17 October 2014
FBI Director Going Dark
James B. Comey
Federal Bureau of Investigation
October 16, 2014
Remarks as delivered.
Good morning. Its an honor to be here.
I have been on the job as FBI Director for one year and one month. I like
to express my tenure in terms of months, and I joke that I have eight years
and 11 months to go, as if Im incarcerated. But the truth is, I love
this job, and I wake up every day excited to be part of the FBI.
Over the past year, I have confirmed what I long believedthat the FBI
is filled with amazing people, doing an amazing array of things around the
world, and doing them well. I have also confirmed what I have long known:
that a commitment to the rule of law and civil liberties is at the core of
the FBI. It is the organizations spine.
But we confront serious threatsthreats that are changing every day.
So I want to make sure I have every lawful tool available to keep you safe
from those threats.
An Opportunity to Begin a National Conversation
I wanted to meet with you to talk in a serious way about the impact of emerging
technology on public safety. And within that context, I think its important
to talk about the work we do in the FBI, and what we need to do the job you
have entrusted us to do.
There are a lot of misconceptions in the public eye about what we in the
government collect and the capabilities we have for collecting information.
My job is to explain and clarify where I can with regard to the work of the
FBI. But at the same time, I want to get a better handle on your thoughts,
because those of us in law enforcement cant do what we need to do without
your trust and your support. We have no monopoly on wisdom.
My goal today isnt to tell people what to do. My goal is to urge our
fellow citizens to participate in a conversation as a country about where
we are, and where we want to be, with respect to the authority of law
The Challenge of Going Dark
Technology has forever changed the world we live in. Were online, in
one way or another, all day long. Our phones and computers have become
reflections of our personalities, our interests, and our identities. They
hold much that is important to us.
And with that comes a desire to protect our privacy and our datayou
want to share your lives with the people you choose. I sure do. But the FBI
has a sworn duty to keep every American safe from crime and terrorism, and
technology has become the tool of choice for some very dangerous people.
Unfortunately, the law hasnt kept pace with technology, and this disconnect
has created a significant public safety problem. We call it Going
Dark, and what it means is this: Those charged with protecting our
people arent always able to access the evidence we need to prosecute
crime and prevent terrorism even with lawful authority. We have the legal
authority to intercept and access communications and information pursuant
to court order, but we often lack the technical ability to do so.
We face two overlapping challenges. The first concerns real-time court-ordered
interception of what we call data in motion, such as phone calls,
e-mail, and live chat sessions. The second challenge concerns court-ordered
access to data stored on our devices, such as e-mail, text messages, photos,
and videosor what we call data at rest. And both real-time
communication and stored data are increasingly encrypted.
Lets talk about court-ordered interception first, and then well
talk about challenges posed by different means of encryption.
In the past, conducting electronic surveillance was more straightforward.
We identified a target phone being used by a bad guy, with a single carrier.
We obtained a court order for a wiretap, and, under the supervision of a
judge, we collected the evidence we needed for prosecution.
Today, there are countless providers, countless networks, and countless means
of communicating. We have laptops, smartphones, and tablets. We take them
to work and to school, from the soccer field to Starbucks, over many networks,
using any number of apps. And so do those conspiring to harm us. They use
the same devices, the same networks, and the same apps to make plans, to
target victims, and to cover up what theyre doing. And that makes it
tough for us to keep up.
If a suspected criminal is in his car, and he switches from cellular coverage
to Wi-Fi, we may be out of luck. If he switches from one app to another,
or from cellular voice service to a voice or messaging app, we may lose him.
We may not have the capability to quickly switch lawful surveillance between
devices, methods, and networks. The bad guys know this; theyre taking
advantage of it every day.
In the wake of the Snowden disclosures, the prevailing view is that the
government is sweeping up all of our communications. That is not true. And
unfortunately, the idea that the government has access to all communications
at all times has extendedunfairlyto the investigations of law
enforcement agencies that obtain individual warrants, approved by judges,
to intercept the communications of suspected criminals.
