> "First, we can reduce vulnerabilities. We in the government can equip you in the private sector to understand actors and cyber criminals and their techniques,

> "First, we can reduce vulnerabilities. We in the government can equip you in the private sector to understand actors and cyber criminals and their techniques, their tactics, and their procedures." - From [1] I realize the alphabet soup agencies don't have much communication between each other, but isn't the NSA hoarding vulnerabilities? Doesn't that go against this "let's work together" shtick? > "We have gotten good at minimizing your disruption, minimizing disruption and pain to your employees, and protecting your privacy and your legitimate concerns about competitive advantage. We will not share your data about employees or operations. We will have adult conversations constantly with you to tell you what we’re going to do with the information you give us, so that you can make risk-benefit decisions about what information to give us. We will not allow you to be blindsided, because we understand that if we do that, you’re not going to talk to us anymore...We need to make sure you understand how important it is to your competitive advantage to integrate the FBI into your risk-assessment plan. You spend a lot of time, no matter where your facility is, making sure the fire department has a basic understanding of the layout your building, so that in the event of a disaster they can save lives. I suggest you do the same with respect to your cyber threat and your risk-assessment plan." - From [1] This is absolutely nuts. Assuming they're even true about "minimizing your disruption" - which once they start they'll slam a gag order on you anyways so you can't even cry wolf about their "disruption" - the parallel to the fire department is completely unfit. The FBI's interests are not aligned with yours, he even admits as much in the article! Furthermore, the role of the fire department, in the case of a fire, is to save as many lives as possible. The FBI's role in response to an attack is to not save your data, nor is it to save your business, it's to find and punish the actors responsible. The fire department doesn't go after the arsonist, they're there for a fundamentally different reason. Giving the FBI "backdoor" access is akin to letting the FBI be the judge, jury, and executioner in your case. > "We believe in the FBI that we need a conversation. If at the end of the day the American people say, “You know what, we’re okay with that portion of the room being dark. We’re okay with”—to use one example—“the FBI, in the first 10 months of this year, getting 5,000 devices from state and local law enforcement and asked for assistance in opening them, and in 650 of those devices being unable to open those devices.” That’s criminals not caught, that’s evidence not found, that’s sentences that are far, far shorter for pedophiles and others because judges can’t see the true scope of their activity." - From [1] That could also easily be 650 regular American citizens who've done nothing wrong. The absence of evidence is not evidence, and this argument bears a striking similarity to the "nothing to hide" argument. [1]: https://www.fbi.gov/news/speeches/the-fbis-approach-to-the-cyber-threat https://www.fbi.gov/news/speeches/the-fbis-approach-to-the-c...