Files in an attempt to influence the election. I am pleased to have john carlin at the table. Mr. Carlin thanks, charlie. Charlie why are you leaving . Like alin it seemed natural break point. It has been nearly 20 years with the justice department. I had there. Charlie tremendously influenced by 9 11 . Mr. Carlin i am a new yorker, my family was in new york that day. I remember my father was underneath the World Trade Center in the subway on his way downtown. My brotherinlaw was right across the street, looking out. Charlie he saw people jumping out . Mr. Carlin he did. He got called up as one of the people helping to clean up the site afterwards, and i remember the feeling, as many do come out of wondering if your family members are safe and trying to call frantically to reach them. We were lucky that day. Many others were not. Charlie have we learned the lesson . Mr. Carlin i think we have learned important lessons from that day, what it which is to forget not what never forget what happened. Was created i lead as post9 11 reform because of a failure to share information. Charlie from cia to fbi to nsa and others . Mr. Carlin we werent structured that way at the time. There were legal and cultural barriers. We now have the prosecutors sitting next to the intelligence lawyers, and it caused a change in mindset. Success is no longer going to be measured by the successful prosecution of a terrorist afterthefact. When families have lost loved ones. Iscession is success measured by preventing the attack. You have to know what they know, and be creative, look across the full set of legal tools so you are not wedded, if you were a prosecutor, to just doing prosecutions. Lets think about everything we can do to keep terrorists from accomplishing their goal of killing people. Charlie what would be in the toolbox . Mr. Carlin it could be a criminal prosecution, it could be diplomacy, could be a military strike or the use of Treasury Department sanctions to from gettingoups the finances they need. It could be using the Commerce Department to say, this company is doing this business with terrorists. Have to be as nimble as the threat is and keep looking across the toolkit. Charlie who had the job before you . Mr. Carlin lisa monaco. She is now the president s homeland terrorism advisor. Formerly beenad chief of staff for robert mueller, fbi director. Mr. Carlin it was amazing. No one i have worked with is like him in terms of being dedicated to the task at hand. It gives makes him uniquely qualified. Charlie how did we determine the russians were behind the hack of the dnc, and perhaps john podesta as well . Mr. Carlin thinking about this case, i go back to my First Encounter with the obama administration, when i was at the fbi working with the director. We briefed both campaigns. We briefed the Mccain Campaign and the Obama Campaign, and the Obama Campaign sent dennis mcdonough, who became his chief of staff, and a guy who became the ambassador to south korea. We told both campaigns, you have been breached i china. Your emails have been compromised. We did so at the time and it was declassified later. I think how far we have come since then and the threat has changed. Charlie they didnt know they had been breached. Mr. Carlin we knew, and we went to tell them. Charlie how did you know . Mr. Carlin using sensitive sources and methods to collect the information. We couldnt tell them at the time how we knew, but we could tell them they had been breached and defensive steps they could take. At the time, we had known for a in particularna was committing economic espionage, and we were not saying that publicly. Indidnt use the word china relation to the threat. That came later. It was treated as an intelligence problem, a secret issue. As it has for years when it came to spy versus spy. Was, i wase, china at the fbi, and i saw was on the intel side of the house. I had to do this as a prosecutor on the criminal side. That is plenty to do on side. I worked with a squad of agents, and occasionally, one of the agents would switch over to the intel side and the intel side ,as literally behind a locked secured door. Agent would disappear behind the door and i would never see him again. It wasnt like i was banging on the door to get in, because there was plenty to do on the criminal side. When i came to the fbi, i opened the door and saw what was on the intelligence side of the house. It was amazing. Atworked on Getting Better collecting intelligence, and we created a system where you could watch and a jumbotron screen into a actors hack university, hopped from the university into a company, then you would watch the data x filtrate out of the United States. We were seeing intelligence, but we were losing billions of dollars in intellectual property, trade secrets. How have weear, changed since 9 11 . We were not applying some of the changes we applied against the terrorists threat when it came to cyber. When i went to the department of justice, we still hadnt opened the door. We werent sharing the intelligence with Law Enforcement, with victims to see how we could disrupt. To take a massive transformation in the justice departments approach to National Security, cyber threats. Charlie that is how we know the russians were hacking the dnc and john podesta . Mr. Carlin that is what led to , an approach where hundreds of prosecutors across the country were retrained and started working day in, day out, with the fbi agents and there were four major threat actors we were up against. Russia, china, north korea, iran. This is what the fbi said. Once we started the new approach, the first one we used that we went after to do and investigation attribution and see what we could make public was china. That was a case that led to the first indictments of their kind in 2014, year after we did the transformation. We indicted five members of the Peoples Liberation army. They were not doing traditional spy craft. What they were doing is, they were going into