Playing to the Edge: American Intelligence in the Age of Terror (3 page)

Barbara was badly treated in a November 1999
New Yorker
article by Seymour Hersh, he of My Lai exposé fame and chaser of real and imagined scandals ever since. The lengthy article was a pretty stern critique of where NSA stood (accurate enough), but it then singled out McNamara. “Hayden gets it,” Hersh quoted one intelligence committee aide. “But he’s parachuted in there, and faced with a deputy director whose job is to foil what the director wants to do.”

Not true, but Barbara would never be a ruthless change agent; she was approaching three years in the job, and as a thorough Anglophile she was happy to end her career representing us in London to our British partner.

There was talent in the senior leadership, but no obvious choice for a new deputy, and there was no one in the lot who was close to being the bomb thrower I wanted. So I scoured the alumni association for anyone who had left recently and who had left angry. Bill Black’s name quickly popped up. Bill had been my predecessor’s special assistant for information warfare (see chapter 8) and had resigned from the agency three years earlier. Since entering NSA in 1959, he had been at the heart of the agency’s traditional mission targeting the Warsaw Pact, but he had been frustrated by the slow pace of transformation to a new age. He was also a bureaucratic knife fighter; if he was deputy, I knew he would have my back.

I invited Bill to lunch at a nondescript Korean restaurant outside the back gate of Fort Meade. Over bulgogi and kimchi we covered the state of the agency and his views on what could be done about it. He was firm,
but not especially vindictive. It went well. My executive assistant, who was with us, later said that I was the most relaxed she had ever seen me during the meal.

We chose the off-base Korean restaurant to keep all of this quiet. But NSA as a social group permeates eastern Maryland. The next day Bill received an e-mail from a retiree in California asking him how his lunch with the director had gone.

Bill was the choice, but I had one last question. I invited him to my base quarters for a Sunday dinner for just the two of us. My wife was traveling, so I opted for simple roasted vegetables over couscous.

I told Bill that I wanted him to be the deputy, but I had one concern. I knew he could make things happen; he was notorious for his back-channel expertise. “But, Bill,” I said, “we’ve got to institutionalize this. This has to work even if you and I don’t show up for work.” He agreed. We had a deal.

Bill was a great choice. He stayed on for six years and served as acting director after I left. I owe him a great debt. After 9/11, though, in a private moment, I confessed that up to then I should have been thanking him for being there. “Now,” I said, “you need to thank me.” He didn’t argue. He would have died of frustration if he were confined outside after the attack.

To reinforce the shake-up, we hired from the outside to create crosscurrents within our own culture. We were being intentionally disruptive. At the time, I didn’t think there was sufficient expertise in the private sector to delegate mission responsibility to newcomers from the outside, so I didn’t. The closest I got to that was the 2000 decision to outsource our IT to a private consortium in the $2 billion ten-year Groundbreaker program.

In retrospect, I may have missed an opportunity, since American industry was already breaking new ground in what came to be called the cyber domain, and the more I learned, the stronger the parallels became.

But my caution certainly did
not
apply to a host of support tasks. The new chief financial officer came from Legg Mason, the Baltimore investment firm. We got our new inspector general via an ad in the
Wall
Street Journal.
We created the position of senior acquisition authority and filled
it with a former deputy assistant secretary of the navy with thirty-five years of acquisition experience. The chief information officer came from the Federal Trade Commission (and NASA). The chief of legislative affairs had been an executive assistant on the Hill for five years.

We even went outside for some direct mission support tasks. Working through a member of the advisory board who was an Academy Award winner in Hollywood, we recruited our new chief of research from the R&D department at Walt Disney Imagineering.

Another advisory board member with deep experience in telecommunications hooked us up with a tech- and business-savvy outsider who became our chief of IT. I interviewed him personally, without fanfare, then simply introduced him and his mandate to a meeting of seniors still trying to decipher the IT meltdown of January 2000.

There was nothing easy about this. We had to transform, but I didn’t want to make war on the agency either, and I certainly did not think that I was the anointed one sent to bring it salvation.

I think I was open to advice, but I had to decide on my own. Folks were candid and insightful, but in an organization as compartmented as NSA, most people viewed issues from their own vantage point and not the broader field of view I had from my office. We had to get off the
X
of inaction,
*
and waiting to build consensus or accommodating all concerns would have been a killer.

I had to be really careful with my language. I had been at NSA less than a year; a lot of people had been there (and usually nowhere else) for decades. I always used first person plural: “We’re going to do this.” “We’re going to try that.” Never first person singular. And never, never, never second person. The routine use of “you” would have deepened the chasm that was always threatening to open between me and a talented workforce.

Beginning in November 1999, I communicated regularly in a series of director’s e-mails that we called DIRGRAMs to announce and explain
changes and keep an open line for comments and critiques in return. By the time I left in spring 2005, I had issued over four hundred. This made sure that the message got through unfiltered and probably accelerated our pace, but as a career military officer I knew that I was jumping the chain of command, communicating directly with all echelons, eroding the real or perceived authority of intervening layers of leadership.

 • • • 

N
OT ALL OF
OUR PROBLEMS
were internal or self-inflicted. We also had a public relations problem that threatened our future. Even as some members of Congress and outside experts were accusing us of incompetence and being on a path to deafness, some civil libertarians and European parliamentarians were characterizing us as omniscient, stealing industrial secrets and invading personal privacy. The catchphrase for all of this was Echelon, to the Europeans an Anglo-Saxon cabal to steal economic advantage; to groups like the American Civil Liberties Union, “[T]he government . . . once again spying on American’s private communications.”

Never officially or precisely defined, the concept of Echelon was a convenient all-purpose bogeyman for any critic who wanted an audience. The transatlantic handwringers seemed to reinforce one another even if their grievances weren’t exactly the same.

