Learned shane harris with the wall street journal. Very happy to be talking to this panel about the emergence of Encryption Technology because i am both challenged by them and i use them. I will let introduce the panel starting to my left. We will let each of these gentlemen who are experts in this field give opening remarks on how they are approaching this question on the challenge of ierging technology and after introduce each one you will see how they come out and buy their unique perspective. Questions fromke you at the end. Be thinking about question she want to ask and when we get to that time, you will see people with nametags. Stop one and frazier hand. They will bring a microphone to you. First is james baker. You are totally not busy right now so thank you for taking the time to be with us. Then, the director for internal security at the european commission. Senior counsel for the computer and communication industry association. I want to jump right into this and asked mr. Baker to lead us off. Certainly the fbi has had a lot to say about the challenges of encryption. When will you take some time to help set the table for us about how you think of this challenge from a legal standpoint, policy, operational. Please, kick us off. Mr. Baker thank you. Thank you to g w posting this. Thise eager to talk about as much as possible to help the public understand the issue, understanding complexity and subtleties and for us to contribute to what we hope is a more informed, educated debate and discussion about these topics because they are important to all of us. So if i could just go through the issues from our perspective a as you say, set the table as to how we are confronting encryption. We confront encryption every day in a lot of different ways. As i have said, as i think the director is that multiple times, the agency supports strong encryption. Strong encryption has very significant benefits for society across a whole range of issues and across a whole range of protections of the data we all care about. Personally identifiable information about us. Commercial transactions that facilitate and an able. It protects our health data. It protects a whole range of very important data that is essential for us to function as a society and to have a functioning economy. It is really important. We are beginning to acknowledge as a society that encryption also has costs and what we are experiencing in the most pronounced way being in the Public Safety sector is that encryption has costs for Public Safety for those involved in trying to protect the Public Safety with appropriate Legal Process and adhering to the laws of the constitutional United States at all time and what i mean by that is in certain circumstances, encryption has cost for our investigative effort in paper iv of ways. In particular, it means in some cases, and some instances, that information or evidence simply will be available. It is encrypted in motion or it is on a device that we do not have a key to get into that information and therefore it is just not going to be available to us. That does not stop us from conducting an investigation. We will still pursue. Fbi investigators are intrepid uncreative and they will figure out ways to solve problems if they are confronted with a problem. So it might not be convention of an electronic surveillance or electronic search means. They will do other things and those things will have costs. They can slow them down, make them more complicated, make them more risky. For example we might have to use a confidential source or an undercover agent to go into a situation including circumstances where there might be physical danger to the agent or to the source. So that is risky. That is just risky. And doing all of these things poses risks to the integrity of the investigation as well. So that is really what we are trying to say. That encryption is good, encryption has skewed benefits, but encryption is not cost three. We have to figure out as a withty how we have to deal that. Historically we have thought in the United States at the balance between sort of privacy and security, if you will, or security and security, however you want to frame the discussion, was settled or that 200 years ago by the Fourth Amendment which discusses reasonable expectations of privacy. And if we go through processes and adhere to the Fourth Amendment and get a warrant to have access with approval by judge to the evidence for the material. So that is how we have done that, how we have settled that balance for more than 200 euros. So encryption is creating, however you want to phrase it, it is changing that balance. Making things harder for us. Making information unavailable to us and so we have to think about what we want to do in those circumstances. Laws an issue across enforcement. But, state, local. Across the intelligence community. It impacts us in different ways. Until december of leicester, all of the devices that were brought to the f ei open,chnical experts to whether they came from authorities, federal, state, or local, we could not open rx is 40 of them. So a significant number of devices. Are those brought to by Law Enforcement . Is to baker some were brought by state and local agencies, the fbi. We could not get into about 40 of them. So that is an issue. The data on those devices is simply not available to us. We do not have a solution to this problem. Were not trying to impose a solution on the United States or any part of the world. We are not advocating a backdoor or a golden key. What i mean by that is we do not want a solution or a solution that somehow in a significant way undermines Cyber Security and undermines the security of our devices and our