RUSH TRANSCRIPT

Cyber Space with John Carlin

Interview with John Demers

Air date: 6/5/20

John Carlin: So John, it’s great to have you here today. You’re someone I’ve known a long time. We have a bit of a strange story that way, dating back to law school. Tell me a little bit about, from your perspective, being in a job now, the Head of the National Security Division, that didn’t exist when we were in law school together?

John Demers: I thought this interview was going to start with a little bit, “Hey, why don’t you tell me what you think of me?” But yeah, you’re right. So as you know, John, I mean, this field didn’t exist as a field before 9/11, and the division didn’t exist in the department since before 2005. It was one of the recommendations of the Weapons of Mass Destruction Commission to reorganize the department similarly to the way the FBI had reorganized.

John Carlin: By the way, it always seemed strange to me that why our division was a recommendation of the Weapons of Mass Destruction Commission. It seems [crosstalk].

John Demers: Well, I think it’s about who was in charge of that commission, and the ideas they had for the way the departments should be reconfigured. So it was an effort on the part of the folks who were in charge at the time to bring together all the parts of the department that worked on national security, including the counter-terrorism prosecutors, the counterespionage prosecutors, and then those attorneys who had worked on the applications to The Foreign Intelligence Surveillance Court to add onto that a law and policy office to make sure you had a dedicated unit of people who thought about national security policy issues full-time. And to organize that under one assistant attorney general and have that person report to the deputy attorney general. So it was more of a reorganization than a new division, but it is the first new division in the department since the Civil Rights Division was created about 50 years before that.

John Carlin: Now, as you say, when we were at Harvard Law School together, there was no national security courses. I know I took one or two that at least touched on national security issues, but they had a different feel back then. Was there anything in your law school experience where you thought maybe one day I’ll end up doing national security? CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 2 of 24

John Demers: Not really national security. I always thought, “Oh, I’ll come work at the justice department or I’ll work in government.” I went to law school because I was interested in government and in policy work. So the idea of coming down here was very much in line with what I was thinking. In fact, when I first, I first came to the department in 2003, two years after 9/11, it was not to work in the National Security Division, which had yet to be stood up, but it was to work in the office of legal counsel.

Then when I left the department to go clerk for Justice Scalia and at the end of that clerkship, when I was otherwise thinking, “Well I suppose it’s time to go back to private practice at this point and figure out what I’m going to do next,” the department called and said, “Hey we’re setting up this new division. Would you like to talk to us about coming and working here with Ken Wainstein?” who was the first assistant attorney general. He hadn’t been confirmed yet, but he had been selected for.

John Carlin: I remember getting a call because Ken Wainstein was the top prosecutor in the District of Columbia, the US attorney. I was a prosecutor there at the time. So I knew him as a career prosecutor. He said, “It looks like this guy went to law school around when you did, have you ever heard of John Demers, what do you think of him?” So I lied and said good things, at the time. But it was interesting, he didn’t know you and you didn’t know him, when you started and you didn’t really know … the division didn’t exist, what it would be. What was your thought process when you started at this division right at its birth?

John Demers: Well, so that was 2006, and it was the last two years of the Bush administration. It was going to require me to come in as a political appointee in the last two years. At that time, it was post-Katrina things were not-

John Carlin: Could you just explain for a little bit the difference between career and political appointees?

John Demers: Sure. So when I was first at the department, I was here as a career appointee. That basically means you stay on at the department indefinitely without regard to what administration is currently in power at the moment. When you’re a political appointee, and the political appointees hold most of the more senior jobs at the department. So the upside is you get to run things a little bit more. The downside is, if you know the administration that appointed you and nominated you loses, then you get to find a new job.

So in the last two years of the Bush administration, things were not looking very good for the Republicans already by then, Congress had changed hands. As I said, I had been thinking about going into private CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 3 of 24

practice, but having gone to law school with the thought that I wanted to do government service and work at the justice department, having worked at the justice department for a couple of years before then, and having the opportunity to work at the first new division, working on national security, which then, as now, was such a priority of the department and of the country. I really couldn’t pass up the chance to come back.

So I did, and I’m very glad that I did. The division was not yet started yet. I started in the criminal division while they were waiting to officially start the division with Ken’s confirmation. When that took place in September of 2006-

John Carlin: Just quick question. Wait, wait. So you’re starting it up, it’s still in the criminal division. Where did they stick? Where were you physically?

John Demers: I was in the front of office as a very short term counsel to the assistant attorney general-

John Carlin: But physically, how’d you find the office?

John Demers: Physically, I was right outside where the new secure facility for the National Security Division was going to be. So it was just two doors away from where the front door of that skiff was. So they had already built it out and they just didn’t want to start the division going without a confirmed assistant attorney general in charge. So once that happened, we got up and running and I moved into the division and then I spent the next two and a half years or so in the division.

The other thing, knowing that it was national security, I had no worries about going in at the end of an administration because I knew it was going to be a busy time, regardless. It wasn’t a time when people were going to kind of wait and see what happened for the election. We were going to have to continue to work on these issues. As you know, John, in those days, when we talked about national security, we’re talking about counter-terrorism, we’re talking about Al-Qaeda and its affiliated groups. We were still very much in a post 9/11 world, and we spent maybe 90% of our time doing investigation, surveillance, and prosecutions of terrorists.

John Carlin: Yeah. So you’re there, you’re working heavily on terrorism. I think I was at FBI at the time-

John Demers: You were, yeah.

John Carlin: Then you leave for the duration of the Obama administration. So roughly eight years, you come back, and tell me a little bit what changed? CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 4 of 24

John Demers: Well, it changed significantly and not just because you were in charge, but because the nature of the threat changed, not immediately, of course. I think, obviously, I was looking at it from the outside, but the first several years of the Obama administration, it was still very much, I think, a counter-terrorism focused job. But a couple of things changed along the way.

One was the rise of nation states as threat actors that had to be dealt with from a justice department perspective. Another was the rise of cyber as a tool for projecting nation state power. That was something that you and Lisa were very much focused on, and actually had reorganized the division by the time I got here to address the fact that we had to focus more on nation state activity at large, but cyber activity by nation States in particular.

