Playing to the Edge: American Intelligence in the Age of Terror (15 page)

I
was certainly NOT a cyber pioneer. I’m not even a technologist. I still hand the TV remotes to the grandkids when they’re around.

“Daniel, make the TV remember this show.”

Decades earlier—when computers meant punch cards, raised floors, and cold, windowless rooms—I had intentionally blown a test in air force tech school to avoid that line of work.

But now, in 1996, I was thrust into dealing with and understanding the cyber domain when I took command of the Air Intelligence Agency (AIA) in San Antonio, Texas.

Immediately prior to that, I had been chief of intelligence (J-2) for all US forces in Europe (EUCOM), and at that time we were deeply involved in supporting UN peacekeeping units in the third Balkan war of the twentieth century. I had been an attaché to a Balkan country and spoke a Balkan language (Bulgarian), so I had some understanding of the historic depth of that conflict.

Winston Churchill once wisely observed that “the Balkans produces more history than it can consume.” That certainly matched my experience.

When I left EUCOM and headed to Texas, I was leaving behind knowledge of, and responsibility for, a conflict medieval in its origins and Byzantine (almost literally) in its complexities, to take command of a unit on the cutting edge of a whole new type and domain of warfare.

Thank God I had a great staff in Texas. They began to educate the new guy with the fervor of those attempting a conversion.

And the first article of faith at AIA was simply that cyber was a “domain.”

“You know, General. Land, sea, air, space,
cyber
.”

Actually, when you convince a GI that something is a domain, a lot of things click. He doesn’t clutter his mind with extraneous concepts like networks, bandwidth, and the like. It’s a domain, an operational environment, and—just like all the other domains—it has its own characteristics. This one is characterized by great speed and great maneuverability, so it favors the offense. It is inherently global. It is inherently strategic.

And, my new staff added, we need to treat it like we treat the other domains. America expects us to operate there. Just like the other domains—air, for example—we’re going to use it for our purposes when we want to and deny its use to others when we choose to.

At least that’s going to be our mission. The language of air dominance and air superiority, which easily tripped off our tongues as airmen, quickly became information dominance and information superiority in our new lexicon.

AIA worked to make this more than just words. The first audience we had to convince was the air force itself. In September 1997 we had the chance to demonstrate what we wanted to do to a gathering of air force three- and four-stars. The chief of staff, General Ron Fogleman, invited me to Scott Air Force Base in Illinois for his semiannual meeting, called Corona Top, to give a presentation about new technologies, new weapons, and new modes of warfare. Fogleman gave us an unprecedented two hours on the agenda.

I would be onstage to give the background to our approach and a touch of the doctrine we were debating, but I would also be connected by
video link to my headquarters and operations center in San Antonio. We were going to demonstrate live some of the tools then under development.

We almost met with disaster when a south Texas thunderstorm hit my headquarters on Security Hill just before we were about to begin. Through heroic efforts we came back online just in time, and all the technology worked as briefed. In one example, we remotely disabled some workstations, and in another I demonstrated how we could spoof a radarscope to show one thing while the actual aircraft it was following was doing another.

Not bad. Senior leadership was impressed. No one volunteered any money from his fighter or bomber programs, but they were impressed. At least we had planted a few seeds.

Back in San Antonio we had already retooled our traditional operations center into an Information Operations (IO) Center. There I was routinely briefed on broad indicators of action in the cyber domain, the status of air force networks, the character of attacks against us. We also regularly deployed information warfare support teams to air force tactical units to better prepare them (and to spread the gospel).

These thoughts and actions in San Antonio ultimately had outsize influence. Not much more than a decade later Bob Butler—the talented young lieutenant colonel who headed up my IO center—was now the deputy assistant secretary of defense for cyber policy, and those nascent concepts from San Antonio had pretty much become American military doctrine. Butler worked for Bill Lynn, the deputy secretary of defense, who wrote a seminal piece in
Foreign Affairs
in the fall of 2010 that brought the concept of the cyber domain and cyber dominance into full public view.