communications is therefore not a solution. Any solution we come up with us do appropriately in my mind, balance the needs of Public Safety folks, but also protect our privacy and protect Cyber Security and protect the right to expression, free association, encourage our companies to be innovative and competitive in a Global Marketplace where they have competitors, users, and regulators from the world that we have to make sure this is addressed in a global way in and where encryption is available in a global way. The genie is out of the bottle, and is not going back in. We know that. Were well aware of that. So any solution has to balance all of these things. Corporations in america for example solve this problem of the day in way they feel comfortable with because they maintain access to the emails of their employees for a variety of different purposes. Internal, monitoring what is going on, being able to reconstruct things if an employee leaves. They have been able to figure out a balance acceptable to them taking on some Cyber Security risk but having access today and providing protection and a meaningful way. That may be fruitful down the road. At the end of the day, the fda works for the fbi works for the American People to protect them from a variety of threats and to do it simultaneously across the board. A lot of threats we face on any given day. You want us to do it in a certain way, obviously consistent with the laws of the United States, but with certain tools available to us. You give those to us by law and by regulation and my finding and we will make full use of them. The question is, in confronting this problem what tools do want us to have available to us. What tools do you want us to have available to utilize in order to protect you . We will do what you want us to do yet what we feel is incumbent upon us to make sure you understand our current situation. So you are not caught by you can put it through appropriate democratic means to figure out what it is we should have. So, we work for you. The question is, what you want us to do . I will pause there. Host you were coming out this obviously from the point of view of european perspective. I wont ask you to try and speak entirely on behalf of european views on this but one are you give us your introduction and how you approach this challenge. Thank you shane. Let me thank you also, and gw. It is a privilege for me to speak on behalf of the European Union, specifically the european commission. What james just said, two continents but the same problem. Encryption is good. Considered good for Cyber Security. Good for privacy. Good for the economy. Good for the users. It is a key feature of the general Data Protection regulation that will apply starting like next year to the 28 Member States. It is a key feature of our eight e privacy framework, where confidentiality of communication is the most important objective. But, as james said, any particular like was said before, the situation in europe, it is the one that you know. And the debate is easing up on the need for Law Enforcement and other authorities to perform duties against terrorists and Serious Organized Crime to counter a problem with encryption and the congress of criminal investigation both and stored in communication data. The encryption is on the rise. We have 27 of the smartphones in europe encrypted. 47 here in the United States use encryption. So, are we going dark, as someone has said . I certainly hope not. I do not know. There is a need to study options. James was saying there are options being assessed or developed through the interception requirement that goes back to the ordinary mobile communication, now to extend to the ott or over the top providers. What we have to do with encryption has moved the debate from access by design to privacy by design. With the endtoended encryption. The approach of the European Union, of the european commission, is an inclusive one. We have created a phone and we dont have a solution coming from one only of the constituents. The intelligence says we cannot solve alone the problem. The privacy advocates cannot solve the problem. Law enforcement industry cannot solve the problem alone. So we have put in place a mechanism that allows us to assess with all the different stakeholders, first of all to define the problem. Because as has been said, we have to understand what we can do without compromising privacy and allowing line enforcement to move forward. And, we have to assess the option in a way that necessity of proportion has it. The under mental rights are to make sure fundamental rights are respected. We have to ensure Member States have access to data they need. Companies have to do their part. They have to pick up the social responsibility. Understand that it is important that they contribute to the final good, which is to ensure the security of the citizens. In 2015vent set up this specific structure called the youinternet phone. This brings together all of the Law Enforcement and probably Member States. Social media companies. Some of them are present here for this. An come back and clearly our own agency. In we are trying to identify a solution. It takes time. We all speak about time necessary to avoid coming from the back door. To enter from the front door. Because we have to find a solution that will allow us to enter from the front door. And there are challenges. We are a continent. To create an environment for 28. But we are only one part of the entire geographic port. So we have the challenge of the enforcement of the law. Someone was saying that several memberstates are putting up at national level, laws. How do we enforce these laws . How do we address the jurors diction. So