U.S. Department of Justice REPORT OF THE Cyber -Digital Task Force Report Force Cyber -Digital Task ATTORNEY GENERAL’S CYBER DIGITAL TASK FORCE REPORT OF THE ATTORNEY GENERAL’S CYBER DIGITAL TASK FORCE United States Department of Justice Office of the Deputy Attorney General Cyber-Digital Task Force 950 Pennsylvania Avenue, N.W. Washington, D.C. 20530 https://www.justice.gov/cyberreport INTRODUCTION Table of Contents Letter from the Deputy Attorney General .............................. i Attorney General’s Cyber-Digital Task Force ...................... vii Introduction ........................................................................................ xi Chapter 1 Countering Malign Foreign Influence Operations ...................... 1 Chapter 2 Categorizing Sophisticated Cyber Schemes .................................... 23 Chapter 3 Detecting, Deterring, and Disrupting Cyber Threats ............... 49 Chapter 4 Responding to Cyber Incidents .............................................................. 83 Chapter 5 Training and Managing Our Workforce .......................................... 95 Chapter 6 Looking Ahead ..............................................................................................109 Appendices Appendix 1: Memorandum Establishing the Task Force .......... 131 Appendix 2: Recent Successful Botnet Disruptions ................. 133 Appendix 3: Recent Successful Dark Web Disruptions ............ 137 Appendix 4: Glossary of Key Terms .....................................................141 v TASK FORCE MEMBERS ATTORNEY GENERAL’S CYBER-DIGITAL TASK FORCE Task Force Members Sujit Raman, Chair Associate Deputy Attorney General Office of the Deputy Attorney General John P. Cronan Andrew E. Lelling Assistant Attorney General (Acting) United States Attorney Criminal Division District of Massachusetts John C. Demers David T. Resch Assistant Attorney General Executive Assistant Director National Security Division Federal Bureau of Investigation Carl Ghattas Beth A. Williams Executive Assistant Director Assistant Attorney General Federal Bureau of Investigation Office of Legal Policy John M. Gore Peter A. Winn Assistant Attorney General (Acting) Chief Privacy & Civil Liberties Officer (Acting) Civil Rights Division Director, Office of Privacy & Civil Liberties CYBER-DIGITAL TASK FORCE REPORT Task Force Contributors Matthew J. Sheehan Counsel to the Deputy Attorney General Staff Director Elizabeth Aloi Brendan Groves Erica O’Neil Leonard Bailey Aarash Haghighat Richard Pilger Michael F. Buchwald William Hall Jason Poole Mark Champoux Christopher Hardee Andrew Proia Thomas Dettore Adam Hickey Kimberley Raleigh Richard Downing Ray Hulser Peter Roman Benjamin Fitzpatrick Anitha Ibrahim Opher Shweiki Lindsey Freeman Matthew Kluge Michael Stawasz Tashina Gauhar John T. Lynch, Jr. Andrew Warden Josh Goldfoot Katrina Mulligan J. Brad Wiegmann Bonnie Greenberg Sean Newell Cory Wilson And representatives from: Bureau of Alcohol, Tobacco, Firearms, and Explosives Office of Strategic Intelligence & Information Drug Enforcement Administration Office of Investigative Technology Federal Bureau of Investigation Counterintelligence Division Federal Bureau of Investigation Counterterrorism Division Federal Bureau of Investigation Criminal Investigative Division Federal Bureau of Investigation Cyber Division Federal Bureau of Investigation Digital Transformation Office Federal Bureau of Investigation Information Technology Branch Federal Bureau of Investigation Office of Private Sector Federal Bureau of Investigation Office of the Chief Information Officer Federal Bureau of Investigation Office of the Director Federal Bureau of Investigation Office of the General Counsel Federal Bureau of Investigation Operational Technology Division INTERPOL Washington, the U.S. National Central Bureau Justice Management Division Office of the Chief Information Officer/ Cybersecurity Services Staff United States Marshals Service Investigative Operations Division United States Marshals Service Judicial Security Division viii INTRODUCTION Introduction Cyber-enabled attacks are exacting an enormous toll on American busi- nesses, government agencies, and families. Computer intrusions, cy- bercrime schemes, and the covert misuse of digital infrastructure have bankrupted firms, destroyed billions of dollars in investments, and helped hostile foreign governments launch influence operations de- signed to undermine fundamental American institutions. The Department of Justice’s primary mission is to keep the American people safe. We play a critical role in the federal government’s shared effort to combat malicious, cyber-enabled threats. n February 2018, the Attorney General policy—grounded in our longstanding prin- established a