Breaking: Justice Department unveils strategy to fight election meddling, cybercrime: subscriber.politicopro.com/cybersecurity/…
Deputy AG Rod Rosenstein is announcing this right now at Aspen:
Deputy AG Rod Rosenstein is announcing this right now at Aspen:
The report justice.gov/cyberreport mostly summarizes existing information about how various parts of DOJ work together to fight cybercrime, but there are a few noteworthy bits...
The report starts with a long section on foreign influence operations. DOJ unveils a policy for when and how it will notify targets, tech companies, Congress, and the public about foreign meddling.
Noteworthy: Foreign meddling “may violate a number of federal laws on which the Department may base criminal investigations and prosecutions,” report says, but DOJ is “also considering whether new criminal statutes aimed more directly at this type of activity are needed.”
Also interesting: DOJ notes that CFAA, the major computer crime law, only covers hacking of internet-connected devices. DOJ says that this means prosecutors can't use CFAA to prosecute hacks of [offline] electronic voting machines.
In addition to foreign meddling, this report summarizes more prosaic types of cybercrime, like DDoS, ransomware, botnets; describes how the govt responds (prosecutions, info sharing, surveillance); and explains how DOJ components (e.g. FBI) train and retain cyber experts.
There is also a section about challenges facing cybercrime investigations and how DOJ should respond.
Not surprisingly, the "going dark" challenge (access to digital evidence) gets the most attention. This is where DOJ complains about unbreakable encryption.
Not surprisingly, the "going dark" challenge (access to digital evidence) gets the most attention. This is where DOJ complains about unbreakable encryption.
DOJ lays out seven ways that it plans to respond to the encryption challenge, including “considering whether legislation to address encryption (and all related service provider access) challenges should be pursued.”
DOJ also says investigators can't rely on tools like Graykey and Cellebrite to unlock encrypted devices, because it's too expensive and it "may not be a scalable solution."
Something funny about this report is that in some cases it just copies and pastes from DOJ websites. For example, the beginning of the INTERPOL section is taken from here: justice.gov/interpol-washi… 
Back to DAG Rosenstein at Aspen, who just subtweeted a big chunk of his boss's party: "Intelligence assessments and criminal indictments are based on evidence. They do not reflect mere guesses."
Rosenstein cites 1910 Theodore Roosevelt speech that included the line "It is not the critic who counts." Rosenstein, under fire from the far right, says this line is "important to keep in mind" when you're in D.C.
Rosenstein: "Trump Administration agency appointees and White House officials work with career professionals every day to prevent cybercrime and protect elections."
Rosenstein has wrapped up his remarks.