John Demers: So the nature of the threat changed by the time I got here in 2018, the nature of the terrorism threat was markedly different than it had been in-

John Carlin: Just jumping in. You were saying that Lisa and I changed … You’re talking about Lisa Monaco, who was the Assistant Attorney General-

John Demers: Lisa Monaco, right. Lisa Monaco was the Second Assistant Attorney General during the Obama years. Then she was followed by you and I think both of you were very focused on cyber. I know that was your background too, when you were at the FBI, when you were at the cyber part of the criminal division here at the department also, and I think rightly saw that it was very important for those of us who work on the national security side of things, on the nation state actor side of things, to have the expertise to develop and investigate and prosecute cyber cases against these nation state actors. So that’s something that we’ve continued and built upon in the last years since you left.

John Carlin: Yeah, it’s interesting because when I came in and was doing the shift over to the division, we were thinking, “We might be at a transition point for the country where the terrorism threat has decreased and we’re going to switch and focus on nation state actors, in particular, we’re seeing the rise of cyber.” But actually that turned out not to be true because-

John Demers: Because of ISIS.

John Carlin: Because of ISIS who took advantage of cyber in a different way, not the way we had traditionally been thinking about it, but in order to use social media to incite terrorist activity. So that drew a lot of resources for a couple of years. Then you saw the nation state meddling in the election, in some ways using a similar tactic as it turned out that ISIS had, which is not just hacking stealing information, but by using social media as a CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 5 of 24

propaganda tool. So that kind of hits, you come in, that’s front and center on your desk. Tell me a little bit about how you think about tackling that problem.

John Demers: Yeah. I mean, and you had done … but to your credit, I mean, there was aspect of it, but before then there was the computer intrusion side in terms of Chinese state actors stealing intellectual property. Another thing that we have been able to build upon, I think in the last few years, I mean, when I came in, so it was post … It did take a while for that process to go. So I didn’t come in until early 2018, about a year and a half after the election took place. The special counsel’s office was already up and running. We, at that time though, we’re focused and have been since then on election security, one aspect of which is countering Russian disinformation. If not necessarily disinformation, let’s say the propagation of divisive issues and trying to stoke discord within the United States-

John Carlin: Let me jump on that for a sec with current events and there’s civil unrest right now. One thing that struck of interest that was in one of the Special Counsel’s indictment was a description of how, in particular, among other groups, but that Russian provocateurs were using social media in order to pretend to be black lives matter along with many other groups to just sow as much discord as they can. In this current time of social rest, how are you monitoring that? Or are you seeing any signs of that threat? What role are you playing at the National Security Division?

John Demers: Yeah. So the Russians, as you said, are not new to these issues and they are looking for issues that will prove divisive in the US and are looking to amplify the voice of both sides and sometimes inventing social media postings, writing them themselves, other times retweeting really amplifying messages that are already out there, but all to a view of stoking division and you saw it reflected in the Special Counsel’s work, you also saw it reflected in an indictment by the Eastern District of Virginia of the Internet Research Agency, which is, actually a private group in Russia, but affiliated with Russian government actors whose job it is to propagate these divisive messages, and especially to focus and try to increase the violence associated with the differences, the strong differences of opinion, among different people on these various issues.

Then all to the goal, of course, that by dividing something, you weaken it. So it was also the goal of weakening the US as a force in the world, weakening the reputation of the US and its ability to lead in the world and hoping that it’s too distracted to deal with the issues that are near and dear to the Russian heart. So when it comes to the current events, we are tracking and monitoring, and working with social media companies to monitor efforts by foreign powers, particularly the Russians are very active in this space. The Iranians also get into this space and- CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 6 of 24

John Carlin: Are the Iranians involved in … Is there something new about the way Iranians are involved? Is that long standing? How would you characterize that?

John Demers: New meaning in the last few weeks? No. I mean, new last few years. I mean, look, the Russians have been doing disinformation campaigns since the cold war, right? So it’s just now they had a new platform, which is cyberspace and the internet. So it was a new means of doing an old tactic. Then other people, I think having looked at the Russian behavior in this area have decided to emulate it, and the Iranians have done some of that, although it’s not on the scale that the Russians have been able to muster-

John Carlin: What about the other two major actors in this space of disinformation around civil unrest, China, North Korea? Seeing any activity there?

John Demers: We, don’t … not so much. So we have seen the Chinese enter this … Well, I shouldn’t say this. The Chinese have been active in terms of cyber disinformation, but not in the US right? But in other places in the world, say Taiwan. Areas that are a little closer to their heart. So we don’t see them in this space, very active. We have seen them on the issue of coronavirus start to do some social media campaigns. There, the goal was to message how effective they were in dealing with coronavirus, how ineffective the West is in dealing with coronavirus, all to the point, one, I think of limiting their responsibility for the coronavirus. Then two, to try to establish the world that the Chinese authoritarian system is better at protecting the lives of its citizens than is Western style liberal democracy. But we haven’t seen them get into this current issue of police brutality here.

The work that the FBI has done and the Department of Homeland Security has done with the social media companies since the election of 2016, it’s actually quite a tremendous, in their ability to provide information to one another in terms of what they see with respect to foreign countries, disinformation campaigns, what accounts are being set up and used by a foreign countries, and then the social media companies have done a lot of work ,of their own accord, under their terms of use to take down a lot of that content that they see that’s online that’s supposed-

John Carlin: So would you give them a good grade in terms of the performance of social media companies at thwarting nation state propaganda on social media?

John Demers: I think, look, this whole effort, both by the social media companies and the FBI, I always say it’s like sweeping your porch on a dusty day, right? You never get it totally clean because it’s so easy to reopen an account or to open a new account or dream up a new handle and start pushing your CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 7 of 24

messaging. But if you don’t do it, your porch is going to be absolutely filthy, right? So-

John Carlin: You know, during this pandemic, among other things I’ve learned that and have been instructed accordingly by my spouse, “If you don’t clean regularly, it doesn’t get clean, and doing it once is not sufficient.”