Some believe that the FBI has these phenomenal capabilities to access any
information at any timethat we can get what we want, when we want it,
by flipping some sort of switch. It may be true in the movies or on TV. It
is simply not the case in real life.
It frustrates me, because I want people to understand that law enforcement
needs to be able to access communications and information to bring people
to justice. We do so pursuant to the rule of law, with clear guidance and
strict oversight. But even with lawful authority, we may not be able to access
the evidence and the information we need.
Current law governing the interception of communications requires
telecommunication carriers and broadband providers to build interception
capabilities into their networks for court-ordered surveillance. But that
law, the Communications Assistance for Law Enforcement Act, or CALEA, was
enacted 20 years agoa lifetime in the Internet age. And it doesnt
cover new means of communication. Thousands of companies provide some form
of communication service, and most are not required by statute to provide
lawful intercept capabilities to law enforcement.
What this means is that an order from a judge to monitor a suspects
communication may amount to nothing more than a piece of paper. Some companies
fail to comply with the court order. Some cant comply, because they
have not developed interception capabilities. Other providers want to provide
assistance, but they have to build interception capabilities, and that takes
time and money.
The issue is whether companies not currently subject to the Communications
Assistance for Law Enforcement Act should be required to build lawful intercept
capabilities for law enforcement. We arent seeking to expand our authority
to intercept communications. We are struggling to keep up with changing
technology and to maintain our ability to actually collect the communications
we are authorized to intercept.
And if the challenges of real-time interception threaten to leave us in the
dark, encryption threatens to lead all of us to a very dark place.
Encryption is nothing new. But the challenge to law enforcement and national
security officials is markedly worse, with recent default encryption settings
and encrypted devices and networksall designed to increase security
With Apples new operating system, the information stored on many iPhones
and other Apple devices will be encrypted by default. Shortly after Apples
announcement, Google announced plans to follow suit with its Android operating
system. This means the companies themselves wont be able to unlock
phones, laptops, and tablets to reveal photos, documents, e-mail, and recordings
Both companies are run by good people, responding to what they perceive is
a market demand. But the place they are leading us is one we shouldnt
go to without careful thought and debate as a country.
At the outset, Apple says something that is reasonablethat its
not that big a deal. Apple argues, for example, that its users can back-up
and store much of their data in the cloud and that the FBI can
still access that data with lawful authority. But uploading to the cloud
doesnt include all of the stored data on a bad guys phone, which
has the potential to create a black hole for law enforcement.
And if the bad guys dont back up their phones routinely, or if they
opt out of uploading to the cloud, the data will only be found on the encrypted
devices themselves. And it is people most worried about whats on the
phone who will be most likely to avoid the cloud and to make sure that law
enforcement cannot access incriminating data.
Encryption isnt just a technical feature; its a marketing pitch.
But it will have very serious consequences for law enforcement and national
security agencies at all levels. Sophisticated criminals will come to count
on these means of evading detection. Its the equivalent of a closet
that cant be opened. A safe that cant be cracked. And my question
is, at what cost?
Some argue that we will still have access to metadata, which includes telephone
records and location information from telecommunications carriers. That is
true. But metadata doesnt provide the content of any communication.
Its incomplete information, and even this is difficult to access when
time is of the essence. I wish we had time in our work, especially when lives
are on the line. We usually dont.
There is a misconception that building a lawful intercept solution into a
system requires a so-called back door, one that foreign adversaries
and hackers may try to exploit.
But that isnt true. We arent seeking a back-door approach. We
want to use the front door, with clarity and transparency, and with clear
guidance provided by law. We are completely comfortable with court orders
and legal processfront doors that provide the evidence and information
we need to investigate crime and prevent terrorist attacks.
Cyber adversaries will exploit any vulnerability they find. But it makes
more sense to address any security risks by developing intercept solutions
during the design phase, rather than resorting to a patchwork solution when
law enforcement comes knocking after the fact. And with sophisticated encryption,
there might be no solution, leaving the government at a dead endall
in the name of privacy and network security.