“As a doctrinal matter,” he declared, “the Pentagon has formally recognized cyberspace as a new domain of warfare. Although cyberspace is a man-made domain, it has become just as critical to military operations as land, sea, air, and space. As such, the military must be able to defend and operate within it.” It was as if he had copied our notes from Texas in 1996.

Our ideas had stuck, but in retrospect we had admittedly been living
within a unique culture and underappreciated that an entire generation was growing up outside our fence-line thinking of this domain as a global commons, a pristine playground, not a zone of potential conflict where powerful nation-states would want to work their will.

American doctrine doesn’t militarize this domain more than many other nations around the world have, but we certainly have thrown a lot of resources into our efforts, and our natural transparency and casual use of language expose us to charges that we have.

Go back to Lynn’s article. The most telling line in the whole piece was the one at the bottom of the first page:
William J. Lynn III is U.S. Deputy Secretary of Defense
. The seminal American thought piece on cyber wasn’t written by the deputy attorney general or deputy secretary of state or deputy secretary of commerce or even by the president’s science advisor. It was written by the deputy secretary of defense. People outside this country notice things like that.

So do people inside this country. There was little coordination of Lynn’s 2010 article in the interagency process in Washington. There were a few discussions with cybersecurity czar Howard Schmidt at the White House, but not much beyond that. The Department of Homeland Security, up on Nebraska Avenue, and the Department of State, over on C Street, were as much surprised by the article as some foreign audiences.

They pushed back. Within six months of Lynn’s article, Jane Holl Lute, the deputy secretary of Homeland Security, coauthored a piece in
Wired
that proclaimed, “Cyberspace is not a war zone.” Rather, she wrote, “cyberspace is fundamentally a civilian space—a neighborhood, a library, a marketplace, a schoolyard, a workshop—and a new, exciting age in human experience, exploration and development.”

Michele Markoff, the deputy coordinator for cyber issues at the Department of State, would tell anyone who would listen that our emphasis on a new domain that was (allegedly) severable from the physical realities that comprised it (servers, for example, had to be somewhere in physical space) was making her work very difficult.

Markoff was tirelessly trying to create international norms for cyber behavior. DOD’s construct of a separate domain tended to mute the traditional principles and responsibilities of sovereignty, and it wasn’t helping. From Markoff’s point of view, DOD was actually focusing on a physical object, say a server in Malaysia, not on some abstract node in a near-mythical new universe.

Audiences also had to notice a section in Lynn’s piece entitled “Leveraging Dominance,” as well as his wonderfully alliterative and somewhat ominous description of something he called active defense: “part sensor, part sentry, part sharpshooter.” You can imagine how that last word was read in many foreign capitals.

The debate continues today. Not long ago, I was sitting in front of a Skype screen in Colorado arguing via video link with author Jim Bamford, who has made a living writing unauthorized books about NSA. One of my distant NSA predecessors, Linc Faurer, wanted to have him arrested over his first opus,
The Puzzle Palace
, when it hit the streets in 1982.

I tried to more productively cultivate Bamford two decades later when I was director, even inviting him to dinner and allowing him to have a book signing in NSA’s National Cryptologic Museum. It didn’t work. When the Terrorist Surveillance Program was made public in late 2005 (see chapter 5), he joined an ACLU lawsuit against NSA.
*

The Skype debate was for a TV trade audience in Beverly Hills on behalf of PBS hyping an upcoming
NOVA
special on NSA. Bamford was a coproducer and was arguing that America had tragically militarized the cyber domain through actions like Stuxnet, which he described as an American cyber attack on the Iranian nuclear facility at Natanz. America’s intemperate behavior, he claimed, had legitimized Iranian responses against the giant oil company Saudi Aramco and against American banks. The Internet was now a free-fire zone, and it was our fault.