John Demers: You just have to keep at it, and I think both the Bureau and the social media companies have been keeping at it and what’s gotten better I think it’s just that two-way relationship of sharing information with one another that can help us push back on some of this.

John Carlin: So just to pin it down, and then I’m going to shift a little bit, but so we are seeing Russia, in particular, active with our current civil unrest in the same manner they have been with other types of unrest?

John Demers: We’re starting to see some of that. Yeah. Yep.

John Carlin: Outside of Russia, I just wanted to talk a little bit about … I think it would be of interest for folks, about the National Security Division, which was, as we’ve talked about, really stood up with the focus on international terrorism and international threat. What role does it play when the civil unrest is coming from inside the United States? When much of it is peaceful protesting and the more difficult lines to draw when it comes to domestic terrorism, and when to call that domestic terrorism statutes are? Maybe you could just start with laying out the framework. What is domestic terrorism under federal law from the point of view of a prosecutor?

John Demers: So it’s different from what we think of as international terrorism in terms of the law’s approach to it, right? So usually, when you hear about terrorism cases, international terrorism cases, what people are talking about is individuals who are providing support of one type or another, whether it’s money, whether it’s themselves, whether it’s weaponry, whether it’s helping another person to join a group, to a group that has been designated by the state department as a foreign terrorist organization.

John Demers: To be a foreign terrorist organization, you have to be foreign, as the name suggests. That means that there’s not a precise test for that, but basically the bulk of your activities and members have to be outside the US, or have to be transnational. So when we talk about material support to terrorism, that’s sort of our standard terrorism charge, where we’re charging somebody with providing support to one of these terrorist groups.

John Demers: On the domestic terrorism side, there are a few things that are different. For one thing, when we talk about international terrorism, what we’re CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 8 of 24

talking about, not exclusively, but by and large, is jihadist terrorism. When you’re talking about domestic terrorism, you’re talking about a wide variety …

About domestic terrorism, you’re talking about a wide variety of groups or individuals here in the US, from the far left to the far right, that have very varied ideologies. And some of these are not very well structured as groups.

The second difference is that our law is set up differently. And the statutes that we can use, that when people talk about domestic terrorism they’re thinking about, aren’t premised on the idea that the government has labeled a group as a domestic terrorist group, and then gone after everybody who supports that group. We are going after individuals who are undertaking a set of violent activities, all for the purpose of affecting government policy, intimidating the civilian population, or going so far as to overthrow the government.

And that’s effectively sort of more in lay terms, the definition of terrorism in US law. But there’s no crime of domestic terrorism. What there are instead-

John Carlin: I think that’s going to be a surprise to some. But it’s an important point, that there is no crime of domestic terrorism, and yet it is defined in statute. So why define it at all in statute? And what meaning does it have?

John Demers: So the statutory definition is useful. If you’re sentencing someone, it’s an enhancement to their sentence, if you can show that, let’s say they committed a murder or an assault on a federal officer, all in furtherance of domestic terrorism. And you can get a greater sentence. It also opens up the use of some investigative tools that would be available in those kinds of cases. So it’s not that it’s a crime in and of itself to do that. And the definition itself presupposes the commission of certain criminal, violent criminal offenses. But there’s no crime called a crime of domestic terrorism.

John Carlin: So you can’t right now sort of… following up on what you said, you can’t designate a group inside the United States and say, you’re a terrorist group, under a federal law.

John Demers: You can, but it doesn’t have the legally significant meaning that it has when you’re doing it for an international, foreign terrorist organization. So what I mean is, you can point to a group and say, “You are operating as a terrorist group,” and therefore focus the resources of the FBI and law enforcement on that group, and say to those law enforcement entities, “You should be taking the same approach, vis-a-vis that group, even if you CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 9 of 24

can’t bring exactly the same charges, but take the same investigative approach as you have been on the international terrorism side.”

And what I mean by that is, on the international terrorism side, after September 11th, the focus was very much on the prevention and disruption of terrorist activity. It wasn’t going to be a, let’s figure out who did it after it happened approach. And together with that, or as a part of that, is the idea that you’re going to bring a variety of charges to neutralize, to disrupt international terrorism suspects before they can act. So you might bring visa fraud charges, for instance, on somebody, and then have them removed. Although maybe originally, that investigation started out as a terrorism investigation, but you didn’t want to wait until you saw what terrorist act they did, and then charge them with that.

John Carlin: So does that mean the FBI and the National Security Division of the Department of Justice or other members of the justice department will be focusing on members of the Antifa?

John Demers: So for several years, both the Bureau and us… And John, I know you brought attention to the domestic terrorism issue when you were in this job also, and you had created within the National Security Division, this position of domestic terrorism coordinator, which still exists to this day. And so for several years, what we have done is to take that same approach against domestic terrorism, and that we had sort of developed vis-a-vis international terrorists and to apply it on the domestic side.

So to give you an example, you probably saw a series of disruptive arrests take place before the rally down in Charlottesville this past winter. And the idea there, again, was figure out not the people who are there to assemble in favor of second amendment rights, not the people were there just to protest and petition the government, but figure out who’s going to come to this rally, who in particular might be traveling across state lines to come to the rally, and to foment acts of violence. And don’t just watch them and then arrest them when they do it, but actually see whether there are criminal charges you can bring beforehand, and then charge them beforehand, so you’re disrupting them before they can do that. And in fact, that rally, although it was very large, was ultimately a peaceful one, in contrast to the one two years [crosstalk].

John Carlin: Yeah, so a lot in there. So one is… And it’s actually prohibited, right? You cannot target a group on the basis of their opinions or thoughts, their first amendment activity.

John Demers: Right. CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 10 of 24

John Carlin: And so instead, you’re looking for other existing crimes, because there is no domestic terrorism charge to bring. And then third, you’re really looking… Your top goal is the prevention of violence, so particularly violent crime, if I’m hearing you.

