The FBI on Sept. 9 released a new cyber strategy aimed at helping the bureau keep pace with the speed and scale of cyber threats by bringing its law enforcement, intelligence, and national security authorities to bear on defending the nation’s critical infrastructure.
The 17-page strategy lays out a bureau-wide approach to cyber operations under four pillars. The FBI says increasingly complex threats are making coordination across government and the private sector more critical.
“The cyber operational environment is becoming untenable for any one organization to defend alone,” Brett Leatherman, assistant director of the FBI Cyber Division, said at the 17th Annual Billington Cybersecurity Summit in Washington, D.C., where he announced the strategy.
Leatherman said the strategy is intended to bring greater consistency to cyber operations across the FBI’s 56 field offices. Threat teams within the Cyber Division are also developing strategies focused on specific adversaries, including Russia, China, Iran, and North Korea. Most will remain classified but align with the new strategy, he said.
Pillar One: Investigate, disrupt, and impose cost on cyber adversaries
The first pillar of the strategy focuses on how the FBI will investigate cyber adversaries, disrupt their operations, and impose costs on those targeting the United States in cyberspace.
Under the strategy, FBI investigations and intelligence analysis will seek to identify the people, institutions, infrastructure, money flows, and tools that enable adversaries to carry out cyber operations. The bureau will use that information to target the resources adversaries rely on and disrupt their campaigns.
In a video posted on X announcing the strategy, Leatherman said the approach “takes the fight to the adversary.”
“Every adversary depends on people, structure, tools, and money,” Leatherman said. “Where we can reach them, we arrest them and extradite. Where we cannot, we take their infrastructure, seize their funds, and dismantle their tools.”
Pillar Two: Supporting victims
The strategy’s second pillar focuses on supporting cyber victims through faster intelligence sharing, direct notifications, and greater engagement through the FBI’s 56 field offices.
“Behind every cyberattack [there] is a victim,” Leatherman said at Billington. “Our job is to prioritize victim engagement through our 56 field offices.”
As part of that effort, the FBI plans to pursue urgent, automated sharing of cyber threat intelligence with critical infrastructure owners and trusted private-sector partners. The bureau will also continue proactively notifying organizations that have been compromised or face an imminent cyber threat.
The bureau pledged to protect the privacy and data of cyber victims. The strategy says the bureau will restrict collection to evidence and intelligence needed for law enforcement actions and technical disruptions and use the least intrusive investigative method feasible.
Leatherman said the FBI often does not need victims to provide sensitive data or intellectual property. Instead, he said, investigators may need technical indicators that can help them understand an incident and support containment and eradication.
Pillar Three: Expanding partnerships
The third pillar focuses on expanding and deepening the FBI’s relationships with government agencies, international allies, state, local, tribal, and territorial partners, and the private sector.
“Nobody does this alone,” Leatherman said at Billington. He said the private sector is an operational enabler for the FBI’s cyber work and that the strategy is intended to reduce gaps with industry in support of operational outcomes.
The strategy calls for the FBI’s field offices to build direct relationships with industry partners in every region of the country, establishing communication channels and points of contact before a crisis occurs. The bureau said, “two-way information sharing can help detect adversary activity, notify victims, and disrupt malicious infrastructure sooner.”
Additionally, the FBI will deliver cyber intelligence to the National Security Council, the Office of the National Cyber Director, policymakers, and other government leaders through official internal and external channels.
FBI Cyber will also coordinate with U.S. government partners, including the Office of the National Cyber Director and the National Security Council.
Pillar Four: Building cyber capabilities
The fourth pillar focuses on strengthening the FBI’s cyber workforce, technical tools, and use of artificial intelligence (AI).
Through its Field Cyber Resources initiative, FBI Cyber will distribute personnel based on investigative and operational needs. The bureau will also continue technical and operational training and develop or acquire new capabilities for investigating, attributing, and disrupting cyber adversaries.
The strategy also calls for using AI to scale cyber operations.
Leatherman said the FBI plans to use AI to support defensive and offensive operations and help its workforce target cyber actors.
Leatherman said adversaries are improving their capabilities through emerging technologies and companies that enable access operations against networks.
“We have to do the same thing,” he said.