I responded by defaulting to my “land, sea, air, space, cyber” construct. “The cyber domain wasn’t the only global commons on the list,” I said. “The maritime domain had been such for eons. And no one objected to the existence of navies. In fact, a good case could be made that navies were essential to keeping that commons common.”

I could have added that the cyber domain has never been a digital Eden. It was always Mogadishu. The president of Estonia, Toomas Hendrik Ilves, knows something about this. His country’s Internet collapsed in 2007 under attack by “patriotic Russian hackers” (read criminal gangs repaying a debt to the Russian state for the freedom of action they enjoy there) after Tallinn tried to move a Red Army memorial from downtown to the suburbs.

President Ilves has a wonderful way of capturing all this. He says that, lacking a Lockean social contract in the cyber domain, what we have is an almost purely Hobbesian universe, a universe where Hobbes’s description of ungoverned life as “poor, nasty, brutish and short” really applies. There is simply no rule of law there.

I have often compared the current evolution of cyberspace to the last great age of globalization, the centuries of European discovery. That era, for all its accomplishments, jammed together the good and the bad and the weak and the strong in ways that had never been experienced before. What the Europeans got out of it was land, wealth, tobacco, and syphilis. Much of the rest of the world got exploitation of entire populations, global piracy, and the global slave trade. We are in a somewhat analogous condition now except that today’s connectivity isn’t at ten knots with a favoring wind. It’s at 186,000 miles per second. It didn’t take Stuxnet to make the cyber domain a very dangerous place.

 • • • 

T
HESE DEBATES
were all in the future when I arrived at NSA in March 1999. I had had only eighteen months in San Antonio, but the people there were cutting edge and the education they gave me was invaluable when I got to Fort Meade.

And it was invaluable right from the beginning. Keep in mind the purpose of the National Security Agency. NSA’s job was all about communications. Historically that was electronic data in motion: global high-frequency communications, shorter-range microwave signals, photons and electrons moving along a cable.

Agencies like CIA handled other materials—human sources, purloined documents, pilfered codes—more or less physical data sitting at rest.

The division of labor was clear. Electronic data in motion—NSA. Physical data at rest—CIA. But the new digital domain had created a different state of nature: electronic data at rest.

It’s easy to forget how novel this really was. Since Marconi we had been turning physical data into an electronic form only to move it. I still remember my days at a fighter wing in Korea as recently as the 1980s where, to send a message, we would type it out with something called an OCR (optical character recognition) typewriter and walk it across the street to the communications center, where it would be scanned, turned into electrons, and transmitted to Washington. Once it arrived there, the electrons would be converted back to a printed page that was thrown into a pigeonhole, where it awaited a clerk to come pick it up.

That now sounds archaic, and it is inexplicable to our children. By the late 1990s we were all moving data routinely (like e-mails) that would never exist as anything but electrons, and we were all storing data in electronic form, much of which—documents, spreadsheets, files, notes—would never be electronically transmitted.

The former was clearly a communication (electronic data in motion) but the latter, well, that was something new. To NSA it was electronic and hence fair game. To CIA it wasn’t moving and hence was equally fair game.

This bureaucratic issue didn’t end up in a death match across the Potomac between the two agencies. President Bush settled it in a memorandum after 9/11 declaring it fair game for both agencies, with NSA treating it in accordance with SIGINT rules and CIA handling it like HUMINT.

But the fact that it was an issue at all says a little about American
intelligence bureaucracy and a lot more about how disruptive the digital age was for American intelligence.

At NSA we had to develop a whole new language. We were moving to
active
SIGINT, commuting to the target and extracting information from it, rather than hoping for a transmission we could intercept in traditional
passive
SIGINT. This was all about going to the
end point
, the targeted network, rather than trying to work the
midpoint
of a communication with a well-placed antenna or cable access.

We also knew that if we did this even half well, it would be the golden age of signals intelligence, since mankind was storing and moving more and more data in digital form with each passing day.