John Demers: Yeah, no, for sure. That’s the number one goal is the prevention of violent crime. On the first amendment point, that’s also true on the international terrorism side. You can’t, the FBI is prohibited from targeting anybody only on the basis of their first amendment activities, and that’s obviously very consistent with the Constitution.

John Carlin: And how, because they are already existing crimes, so in our current arrest, what role does National Security Division play? When do you get involved? And you wear a lot of hats, and we’re going to talk about this a little bit more, but one is the Foreign Intelligence Surveillance Act, that doesn’t come into play-

John Demers: No, no.

John Carlin: With domestic terrorism. So when you say some other tools for surveillance might be available, you mean under criminal. Criminal laws.

John Demers: For sure. Right. So our main, what we’re looking at … And so there’s something, as you know, called the Justice Manual, used to be called the US Attorney’s Manual. It lays out what the responsibilities are of the different parts of the Justice Department, in terms of reviewing and either approving or being consulted upon in different charges.

One of the statutes that we have responsibility for, which is relevant to the issues we’ve been talking about, is called the Anti-Riot Act. And so that basically criminalizes the crossing of state lines to incite or participate in a riot. The statute itself is a fairly old. It’s been used sometimes successfully, as it was used in Charlottesville to go after some of the folks who committed violent activity down in Charlottesville. Sometimes unsuccessfully, in California, the district court judge threw out a charge under that act as being contrary to the first amendment. So I think the courts that have looked at this most carefully say, well, it’s got a lot of constitutional first amendment issues in it.

And then the question is, is there a core of the act that is properly criminalized? And our job, I think, is to keep sort of the charges within that core, where we’re comfortable that people are being charged, not for exercising first amendment freedoms, for protesting, but truly for crossing state lines to engage in violent activity.

John Carlin: And have you brought any Anti-Riot Act charges related to the- CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 11 of 24

John Demers: I don’t believe… no, I’m sorry. There have been a couple charged in different districts in the country. And so, one of our jobs currently, obviously, is to coordinate with the… Since the protests are taking place across the US, to coordinate with the US attorney’s offices around the US and provide what expertise and support they need, as they decide what charges to file.

As you said, first of all, the vast majority of the protestors are absolutely peaceful. Secondly, even of those who were arrested, most of them are being arrested by state and local police and only charged by state and locals. And what we’re focused on are really the people who are out there participating in the most violent acts, and in particular against obviously federal buildings, is an area where we have to be focused on, since that’s US property.

John Carlin: And combining the two, before we move on, the Russian misinformation, which I think you said you starting to see the anti-red, would you say, in part, you’re defending? Are they going after the peaceful protestors in a way, trying to foment violence, and in that way, disrupt the civil right of being able to peacefully protest?

John Demers: So certainly when people engage in violence, they are also hindering those people who are just trying to peacefully protest, from peacefully protesting. What we did see, on the Russian side… Not right now, necessarily, it’s still early days in terms of what we’ve seen. But previously, when a few years ago, the Russians were also focused on this issue of police brutality, we did see the Russians try to make individuals more violent, encourage them. So maybe they already thought and felt strongly that the police, in some particular instance, had committed an act of brutality, but they were not necessarily inclined to act violently. We have seen Russian disinformation websites pushing people to be more violent than they would otherwise be, and in that sense, really just trying to get them in trouble.

John Carlin: And who in the department… Other side of this has been the misconduct by a police officer, who’s now charged with murdering a civilian. Does the National Security Division play a role in policing police and police misconduct? Who plays that role in the department?

John Demers: That is usually the civil rights division which that plays that role in the department. Usually, as I understand it, you see what the state’s going to do. And the state, in this case, as you said, brought charges. You can then, in addition, bring federal charges, but those are usually civil rights charges. So we don’t have statutes that we use that apply to that kind of conduct. CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 12 of 24

John Carlin: And in case there wasn’t enough going on with foreign terrorist, nation states, civil unrest, there’s a pandemic. We’re in masks and staying far apart. Tell me a little bit about the way the National Security Division goes to work in a pandemic. Because it’s not a place, I know, where people can stay home. And then also, are you seeing it have an impact on the terrorist threat or nation state threats?

John Demers: So just in terms of the impact on our day to day work, I’m here almost every day, just because, as you said and as you know, my office, which was your office, is in a secure facility, in a suite-

John Carlin: One thing I was curious about, is it’s a hand reader. And what do you do in a pandemic with a hand reader? How are you getting into your office?

John Demers: So I have to say that the assistants, they’re very good at keeping an eye on the cameras and unlocking the doors from their desks, so that we don’t have to use the hand reading. There’s also hand sanitizers on the other side of the hand reader. Although that actually predated coronavirus, because the hand readers, under any set of health circumstances, are a little bit gross. So [crosstalk]

John Carlin: I will say [crosstalk] I was constantly infecting everyone in the skiff with some two-year-old disease [crosstalk].

John Demers: Retina scanners, I think, soon.

John Carlin: Yeah.

John Demers: But so much of the work we have to do has to be done in a secure environment, which means, I think of all the divisions in the department, we’re probably the ones that have the highest percentage of people here on any given day. Still, we encourage people to work from home whenever they can, and there are certainly aspects of our jobs, depending on exactly what your job is, that could be done from home. The people who are working on cases, for instance, that have gone to prosecution, most of that is going to be unclassified, and they can do a lot of that work from home.

John Demers: I would say the biggest impact on our work has been on the outreach side of things. As you had done, John, when you were here, I have done a lot of outreach to the private sector, to universities, to academic institutions, to the press, at conferences and everything from one on one meetings to very large conferences. And all of that, along with all the travel that goes with that, has halted. So there’s a little bit, I’d say maybe 10% of that volume has switched to Zoom, and 90% has just been canceled, as is the case in any field. CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 13 of 24

John Demers: So that’s, I think, has been the biggest impact. And it is an impact. I think in this job, one of the things you can do effectively is to raise awareness of different issues with the effected communities. And there is nothing that meets that better than being able to go to talk to people, as you know, just face to face.