The American handwringers were more important to us. We had to take them head-on. We needed more money, and we weren’t going to get it unless the American people and their elected representatives had a level of trust in us. Trust was especially important, since we were telling our overseers that the signals we were going to chase were no longer confined to isolated target networks, but were on international networks commingled with other, innocent communications, including those of Americans.

As for the Europeans, they were a self-righteous nuisance; I refused to meet with them. They spent more time researching us than their own security services, several of which actually did conduct economic espionage. And the reason that they researched us was that American
espionage is far more transparent than European. Talk about looking for your car keys under the lamppost. I suppose we were a little contemptuous. Looking back now, that still feels about right.

We convinced Porter Goss, chairman of the House Intelligence Committee, to hold an open hearing on all this. In April 2000, George Tenet and I testified, as did Congressman Bob Barr, a Georgia Republican passionately committed to civil liberties.

In front of a packed gallery for a full two hours, both George and I freely admitted that we collected information on foreign businesses when it came to things like arms sales, chemical trading, money laundering, and drug trafficking. But we adamantly denied that NSA spied on European companies to collect industrial secrets and pass them on to US companies.

I talked about the challenges NSA faced because of the volume and variety of modern communications and the velocity with which they changed. Anticipating the cyber challenges then beginning to unfold, I said, “Our ability to collect may have increased, but it has increased at a pace far slower and smaller than the explosion of the ones and zeros that are out there.”

With regard to US privacy, I stressed our lawfulness and observed that if Osama bin Laden crossed the bridge from Niagara Falls, Ontario, to Niagara Falls, New York, provisions of US law would kick in, offer him protection, and affect how we could cover him. At the time, I was using this is a stark hypothetical. Seventeen months later it was about life and death.

 • • • 

E
VEN IF WE SUCCEEDED
in building some public trust and squeezing a few more dollars out of Congress, we still had the technical challenge of signals that were growing more complex, more numerous, and more encrypted. How to tackle that?

Our answer was Trailblazer. This much-maligned (not altogether unfairly) effort was more a venture capital fund than a single program, with
our investing in a variety of initiatives across a whole host of needs. What we wanted was an architecture that was common across our mission elements, interoperable, and expandable. It was about ingesting signals, identifying and sorting them, storing what was important, and then quickly retrieving data in response to queries.

And all of this at speeds and volumes no one had ever seen before. One very prominent captain of the IT industry visited me in my office one evening, and when we explained our volume challenge to him, he slowly exhaled before observing that what we were discussing was bigger than anything he had ever encountered.

Despite his caution, we still believed it was important to engage industry on this, even though it stretched industry with its technological challenges and stressed our ability to manage a contract with deliverables beyond just billing for time expended and materials consumed.

Our program office had a logical progression in mind: begin with a concept definition phase, then move to a technology demonstration platform to show some initial capability and to identify and reduce technological risk. Limited production and then phased deployment would follow.

It looked good on paper, and there is no doubt that we got a lot out of the effort, more than just by-products like Velcro and Tang in NASA’s space program. Trailblazer advances were integrated into mission systems, and they contribute to this day.

But there is also no doubt that the overall results were disappointing and took far longer than we wanted. We found that when we went to industry for things they already knew how to do, we got impressive results. When we went to them for things nobody had done yet, we found that at best they weren’t much better or faster than we were. And that was true even with a team that included such defense giants as SAIC, Boeing, CSC, AT&T, and Booz Allen Hamilton.

We were also trying to do too much, too quickly. Trailblazer comprised multiple moon shots. We ended up like a lot of big federal IT programs—like the FBI’s Virtual Case File and DOD’s Navy Marine
Corps Intranet. We would have been better advised to pick our spots and work incrementally, trusting to spiral development to eventually get us to where we wanted to be.

We also had to deal with guerrilla warfare. There was a group of talented technologists within the agency who had developed a tool, Thin Thread, to collect and sort metadata (the facts of a communication such as number calling, number called, time, duration, and the like) and then to point analysts to the rich veins of SIGINT ore within a mountain of information.

Thin Thread wasn’t the program of record when I arrived at the agency. I didn’t make it the program of record during my time there, and neither did my successor. We all could have been wrong, of course, but we had our reasons.

Thin Thread technology included e-mails, which was very good, since the volume of global e-mails was about to take off. It had a good packet processor, which meant it could assemble the individual packets that comprise e-mail messaging. It also had very good “session reconstruction,” which enabled it to put communications back together from the individual packets.

A third aspect of Thin Thread was software to actually detect meaningful traffic via the metadata of a massive communications stream (e-mail or voice). By studying the pattern, frequency, and length of calls, the system intended to point to the communications whose
content
should be explored. Of course, all data streams are different, so the system had to be trained within a particular data stream to pick out the valuable from the other information flowing by.

We gave it a try and deployed a prototype to Yakima, a foreign satellite (FORNSAT) collection site in central Washington State. Training the system on only one target (among potentially thousands) took several months, and then it did not perform much better than a human would have done. There were too many false positives, indications of something of intelligence value when that wasn’t really true. A lot of human intervention was required.

As a FORNSAT site, Yakima was also dealing with a data stream nowhere near the volume of modern cable traffic. A good rule of thumb for FORNSAT speed is about 150 megabits per second. Microwave intercept pushes you over 600. We expected cables, where most traffic was now going, to have multiple strands of fiber, each working at a minimum of 10 gigabits per second, each about 70 times the FORNSAT pace. Even if Thin Thread had performed better, the requirements of space and power for the system would have made applying Thin Thread technology to the mass data flows of cable cost-prohibitive.