nuclear, solar, steel, going inside the company and stealing things like, one company was about to do a joint venture with a Chinese Company a bigger going to lease a pipe. Right before the least the pipe, we watched members of the Peoples Liberation army go into their systems and steal the design specifications for the pipe, or with solar, we watched them go in and they stole the pricing information from the Solar Company so they could price. Thehey could price dump. Uniformed members of the pla stole their litigation strategy when they sued. Lets talk about that. In fact, what happened is that the United States came, basically said to china, you have to stop helping private companies have an advantage with respect to american companies. The chinese have agreed to do that . Mr. Carlin thats right. The only reason is because we did a new approach that said number one, we can figure out who did it, so you think it is anonymous, you are wrong. Number two, we made it public. In this case, in the form of an indictment. We showed we can impose consequences, we can figure out by name and face. The consequences in this case came in the form of a criminal indictment that led to an amazing experience where, right before president obama was going to meet with the chinese president , they believed we were about to use a new executive order on sanctions. We got a call that the personal emissary of the president wanted to come to the United States, and he came with a crew of 35 people, and we hammered out over 45 days of negotiations, a socalled fivepoint agreement, one of which was for the first time, the chinese president said, it is wrong to use your military intelligence for this purpose. Is some aspect, i was trying to get an interview with the chinese president at the time, there was a threat that maybe you wouldnt come if we couldnt work something out. If there would be sanctions imposed. Cant tell you what fully motivated them to come and ve this president setting new agreement, but they clearly were very concerned, and otherwise they wouldnt have sent over a highlevel delegation and made the agreement. Because of the agreement, you saw the g20 adopted as the new norm. The most recent or the earlier g20 . Mr. Carlin the earlier g20. It was not in china that year. This year, it was. Yberspace is the wild west if we will bring law to this new frontier, it will take agreements like that. That is one of the reasons we brought the case. Charlie when we say the russians are behind this, the u. S. Government is pretty clear and pretty sure . That that is the fact . Mr. Carlin they wouldnt say it unless we are highly, highly confident that it is so. That is the investigation attribute. Rlie should we inspect and an indictment of russian individuals . Mr. Carlin that is the part of the tools approach. It is important to figure out who did it, and number two, to make it public. You have seen us do that here and say, it is the russians. If you are going to be able to deter, you have to make sure the world knows we can figure out who did it. Third, to be public about the fact that there will be consequences. What the consequences are have buried depending on the threat have buried depending on the threat. It will be at the time and place of our choosing. You may be seeing different things. To talk about what happened, it was a surprise case with the north korean hack into sony. You will see an example of that approach. Charlie we were sure that the North Koreans did it, they hacked into sony . Mr. Carlin exactly. It was an amazing feat of intelligence and Law Enforcement. In less than 28 days, we reached a high level of confidence. That is because sony did the right thing and within 24 hours, had a team of the ei on site and were working very closely fbi on site and were working very closely. We were trying in new approach. We got a call a National Security. I have been doing this for a while. It would lookat like if a rogue nucleararmed donation attacked the United States through cyber means. We never figured it would be a the interview about a bunch of pot smokers. Mr. Carlin you had to brief charlie you had to brief the president about the movie . Mr. Carlin it is not easy to do, if you have seen the movie. Charlie levick affected go back to this. With respect to the russians, you know about the motivation of the North Koreans. They were unhappy about a movie that they thought had smeared their leader. What is the motivation of the russians . Mr. Carlin the china case was to make money. They wanted to steal trade secrets. Charlie their companies are in competition with american companies. Mr. Carlin exactly. They thought it would be cheaper to steal their research and development. With sony, they wanted to, in their society, you dont have political free expression. They didnt like what somebody said, so they wanted to prevent them from being able to say it by intimidating people out of saying what they think. It was an attack on our fundamental values. A third case, the third actor is iran, their attack on our Financial Institutions, which you can guess the motive, irani and actives actors wanted to hack an American Institution for a political purpose. The russians, what we are seeing is, they want to undermine confidence in our public election. That would be consistent with what we have seen them try to do in germany, in other parts of the world. Charlie how does the strategy work for them . Is, canin one question it work if you call it out . Once people know they are trying to do it, it becomes harder for them to secretly try to influence an election or cause uncertainty. This is a country who, under its current leadership, is antidemocratic, fundamentally opposed to the idea of democracy. That is why it is important, if you try to undermine the election, that we publicly confronted and impose consequences. Charlie john podesta, whose werels work hacked hacked and released by wikileaks, what is the connection between russias hackers and wikileaks . Mr. Carlin