John Carlin: So talk a little bit about that, because part of that outreach is developing trust and informing people about what new threats might be that they’re not thinking about. And I know that’s been part of your university outreach.

John Demers: Right.

John Carlin: But another way of delivering that message is with handcuffs. And I have noticed, it seems like an increase of arrests around universities and the conduct of espionage. And then particularly linked to the pandemic and COVID-19, the remarks that you’ve made about the targeting, particularly by China, of research here about vaccines. So what’s going on with that message and with those prosecutions?

John Demers: Well, so one of the big focus areas for us has been theft of intellectual property on behalf of the Chinese government, sort of writ large, both as a result of theft that’s directed by the Chinese intelligence services, that’s conducted by the Chinese military, often the military through cyber means. Or as a result of an ecosystem that encourages theft and the private initiative of theft by the Chinese government through programs like the Thousand Talents. And our focus in the end of 2018, we launched what we call the China Initiative, which was the result of regular intelligence that we were seeing day in and day out. As you know, we have the regular intelligence briefings with the FBI. And the intelligence that the attorney general at that time, Attorney General Sessions, and I were seeing about theft of intellectual property from American companies and American universities and trying to figure out what more we could do about that. And the cases are one, building on the cyber side, a lot of the work that you did-

John Carlin: Tell me this, pausing there. So where you’re referring to is there’s a China initiative to tackle it, and you are the top official in charge of that initiative.

John Demers: Right. Yeah. That’s a department-wide initiative. And then we have a steering committee, and I’m the head of that steering committee and have focused a lot of my time on this issue of Chinese espionage, including political espionage. But a lot of it is private intellectual property espionage. CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 14 of 24

So part of it is building on the work that you did, when you brought the charges against the Chinese people’s Liberation Army actors for hacking into a variety of US companies to steal intellectual property-

John Carlin: It’s nice to be on this side of the microphone, asking questions about that because I have gotten the occasional question, what were you thinking, bringing charges criminal charges against members of a nation state, and I’ve noticed you have brought some similar charges. And so, if you can just walk through why use the criminal justice system as a tool for cases where it’s unlikely that you’re going to get the cooperation of the foreign nation, particularly when you’re indicting their military, so they may not see a courtroom here.

John Demers: Well, I don’t know what you were thinking, but what I’m thinking… no, so look, two different kinds of things. One are the cases that you just described. The other are a lot of the insider threat cases, which are more traditional cases where you can actually detain the person and charge them and arrest them and put them in jail. But in the case you’re talking about, in the cyber cases by foreign government cyber actors who are located outside the US, and you’re unlikely ever to get any of them, why do this?

And I think there are several answers. One is that they play a very educational function, these indictments. They, one, show the nation state, which prizes anonymity. That is one of the things that people prize about the internet is at least the sense that they’re anonymous, although they should be aware that you are rarely anonymous on the internet. But that we can figure out, we can attribute to the nation state who has done the activity, and that we’re going to call them out on it.

So we’re also trying to set up a system of norms. And so the norm I think there, that you started to vindicate, that we’ve been building on, is it is not proper for a nation state to engage in commercial, intellectual property theft. We understand that nations have engaged in political, military espionage for thousands of years. And if you look at our charges, you’ll see that we have not charged that kind of activity, even though we’re quite aware of it, and we try to combat it in other ways.

But when we see them do things like the North Koreans robbing banks via the internet, or we see the theft of intellectual property, as we were just talking about-

The theft of intellectual property, as we were just talking about, we are going to bring a case to set down that marker with these other countries. Not just for those countries, but also for other countries who might be watching and saying, say a smaller country, “Well, if China could try to develop its economy by stealing intellectual property from American or CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 15 of 24

European companies, maybe that’s a good way for me to do it.” So we’re trying to set up the norms. A part of that is getting foreign governments to join us in that attribution and in those indictments. And I think indictments are an almost uniquely credible way for the government to speak, because what we’re saying in the indictment isn’t, “Trust me, this is who’s doing what.” What we’re saying is, “I can go to court tomorrow, and I would love to go to court tomorrow if I could get my hands on one of those folks, I could go to court tomorrow and I could prove what’s in this indictment using only unclassified, admissible evidence in front of 12 jurors.”

And that’s sort of the heart of the American criminal justice system. And-

John Carlin: So you’re saying the indictments are more credible than Twitter?

John Demers: The indictments are more credible than me just saying something to you because I’m saying, “Hey, I could prove this to you-“

John Carlin: No, I often think the same thing and-And people underestimate, and it’s still true even in this troubled time, that one of the American strengths is the credibility of our criminal justice system, which is why it’s so important I think we respond to the complaints when it is not applied properly. But it is still for the world, the envy of the world in terms of a fair system.

John Demers: So I don’t know, you probably saw, I think it was just last month, the Germans charging a cyber criminal, a Russian cyber actor who we had already charged, with cyber intrusions in Germany, which they would not normally have. Or I should say it was the first time that the Germans have charged conduct by somebody like that. And I do believe that we are influencing people in saying that, “Look, even if you can’t get your hands on a person right away, this is a very proper way for you to call out misbehavior by a nation state or by a series of actors.”

And the last time we did a big cyber case, we had 12 other nation states join us on that same day, not with charges because they all have different criminal justice systems, but with joining us in the attribution of that activity. That was APT 10, a Chinese intelligence operation, hacking operation.

John Demers: So that’s Advanced Persistent Threat 10?

[Cross talk]

John Demers: Right, right. But when we charge… And the other thing I think that’s important there in terms of attribution is we don’t charge countries. We don’t charge units of countries. We don’t charge APT 10 itself. We charge CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 16 of 24

individual people who are really the fingers on the keyboard behind the hacking. And that’s how specific we can make that attribution. And we oftentimes have their pictures as part of that package when we roll it out.

John Carlin: And let me shift a little bit as we’re talking about that, because it raises the question, well, how are you able to collect such information? Whether it’s preventing a terrorist threat or a nation state actor? And one of the flip sides of our new technology is encryption and encryption is often what we recommend in order to protect companies, individuals, campaigns from dedicated nation state actors. But it was also called out recently in an investigation in the Pensacola terrorism case, an investigation that seems to have linked… And walk me through this a little bit. Is this the first, when was the last time we saw an international terrorist group, Al Qaeda, directly plot a terrorist act inside the United States?