Another misperception is that we can somehow guess the password or break
into the phone with a so-called brute force attack. Even a
supercomputer would have difficulty with todays high-level encryption,
and some devices have a setting whereby the encryption key is erased if someone
makes too many attempts to break the password, meaning no one can access
Finally, a reasonable person might also ask, Cant you just compel
the owner of the phone to produce the password? Likely, no. And even
if we could compel them as a legal matter, if we had a child predator in
custody, and he could choose to sit quietly through a 30-day contempt sentence
for refusing to comply with a court order to produce his password, or he
could risk a 30-year sentence for production and distribution of child
pornography, which do you think he would choose?
Think about life without your smartphone, without Internet access, without
texting or e-mail or the apps you use every day. Im guessing most of
you would feel rather lost and left behind. Kids call this FOMO, or fear
of missing out.
With Going Dark, those of us in law enforcement and public safety have a
major fear of missing outmissing out on predators who exploit the most
vulnerable among us...missing out on violent criminals who target our
communities...missing out on a terrorist cell using social media to recruit,
plan, and execute an attack.
Criminals and terrorists would like nothing more than for us to miss out.
And the more we as a society rely on these devices, the more important they
are to law enforcement and public safety officials. We have seen case after
casefrom homicides and car crashes to drug trafficking, domestic abuse,
and child exploitationwhere critical evidence came from smartphones,
hard drives, and online communication.
Lets just talk about cases involving the content of phones.
In Louisiana, a known sex offender posed as a teenage girl to entice a
12-year-old boy to sneak out of his house to meet the supposed young girl.
This predator, posing as a taxi driver, murdered the young boy and tried
to alter and delete evidence on both his and the victims cell phones
to cover up his crime. Both phones were instrumental in showing that the
suspect enticed this child into his taxi. He was sentenced to death in April
of this year.
In Los Angeles, police investigated the death of a 2-year-old girl from blunt
force trauma to her head. There were no witnesses. Text messages stored on
her parents cell phones to one another and to their family members
proved the mother caused this young girls death and that the father
knew what was happening and failed to stop it. Text messages stored on these
devices also proved that the defendants failed to seek medical attention
for hours while their daughter convulsed in her crib. They even went so far
as to paint her tiny body with blue paintto cover her bruisesbefore
calling 911. Confronted with this evidence, both parents pled guilty.
In Kansas City, the DEA investigated a drug trafficking organization tied
to heroin distribution, homicides, and robberies. The DEA obtained search
warrants for several phones used by the group. Text messages found on the
phones outlined the groups distribution chain and tied the group to
a supply of lethal heroin that had caused 12 overdosesand five
deathsincluding several high school students.
In Sacramento, a young couple and their four dogs were walking down the street
at night when a car ran a red light and struck themkilling their four
dogs, severing the young mans leg, and leaving the young woman in critical
condition. The driver left the scene, and the young man died days later.
Using red light cameras near the scene of the accident, the
California Highway Patrol identified and arrested a suspect and seized his
smartphone. GPS data on his phone placed the suspect at the scene of the
accident and revealed that he had fled California shortly thereafter. He
was convicted of second-degree murder and is serving a sentence of 25 years
The evidence we find also helps exonerate innocent people. In Kansas, data
from a cell phone was used to prove the innocence of several teens accused
of rape. Without access to this phone, or the ability to recover a deleted
video, several innocent young men could have been wrongly convicted.
These are cases in which we had access to the evidence we needed. But were
seeing more and more cases where we believe significant evidence is on that
phone or a laptop, but we cant crack the password. If this becomes
the norm, I would suggest to you that homicide cases could be stalled, suspects
could walk free, and child exploitation might not be discovered or prosecuted.
Justice may be denied, because of a locked phone or an encrypted hard drive.
