPhone, Comey said the conversation got diverted.
“The case was entirely about that investigation but it became a rallying point of so much emotion,” he said.
Comey said that after this year’s presidential election, the country would have to grapple with the questions of encryption, privacy, and terrorism. He said that it was not the job of the FBI to decide what to do, but it’s a debate that will have to happen—and one that he doesn’t want to have after an attack.
“We will not be able to have this conversation if something terrible happens,” he said. “This is a hard conversation. It’s conflict of two values we all share. It does not fit in a tweet.”
In the meantime, he said, it’s the bureau’s duty to make sure the public understands the dangers of unlimited privacy. He said that he recognized the tech companies’ concerns for their customers, but if the FBI cannot do its job, then it is the Bureau’s responsibility to make sure the nation understands the danger.
“If the tools don’t work we need to shout from the rooftops the costs of absolute privacy,” he said.
The director also said that the FBI needs to be more “predictive and less reactive” to cyber attacks, but with the realization that it can’t prevent “all manner of cyber intrusion.” He said that the Bureau encourages healthy competition between its offices. Where the “physical manifestation” of a cyber attack occurs is not important, he said. The best-qualified office should address the crisis.
“If Little Rock has the chops, it will be worked there, if Pittsburgh has the chops, it’ll be worked in Pittsburgh,” he said.
He added that the competition for talent is fierce and the FBI can compete better with its mission than with money.
“We have to start to make sure the talent sees what we’re about,” he said.
He added that the requirement for agents on a cybersecurity team may have to adapted from the bureau’s current requirement that all agents be able “run, fight, and shoot,” as well maintain integrity and be highly intelligent. He said the average cybersecurity squad at the bureau consists of eight special agents, but in the future a mix of non-agent talent with agent talent might better serve the cause.
He told the audience they also need to do their part as private companies and be prepared before a breach happens. He encouraged them to form similar relationships with their local FBI office as they have with their local fire department to be prepared before a fire breaks out.
“You’ve made sure that the fire department doesn’t need to be figuring out how many floors you have, how many exits you have, or where your stand pipes are during a fire,” he said. “You haven’t shown them anything secret, but they’re able to operate in smoke and save lives.”
“It’s very, very smart for you to make sure we know who you are, and like your fire department, we have general sense of what help you might need in the event of a fire.”