John Demers: Well, what we saw there in Pensacola was the individual who ended up killing the sailors down there communicating with members of terrorist organizations outside the US. And I mean, we see that unfortunately more frequently than we would like. Although as we’ve said at the beginning, the nature of the terrorist threat is very different today than it was previously and a lot of the people we’re seeing are radicalizing themselves on the internet-

John Carlin: So would you put this then more, in the way of analyzing it, there are some where we think it was designed and planned and operated and directed from overseas into the United States and others where it’s really an individual here who’s kind of heading down the path of radicalization and they assist on the path of radicalization. Then I’ll put a third category of a little bit of hybrid. Someone’s walking down that path of radicalization and asks for help from someone outside the United States. How would you characterize-

John Demers: I mean, this is a little bit of both. I don’t think that we have said that we believe this person was directed by anybody outside the US. Certainly the planning, his own planning, began before he came to the US and participated in the program. And then while he was here in the US he was communicating with people outside the US letting them know what he was planning, whether he was kind of tacitly seeking their approval or wanting to get credit for what he was doing. All of that is still, I think, a little bit unclear. But very clearly communicating with people, with terrorists, outside the US. Other people who we’ve-

John Carlin: Let’s get into how… I mean, that’s incredibly important, but difficult to know. And going back to why the National Security Division was created in the first place, it was created because of what had been evaluated as a failure to be able to capture communications of individuals inside the CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 17 of 24

United States planning a horrific terrorist attack and their outside handlers and putting that information together. In this case, it seems like there was a different sort of technical issue, but you were able to overcome it. Can you walk me through a little bit why the attorney general called out in this case problems with encryption?

John Demers: Well, the fear, John, I think is maybe the one that you just put your finger on. So if NSD was created because of the failure to connect the dots problem, which is what it was identified as after 9-11. That the intelligence community, the law enforcement community, had not worked well together to connect dots that various pieces of them knew, that would have demonstrated the links between folks here in the US, folks outside of the US, and might’ve been able to show ahead of time the kind of plotting and planning that they were doing. There is a concern that as the terrorists have moved to encrypted platforms and encrypted devices, that we’re going to move to a pre 9-11 reactive stance from where we’ve been, which is a proactive, do the surveillance, find out what the plotting is, put the dots together, and disrupt the plot before it happens. Which is where we’ve been after 9-11.

A lot of what we’ve been able to do since 9-11 is a result of the use of laws like the Foreign Intelligence Surveillance Act to track the communications of terrorists, whether it was on email, or it was on phones, or it was texting or whatever it was, as those communications technologies evolved. The difficulty with the encrypted apps that we see various terrorist groups using is that we can’t see those communications in real time and we often can’t see them at least without great delay, even if they’re stored somewhere as they were in this case, when it was stored on his phone. And that means that our ability to disrupt terrorist activity is being degraded.

And I see that on a regular basis when I sign the FISAs, and those are the intelligence surveillance warrants on the foreign intelligence side that go to the foreign intelligence surveillance court for approval. But as you read through the affidavit, the probable cause affidavit-

This is the sworn statement from a law enforcement agent?

John Demers: The application… A sworn statement by the agent, by the FBI agent. You get to a part where you know that these two people are communicating, your target is communicating with a series of other people, but you don’t know any more what’s being said. Right? And the problem is twofold. One, you may end up surveilling someone for longer than you ought to be because actually what’s in those statements wouldn’t be threatening. Or two, they’re actually planning and you have no idea what they’re planning and what they’re saying. CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 18 of 24

So this is an issue that we’ve seen, it’s grown. In the last administration, there were various attempts to try to see how we could solve this issue of encryption and the Attorney General called it out in Pensacola and more generally. All with the philosophical view that there should be some way for the government, when a court authorizes it with probable cause consistent with the Constitution, to be able to see the communications of individuals who it suspects are terrorists.

John Carlin: Now, you helped architect in some respects in your prior stint in government, in the Bush administration, one of the key frameworks for the collection of foreign intelligence surveillance in the United States. You’ve had an opportunity now to see the fruits of the statute as you try to apply it. And there’s a reauthorization battle about certain parts of FISA occurring right now in Congress. And key, I know you’ve said this before as well, key to being able to use these authorities, which really in some respects are limitation actually imposed… People think of it as a positive authority, the Foreign Intelligence Surveillance Act, but really it was a limitation on the executive branch that came out of abuses.

John Demers: Right.

John Carlin: And we seem to be in an unprecedented period of lack of trust. And so how big of a problem is the current lapse in Foreign Intelligence Surveillance Act authorities, and how do you overcome the trust issue in trying to be given such powerful tools?

John Demers: So, the statute that I worked on last time around, which was the part of the foreign intelligence surveillance laws that deals with targeting non-US persons who are not here in the US, so people who we never think of as having Constitutional rights. But we want to target them here in the US because for whatever telecommunications reason, their communications are passing through the US.

John Carlin: That so called 702-

John Demers: The 702, yeah. Section 702 of FISA. What was interesting back then is FISA was seen as the answer to the problem of foreign intelligence surveillance and to ensuring, as you say, that the executive conducts foreign intelligence surveillance authority appropriately. Today the view is very much shifted and FISA is seen as the problem as opposed to the answer to the problem of surveillance. What’s actually up for reauthorization are three very limited parts of the FISA statute. And none of which have… Well, I should say one of which has been the subject of some controversy. But there’s no question that the statute, as it’s currently drafted, can’t be used in that controversial way. And that is that it was used to collect metadata from US telephone numbers. So that’s the numbers that CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 19 of 24

people dial, the numbers that are dialing them, and the time and the dates and that kind of information. It was used to collect it on a vast scale. That provision is not an issue and everyone has agreed that it can lapse. The program is not currently used by the intelligence community.