Cyber-Digital Task Force ciples of political neutrality, adherence to within the Department and directed the the rule of law, and safeguarding the public ITask Force to answer two basic, foundational trust—that governs the disclosure of foreign questions: How is the Department respond- influence operations. ing to cyber threats? And how can federal law enforcement more effectively accomplish its Chapters 2 and 3 discuss other cyber-enabled mission in this important and rapidly evolv- threats our Nation faces, particularly those ing area? connected with cybercrimes. These chapters describe the resources the Department is de- This report addresses the first question. It be- ploying to confront those threats, and how our gins by focusing on one of the most press- efforts further the rule of law in this country ing cyber-enabled threats our Nation faces: and around the world. Chapter 4 focuses on the threat posed by malign foreign influence a critical aspect of the Department’s mission, operations. Chapter 1 explains what foreign in which the Federal Bureau of Investigation influence operations are, and how hostile for- plays a lead role: responding to cyber inci- eign actors have used these operations to tar- dents. Chapter 5 then turns the lens inward, get our Nation’s democratic processes, includ- focusing on the Department’s efforts to recruit ing our elections. This chapter concludes by and train our own personnel on cyber mat- describing the Department’s protective efforts ters. Finally, the report concludes in Chapter with respect to the upcoming 2018 midterm 6 with thoughts and observations about cer- elections, and announces a new Department tain priority policy matters, and charts a path xi CYBER-DIGITAL TASK FORCE REPORT for the Task Force’s future work. Over the criminals rely upon to penetrate our borders. next few months, the Department will build We use legal authorities to take control of upon this initial report’s findings, and will virtual infrastructure—such as networks of provide recommendations to the Attorney compromised computers called “botnets”— General for how the Department can even to prevent future victimization. We share in- more efficiently manage the growing global formation gathered during our investigations cyber challenge. to help victims protect themselves. And we do all of these things to fight modern threats The Department’s Cyber Mission while remaining faithful to our Nation’s re- spect for personal freedom, civil liberties, Computer intrusions and attacks are crimes, and the rule of law. and the Department of Justice fights crime. That is true regardless of whether the crimi- Where appropriate, we also work closely nal is a transnational organized crime group, with our interagency partners to support fi- a lone hacker, or an officer of a foreign mil- nancial, diplomatic, and military measures itary or intelligence organization. In addi- to bring all possible instruments of national tion, the Department has unique and indis- power to bear against cyber threats. Other pensable cybersecurity roles in the realm of departments have the primary responsibil- foreign intelligence and counterintelligence. ity for helping victims recover from cyber- attacks; we have the primary responsibility In fighting criminal computer intrusions and for conducting the investigation into who is attacks, the Department identifies, disman- responsible. We do not have the federal gov- tles, and disrupts cyber threats. In doing so, ernment lead for assisting election officials we provide justice to victims and deter others in securing their systems, but we do have the from committing similar offenses. To fulfill primary responsibility for investigating our our mission, we deploy criminal justice and foreign adversaries’ efforts to target election intelligence tools to find malicious hackers, arrest them, incarcerate them, and require infrastructure. them to pay restitution to their victims. We shut down the dark markets criminals de- Similarly, we do not have the government’s pend upon to buy and sell stolen informa- lead role in protecting private or government tion. We deprive criminals of the tools and networks, in designing security standards, services they use to attack American families or in regulating how the private sector must and businesses. Working with private sec- defend itself. Those are important functions tor partners, we seek to deny foreign gov- for which other government departments ernments the infrastructure they would use take responsibility—often, with our support to conduct illegal influence operations. We and assistance. Our mission is to enforce the seize or disable the servers, domain names, law, to ensure public safety, and to seek just and other infrastructure that transnational