i will not address the specific outside the statement the director of National Intelligence and Homeland Security put out. But i think what we do in terms of looking at the frame is, there will be a lot of mischievous that actors, ranging from those who want to undermine confidence in an election to terrorist groups who attack private companies to steal names to create kill lists, which is an actual case. Important foris those in private industry, here is a case that looks like it is a routine criminal hack. Companies everyday have intruders go into their system and it looks very unsophisticated. They steal names and addresses to make a buck. In this case, they stole a relatively small amount, and the vast majority of companies wouldnt reported to anybody. In this case, they reported it and the guy steals the names, then bribes and tries to blackmail the company and says give me 500 through bitcoin or i will embarrass you by releasing the names. The vast majority of Companies Either would pay the 500 or decide to set handle it on their own. But they should report it. Because they reported it and we worked together, it turns out on the back and it is not the lowlevel criminal that it looks like. Instead of a crook, it is a kosovo extremist who has moved to malaysia and in conspiracy with other folks of in kosovo, he is responsible with hacking the u. S. Trusted retail company. Who is aup with a guy britishborn terrorist who has raqqa. O rocca, syria the headquarters of isil. List ofthrough the stolen names to make a kill list, then he uses twitter, and now, whichat we face is more complex than it ever has been, using twitter, american technology, he sends the kill list back to the United States and says, kill these people by name, by address, government employees, kill them. Because we worked together, although it involves people of five nationalities and moves at the speed of ciber, we were able to take effective action. The suspect got arrested in malaysia and was brought to the u. S. He was sentenced to 20 years in prison. Was living in the ungoverned space in syria was killed in a military strike. They didnt say whether it was by drone or airplane. Is interesting is, you call this a blended threat. We are seeing more of an overlap between criminal activity and what looks like criminal activity charlie but it is something else. Mr. Carlin either a National Security threat or a terrorist group, which is concerning as we look forward. Charlie back to the russians. Looking at your toolkit and saying you have a proportionate response, what are the possibilities . Mr. Carlin we have publicly to find this approach on some we have used, we have used criminal indictments. Charlie and the names of individuals . Mr. Carlin it requires names of individuals. In some cases, we have apprehended the individuals, a guy who was a chinese individual who traveled to canada, was in conspiracy with two Peoples Liberation army members to hack extradition,fights comes to the u. S. , is sentenced to over four years in prison in california. These are real charges. Another is the use of sanctions. We saw that with north korea. Sitting when we were around the situation room table when it came to north korea, we realized a good thing in some respects is that it is north korea. We dont have an executive order to sanction individuals and companies the way we do those who would proliferate weapons of mass destruction. Later that year, the president signed an executive order. That is another tool that is available now. Chinese man,f the theres a company he worked with, and in addition to him being criminally prosecuted, the Commerce Department said, you cant do business with the company if you are in the u. S. Without getting a special license. That is another tool that causes economic harm. Charlie does intelligence believe that in the russian case, they wanted to upset the american political system and confidence in a d . They denied it. The foreign minister gave an erview to cnn and say said, we would never do this. The other thing that is interesting is, whether it was connected to the highest leadership in russia. Iran, orlican guard in does it go all the way to putin . Charlie i think mr. Carlin i think you will continue to see the intelligence assessment. Charlie with a dual without the approval mr. Carlin you can tell from our response, which is to be public, and to say that there will be consequences, though we believe the russian leadership is accountable for this activity. Charlie what happens if there warfare, and who is bold . One of the problems with cyber, you may not know the address of who your attacker is. Correct . Mr. Carlin that is true. But i also think we are much better at investigation attribution of people. Before we brought the china case, people said he would never be able to do it. It is too hard in cyber. And we showed that not only we could do it, but we showed activity like, their conduct started to increase at 9 00 a. M. In the morning beijing time, then it spiked from 9 00 until from 12 00decreased until 1 00 beijing time, lunch break. It went back up again from 1 00six 00 and decreased overnight. Luckily, they dont work the same hours as their u. S. Counterparts, but it is their day job. That is evidence. Ideas that they are doing it on a nine to 5 00 beijing time. It is not all bits and bytes. In the north koreasony attack, it is one of the first time we brought in the same guys i work with when i did homicide and serial rapists. The behavioral analysts, the specialists at the fbi who work at quantico, these profilers. They applied their tradecraft where they study psychology, but they also have someone who is a cyber expert, one of the first times they used him. They looked at, when the North Koreans went into the sony system, if you think about it like a murder, there is malware you need to turn the computers into bricks. And to use that. I also did, they also did, they staged a crime scene. Like serial killers will stage a th