John Demers: So what’s left is an authority that is the national security analog to what’s a criminal grand jury subpoena. So you can get documents or records from hotels or phone calls, just the records of the phone calls, not the phone calls themselves. And second is something we call roving, which we basically use if someone tries to evade surveillance by changing telephone numbers and telephone providers during the course of a court authorized surveillance. And then finally something called Lone Wolf, which tries to address the issue of, well, what if we find a terrorist one day, only applies to non US persons, but what if we find a terrorist one day who doesn’t really have any affiliation with any terrorist group?

Now, obviously the reason why FISA writ large is controversial is because of the Carter Page FISA. None of those tools were used in the Carter Page FISA or were criticized at all in terms of their use. But in the moment, obviously when people are focused on FISA issues. I think Congress wanted to take a look at whether it shouldn’t amend other parts of FISA while it was reauthorizing these kind of common sense tools in FISA. And so as you know, and has been in the public, the Attorney General negotiated a package of reforms to FISA with the House, both the House minority on the House majority, and those reforms got passed through the House. And they do contain some significant but workable reforms defies FISA that I think would increase the accuracy of FISA applications, the completeness of the facts that are in there-

John Carlin: And you have a special role to play as the Head of the National Security Division in doing oversight of FISA, where there’s an inspector general report following up on the Carter Page FISA that found that the FBI was not implementing corrections that have been recommended by your own oversight division. And then also found that they were finding other errors that wouldn’t be found through the normal oversight. With the proposed reforms, and also with your own leadership of the division, what type of changes do you think should give people comfort that this is a tool that’s important, but it can also be used effectively and in a way that’s protective of people’s civil rights?

John Demers: So the FBI, together with us, has undertaken a number of changes to its processes. I think if you look at the Inspector General’s reports and in particular, the one on the Carter Page FISA, what you see is a problem not just of inaccuracy, but of the failure to be complete. That is there a lot of facts. It’s not that fact as stated in an application was false, like a sentence is false, but that there were other facts that should have been in that CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 20 of 24

application that would have shown light on the meaning of that sentence, and even undermined that sentence and certainly undermined the probable cause finding at the end.

And so we’ve been working with the Bureau to ensure that the agents are showing all of their cards, all of that information to the lawyers in the National Security Division, who are preparing the applications for filing with the FISA court. And we’ve been working with the court on this. Obviously the court is very focused on the integrity of its own proceedings and of the papers that are filed before it. So there have been a lot of changes at the Bureau on the process side, focusing on eliciting that information in individual applications. Also though on our oversight side, where we have been very focused, and you probably remember on the accuracy of the statements in an application, and reviewing a subset of those applications every year at the different field offices of the FBI, to make sure there was documentation to support all the statements in there.

We’re going beyond that now in a subset of those and looking at what we call completeness. So we’re going to look at the rest of the FBI’s investigative case file and see if there’s any information in there that should have been included in the FISA application at all. And we’re going to, we used to give people advanced notice of when we were going to come. Now, we’re going to do more surprise visits also as part of that. And so there are a number of changes I think that we’re already instituting as a matter of process-

John Carlin: As you’re doing that, do you have trust and faith in the current leadership of the FBI to help implement these reforms?

John Demers: The director and the other folks who are there, the Deputy Directors, the Executive Assistant Director for National Security, they are all focused on making these changes because I think they appreciate, as much as anybody, that if we’re going to keep these tools, we have to make sure that we use them correctly. And so we’ve been working hand in hand with them in making these changes. The Director has proposed more than 40 changes overall to this process to try to address these issues.

So the House bill would have made some additional changes, would have made some of this statutory. Would set up, I think very importantly, at the FBI an Office of Compliance that would really expand. There is currently a small office there. This would really expand its function and its mandate. Wouldn’t just apply to FISA’s, would apply more broadly to compliance with various FBI procedures and processes, and would require higher level accountability for certain subsets of applications, et cetera. I think it was a good package of reforms there. Unfortunately, when it went to the House, it was amended in a way that we- CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 21 of 24

John Carlin: In the House or in the Senate?

John Demers: Sorry. The Senate. It passed the House in a form that we supported. We were hoping it would pass the Senate in that form as well. But the Senate amended the bill and added a provision sponsored by Senators Lee and Leahy that would…

By Senators Lee and Leahy, that would significantly change the Amicus provisions of the FISA statute. The Amicus, they can be in any court, if somebody’s appointed by the court to help them decide legal issues. There currently is an Amicus provision in FISA, it was put in there a few years ago, and it’s been used maybe 10 or 12 times by the court when it’s dealing with particularly thorny issues.

John Carlin: Just to lay it out for folks, we put that in, in a statuary change in the last administration. These are complicated issues of law. There’s constantly changing technology, as well. The way the FISA court works, the lawyers for the government are really supposed to, because it’s an ex parte proceeding, go above and beyond where they normally would go and in briefing the court.

But, as we found so much, generally in our adversarial system, it can be helpful at times to have an independent voice, and that was supposed to be the Amicus. What is it that’s so problematic about the use of the Amicus with the Senators Lee and Leahy amendment that they caused administration to oppose it?

John Demers: When you say these are tough issues of law, the answer is, “Sometimes.” A lot of these are really just search warrant applications. They’re really very straightforward applications, probable cause decisions that judges make, both on the criminal side and on the national security side, hundreds of times a year, but you’re absolutely right. There are times when, because of the technology involved or just the legal issues involved, I think it has been helpful to the court to have an Amicus and they have both technical Amaechi who are non lawyers, but actually people who are technical experts and then they have legal Amicus, so the more traditional Amicus role.

John Demers: The Lee-Leahy bill would greatly expand the number of cases in which an Amicus was called for. It would make it presumptively necessary to have an Amicus in most cases. It has six or seven categories of cases, but some of the language is very broad. It doesn’t, I think, draw the distinction it should between US person cases and non US person cases. To give you a sense, every time we’ve had an Amicus, there’s been about a six to 12 month process to get a ruling out of the court, because at that point, you’re CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 22 of 24

talking about contested litigation, you have a briefing schedule. It’s back and forth.

