FBI director: Without compromise on encryption, legislation may be the ‘remedy’

FBI Director Christopher Wray said Wednesday that unless the U.S. government and private industry are able to come to a compromise on the issue of default encryption on consumer devices, legislation may be how the debate is ultimately decided.

“I think there should be [room for compromise],” Wray said Wednesday night at a national security conference in Aspen, Colorado. “I don’t want to characterize private conversations we’re having with people in the industry. We’re not there yet for sure. And if we can’t get there, there may be other remedies, like legislation, that would have to come to bear.”

Wray described the issue of “Going Dark” because of encryption as a “significant” and “growing” problem for federal, state and local law enforcement as well as foreign law enforcement and intelligence agencies. He claims strong encryption on mobile phones keeps law enforcement from gaining access to key evidence as it relates to active criminal investigations.

“People are less safe as a result of it,” he said.

The encryption debate became mainstream when in 2015, after a terrorist attack in San Bernardino, California, the FBI was unable to gain access to the shooter’s iPhone. At the time, former FBI Director James Comey attempted to convince Apple to write new software that would allow the U.S. government to break into the locked phone. Apple resisted and the fight gained the national spotlight. Then-candidate Donald Trump called for a boycott of Apple.

Comey made many of the same arguments as Wray, asserting that the government’s lack of access to locked iPhones put public safety in jeopardy.

The FBI had claimed investigators were locked out of nearly 8,000 devices in 2017. That number it turns out was enormously exaggerated due to an internal reporting error.

Apple CEO Tim Cook has for years been a vocal defender of strong encryption, positioning Apple as a privacy-first technology company in stark contrast to some of its competitors and detractors.

“Like many of you, we at Apple reject the idea that our customers should have to make tradeoffs between privacy and security,” Cook said in a 2015 speech in the capital. “We can, and we must provide both in equal measure. We believe that people have a fundamental right to privacy. The American people demand it, the constitution demands it, morality demands it.”

In an April 2018 interview on the topic, Cook said that “the only way to protect your data is to encrypt it. There is no other way known today. And so, if I were you, I would do business with no one that wasn’t doing that. Now, it is a thorny issue from a law enforcement point of view, because they may want to know what you’re saying, and I don’t have access to what you’re saying. And my view is kind of simple, is I don’t think that you as a user expect me to know what you’re telling people, right?”

Reflecting back on the high-profile legal battles over encryption in 2015 and 2016, Cook said Apple would continue to refuse and fight any attempt to compel them to create software that would force open a phone.

“If that same circumstance rose again, we would fight,” Cook said earlier this year. “Because this is a value of America, right? You should not be able to compel somebody to write something that is bad for civilization. Right? This is a fundamental wrong.”

An industry of cell phone hacking companies is more profitable than ever as a result of increased demand from governments around the world. Cellebrite and GrayShift are the two most well known mobile forensics companies in the world.

Apple recently introduced a new security feature popularly known as ‘USB Restricted Mode’ that restricts data access via USB devices, exactly the kind of tools mobile forensics companies use to break into iPhones. A workaround to Apple’s new feature was quickly found; a back and forth that highlights the ongoing arms race for protection and exploitation of mobile encryption security.

“But I really do believe that if people come at it with a goal that I think we all share of having both strong cybersecurity and protecting flesh-and-blood Americans — again, there’s a way to do this,” Wray said on Wednesday. “We’re a country that has unbelievable innovation. We put a man on thermion. We have autonomous vehicles. The number of things that are created every day in this country really defies imagination sometimes. And so the idea that we can’t solve this problem as a society — I just don’t buy it.”

In April, CyberScoop reported that the Senate Judiciary Committee was in the early stages of writing encryption legislation, having already spoken with multiple large American tech companies through their policy teams in D.C..