Amy Hess, chief of FBI's Operational Technology Division, admits using zero-day exploits to hack targets
Meet the woman in charge of the FBI's most controversial high-tech tools — In the aftermath of Wednesday's shooting rampage in San Bernardino, FBI teams recovered computer hard drives …
Context & Ripple Effects
Amy Hess runs the FBI's Operational Technology Division, the unit that builds and deploys the bureau's most sensitive intrusion tools, and her admission that it uses zero-day exploits against targets is a rare on-the-record confirmation of how the FBI hacks. That capability soon becomes the center of a national fight: months after San Bernardino, reporting shows the bureau paid an outside party for an undisclosed flaw to unlock the shooter's iPhone rather than use Cellebrite.
The same arc extends into law and personnel. Senator Wyden's attempt to block procedural-rule changes fails, giving the FBI authority to hack computers in any jurisdiction under a single warrant, and by mid-2016 the division is deploying malware written by a former Tor Project employee against Tor users.
First-order effects
- Hess's admission publicly confirms that zero-day exploits are standard FBI targeting tools, putting the Operational Technology Division's acquisition-and-use practices directly into policy debate at the moment the bureau's hacking powers are expanding.
Second-order effects
- The San Bernardino case shows the practical consequence: rather than disclosing flaws to vendors, the FBI buys them from private hackers, sustaining a gray market for exploits that leaves device makers like Apple unaware their products are compromised.
Third-order effects
- Capability is outrunning oversight: within a year the bureau wins warrant authority covering any US jurisdiction, and later assessments of the FBI's cyber posture describe fundamental reforms as never materializing — a pattern where offensive tooling scales faster than the rules governing it.
The trend: Government hacking is industrializing around stockpiled and purchased zero-days, with legal authority and vulnerability disclosure lagging behind the FBI's operational reach.