far, the law has always given Law Enforcement the ability to instruct judicial order. But how do we do it with the internet, which is borderless. And how did we do the concept of localization . That is another big issue we need to discuss. Challenge, also a that could be counterproductive also for the economy. We do we need an International Framework question mark to we need to ensure that all states share the same instruments and how to make this possible. So, this is the approach. An inclusive approach which at the moment does not have a solution because we do not have a solution today. But we want the solution tomorrow. Knowing and encryption is a world of secondbest solutions. Host you cant agree with both of these guys. Thatthink we can all agree we need encryption. Thank you again for having us. That should be the takeaway, industry and Law Enforcement on the same page. Feel free to go home now. [laughter] i think many people in this room have been to a panel on encryption in the last three years, maybe in the last 35 years, when encryption became publicly available to the United States. And worldwide. Vu foray feel like deja all of you. Especially for members on this panel. Not for me, i am really young. But i think what industrys perspective is, is that we regularly have the solutions, the conversation around solution, and i think we, the american public, users worldwide, regularly come to the same conclusion. That weighing the cost of encryption with the benefit, the cost of Law Enforcement investigations and Public Access , and the cost of sort of scaling potential solutions to the encryption solution across ,hat is now a Global Internet the ultimate to i think answer from the perspective of the at least Internet Users, is that that question has been answered. Because start to great. Scaling those secondbest solutions to encryption across the internet puts too many users at risk either from a financial perspective, from an expression perspective, from a freedom of association perspective, that mights a oneup instance be necessary but i think it makes it a secondbest solution to put forward. So that is where industry approaches that from. From a users right perspective and from a technological perspective. I think the remark is been made in the past, its been characterize that the industry perspective on encryption is one of marketing or business practices. That this is something that can help us cell phones or get more users on to key platforms are social media. I do not think anyone realistically believes that is the case for industry. Industry is in this because they are under pressure but from users and regulatory authorities to provide the best appropriate and possible protection for users of Cyber Security. In encryption is the Gold Standard in this regard. It is not perfect. Implementations of encryption are incredibly difficult to scale. And difficult to design. Design osicult to versionto os version. So i think the perspective from industry is that rather then, you know, looking to Technical Solutions and i understand that no Technical Solutions have been suggested from industry or Law Enforcement, we should look at how we can help Law Enforcement was investigation. See what they have no toolbox now and see what we can do to facilitate additional tools, use of those totals, there has to be recognition from both sides that there is not going to be a perfect solution to cracking the case of encryption. It may be that we have to live with encryption because the benefits are too great and to the extent that Internet Users and the public are able to help the government recognize that, i think that is where we would like to go moving forward. Host so if you watched 60 minutes last night, you saw a really smart terrorism analyst from a place you may be familiar with. You saw Shamus Hughes standing in front of a Bulletin Board with this great diagram of terrorist faces and lines drawn between them, looking very much like something you would see in homeland. Right . There were two interesting takeaways. One was that he talked about terrorists, one that we were was ining and one who touch with isis, talking to them by encryption. It would seem that clearly these groups of adopted this is a communication channel which must be very frustrating to Law Enforcement intelligence. It was also the cases was a pretty sophisticated diagram and even despite their use of encryption we were able to understand a fair amount of who these people were and how they are communicating. I wonder if we can take this realworld example. If we know terrorist groups are clearly using this to communicate, that has challenges to Law Enforcement intelligence but it seems there are surmountable and some instances, problems. I wonder if we can provoke each of you with that idea. Mr. Baker, maybe we will start with you because think so obviously fall into your lane. Talk about that challenge. Obviously, terrorist are using the stuff that were finding out ways to know how they are connecting with each other. Can you give us some insight into how that looks when you are grappling with these cases. Mr. Baker i saw that story as well. You think about the diagrams and social network, if you will. You can see that network through a variety of means. Talking to people, having sources, understanding what is going on. You can look at the metadata, the dialing data between people to try to understand what that network looks like. Who they are in touch with the end how often. And importantly, does not tell you what they are planning to do. It does not totally what they are thinking. It does not tell you about their capabilities or activities, plans, intentions, that kind of thing. You d