John Carlin: What happens then? Are you saying that you’re trying to go up, there’s a spy or a terrorist, and there’s no ability to surveil for six months to a year?

John Demers: Right, but the court has been very responsible about when it’s used Amicus. I don’t think we’ve ever been put at risk because of that under the current system. Under this statute, our concern was one, it called for the use of Amicus in many more cases. Two, it changed the nature of the Amicus. The Amicus is no longer the friend of the court helping the court work through difficult legal issues. The Amicus is its own institutional player within the court. It’s almost like, and I’m going to borrow a phrase that somebody else used without naming him, a federal public defender role of Amicus. Somebody who gets in there is appointed by the court, but then is allowed to raise any issue that he or she sees. Normally the court says brief this.

John Demers: They can spot any issue. They can brief any issue. They have access to vast quantities of information, both at the FBI and at the court. It strips away the ability of the executive branch to withhold information from the Amicus on national security grounds, which exists in current laws since the last administration. Fundamentally what it’s doing is changing the whole nature of the Amicus role in the process and saying, “This person is about to be surveilled and needs an advocate, and in order to be an effective advocate, you have to be able to see the FBI’s investigative file. You have to be able to see all of this information.” The worry we have is several fold. One, the delay that it will cause. Two, the fact that some of what we rely on in these applications is hugely sensitive, from foreign countries, or from our intelligence agencies that they won’t share that information with the Bureau because they don’t want other people seeing it, if they don’t think access to it can be controlled. Those are some of the pause with the Amicus provisions. There’s also two other conditions.

John Carlin: Can I ask one quick question? The question is, under the new system, would it be like a federal public defender insofar as they’d have an ethical obligation to advocate in an adversarial manner, or would they be still like the current Amicus provision, where they’re providing an independent view to the court?

John Demers: They’re providing an independent view of the court, but they are much more independent from the court than they are currently. For instance, if the court, let’s say, grants the government’s application, currently, that’s the end of the matter. Here, the Amicus would have the ability to petition the court to seek review with the Foreign Intelligence Court of Review, and if they lost there, to seek certiorari to the Supreme court. Then, if CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 23 of 24

that’s denied by the court, their brief is supposed to be declassified in the same way that opinions of the court are currently declassified.

It’s creating this separate institutional structure. The other problems are really problems that I would hope could just be fixed through some language. For one, it says, for instance, that the attorney general, or the federal officer making the application, has to certify that all information in the government’s possession that’s material to that application has been given to the court. Now, as you know, literally that’s broader than our criminal Brady discovery obligations, because you don’t have to go to every agency in the government and say, “Hey, do you have anything about the Chinese espionage efforts in the US that might be material to this application?” That’s a concern that we have, that we could never make that certification. Then there’s one about accuracy procedures, another concern of the court finding and a certification that we have to make, that we would never make it.

At the end of the day, we thought this is just not operationally feasible anymore, so once that amendment passed in the Senate, we as a department, opposed the legislation as it’s currently drafted. As you know, it did pass through the Senate, back at the House, the House has requested a conference. I think the Senate has indicated at least informally that it would be willing to conference. That’s where things are right now.

John Carlin: In the interim, are we safe? Do you think we have the tools that we need while you work out this legislative debate?

John Demers: So far, I think so. There was a sunset provision in the business records provision. Of those three provisions I talked about, the biggest one that we use is the business records provision. You use that at the beginning of and an investigation to see, it’s not the most intrusive tool, we’re not listening to your conversations, we’re not reading your emails. We’re getting third-party business records to see if two people are connected to one another, if somebody visited a city at the same time another person visited a city, those sorts of things. There is a sunset provision in the business records law, that expired on March 15th, that says that if the investigation existed before the sunset, that we can continue to use business records in that investigation.

John Demers: That authority is very valuable to us upfront, obviously it will degrade over time because you’ll start to get new investigations that we can’t say existed as of March 15th. I think for now, we’re okay, but it doesn’t make for us to continue without these three very non-controversial authorities, which can have some significant value in our cases. They’re common sense authorities early on in case. For now, we’re okay, but we certainly would want them very much to be reauthorized. CAFE, “Cyber Space with John Carlin,” Featuring John Demers 06/05/2020 Page 24 of 24

John Carlin: In this time of pandemic, civil unrest, unprecedented cyber attacks, and also attacks on the fundamental integrity of our law enforcement institutions, and on prosecutors, what message are you giving to the folks in the National Security Division?

John Demers: I love the National Security Division. I would not have come back to this department or to the division if I didn’t. That’s in my message to them, a very supportive one of continuing those aspects of their work that have been valuable as the threat has changed, continuing the focus on foreign election interference on foreign influence, continuing our counter terrorism efforts, but also adapting them as we see domestic terrorism become more of a threat, and continuing the efforts on the cyber side and the intellectual property theft side, continuing to develop the relationships with the private sector and with universities.

My message for them has always been one that we’re constantly building on the work of the year before. I feel very much that I’ve been building on the work that you and David Chris did, and Lisa Monaco did, and that you all were building on the work that Ken Weinstien and Pat Rowan did, and that in this area, although the division has changed significantly, both in terms of size and focus in the 14 years since it stood up, that there’s also been a great continuity and stability, and that that’s the way it needs to be in an area like national security, because the threats that we’re facing, whether they’re from non state actors like terrorists, or state actors like China and Russia, these are actors who will come after us consistently year, after year, after year, and we have to maintain that consistent pressure on them equally.

John Carlin: John has been great having a chance to talk to you today. I hope people get a chance to hear exactly what you said, that there’s maybe a lot that can divide people on a range of issues, but there’s group of folks whose name are not known here, who have the benefit of your leadership, who are focusing on those who attack us because we’re American and don’t really care much about our beliefs, whether they’re terrorists or otherwise, they’re attacking what we stand. Glad to talk about a wide range of issues, where you’re thinking about how to protect us all. Thank you.

John Demers: Great. Thanks a lot, John, and thanks for all the work you did when you were here. Thank you.