Im deeply concerned about this, as both a law enforcement officer and
a citizen. I understand some of this thinking in a post-Snowden world, but
I believe it is mostly based on a failure to understand why we in law enforcement
do what we do and how we do it.
I hope you know that Im a huge believer in the rule of law. But I also
believe that no one in this country should be above or beyond the law. There
should be no law-free zone in this country. I like and believe very much
that we need to follow the letter of the law to examine the contents of
someones closet or someones cell phone. But the notion that the
marketplace could create something that would prevent that closet from ever
being opened, even with a properly obtained court order, makes no sense to
I think its time to ask: Where are we, as a society? Are we no longer
a country governed by the rule of law, where no one is above or beyond that
law? Are we so mistrustful of governmentand of law enforcementthat
we are willing to let bad guys walk away...willing to leave victims in search
There will come a dayand it comes every day in this businesswhere
it will matter a great deal to innocent people that we in law enforcement
cant access certain types of data or information, even with legal
authorization. We have to have these discussions now.
I believe people should be skeptical of government power. I am. This country
was founded by people who were worried about government powerwho knew
that you cannot trust people in power. So they divided government power among
three branches, with checks and balances for each. And they wrote a Bill
of Rights to ensure that the papers and effects of the people
are secure from unreasonable searches.
But the way I see it, the means by which we conduct surveillance through
telecommunication carriers and those Internet service providers who have
developed lawful intercept solutions is an example of government operating
in the way the founders intendedthat is, the executive, the legislative,
and the judicial branches proposing, enacting, executing, and overseeing
legislation, pursuant to the rule of law.
Perhaps its time to suggest that the post-Snowden pendulum has swung
too far in one directionin a direction of fear and mistrust. It is
time to have open and honest debates about liberty and security.
Some have suggested there is a conflict between liberty and security. I disagree.
At our best, we in law enforcement, national security, and public safety
are looking for security that enhances liberty. When a city posts police
officers at a dangerous playground, security has promoted libertythe
freedom to let a child play without fear.
The people of the FBI are sworn to protect both security and liberty. It
isnt a question of conflict. We must care deeply about protecting liberty
through due process of law, while also safeguarding the citizens we
servein every investigation.
Where Do We Go from Here?
These are tough issues. And finding the space and time in our busy lives
to understand these issues is hard. Intelligent people can and do disagree,
and thats the beauty of American lifethat smart people can come
to the right answer.
Ive never been someone who is a scaremonger. But Im in a dangerous
business. So I want to ensure that when we discuss limiting the court-authorized
law enforcement tools we use to investigate suspected criminals that we
understand what society gains and what we all stand to lose.
We in the FBI will continue to throw every lawful tool we have at this problem,
but its costly. Its inefficient. And it takes time.
We need to fix this problem. It is long past time.
We need assistance and cooperation from companies to comply with lawful court
orders, so that criminals around the world cannot seek safe haven for lawless
conduct. We need to find common ground. We care about the same things. I
said it because I meant it. These companies are run by good people. And we
know an adversarial posture wont take any of us very far down the road.
We understand the private sectors need to remain competitive in the
global marketplace. And it isnt our intent to stifle innovation or
undermine U.S. companies. But we have to find a way to help these companies
understand what we need, why we need it, and how they can help, while still
protecting privacy rights and providing network security and innovation.
We need our private sector partners to take a step back, to pause, and to
consider changing course.
We also need a regulatory or legislative fix to create a level playing field,
so that all communication service providers are held to the same standard
and so that those of us in law enforcement, national security, and public
safety can continue to do the job you have entrusted us to do, in the way
you would want us to.
Perhaps most importantly, we need to make sure the American public understands
the work we do and the means by which we do it.
I really do believe we can get there, with a reasoned and practical approach.
And we have to get there together. I dont have the perfect solution.
But I think its important to start the discussion. Im happy to
work with Congress, with our partners in the private sector, with my law
enforcement and national security counterparts, and with the people we serve,
to find the right answerto find the balance we need.
Thank you for having me here today.