Playing to the Edge: American Intelligence in the Age of Terror (8 page)

NSA has lost twenty-three cryptologists since I asked my question. Not a new phenomenon. The first US soldier killed in Vietnam was a SIGINTer, Specialist 4 James T. Davis, a DF (direction finding) specialist in the army’s obscurely named Third Radio Research Unit.

As a DOD organization, NSA was pretty well prepared to sustain and support the military people we sent forward. We were far less prepared to support their families, and most of this was an entirely new experience for NSA civilians. My wife, Jeanine, had already been working on family issues in the summer of 2001, and now she took under her care a program we called Family Battle Rhythms. We talked to family members about services that were available to them, techniques to cope with stress, and opportunities to get acquainted with people in similar circumstances.

And this didn’t just apply to the families of folks who were physically deployed. NSA had a large population of people we called “deployed in place”—folks who perhaps slept in Maryland or Georgia but who worked twelve hours a day in Iraq and Afghanistan because that’s where their headsets took them. It was a new kind of stress: life-and-death circumstances at work, and a continuing responsibility to drive the soccer carpool that evening. We did what we could.

People had to take care of themselves, me included. After I showed up in an Iraqi deck of cards identifying American targets, I got a security
escort every time I left base. I wasn’t entitled to a car and driver, but we did get a chase vehicle. No spontaneous trips after that, but the security guys were friendly and professional.

And there were a few times I was glad they were there. In September of 2004 I attended a Steelers game in Baltimore with my family. Baltimore is a friendly city, unless of course you are decked out in Steelers black and gold on game day. Ravens fans were frisky, too, having won that day. As we were trying to leave the stadium parking lot, some rowdy fans gathered around our car slapping their faces to the windows. Until the loudspeaker in the SUV behind us bellowed out, “Slowly move away from the vehicle!” No problems after that.

I tried to keep my own battle rhythm manageable. I brought tons of work home but avoided the office on weekends. If I went in, a whole ecosystem would have accompanied me.

I kept to my running and even ran the Pittsburgh Marathon in May 2003. More credit to Pete, my security guard, though, who trained with me and then ran the race armed with his weapon in a small satchel pack.

The Iraq war was tough—tougher and longer than even we anticipated. At the tactical level, though, SIGINT put in an impressive performance. In April 2005, as he was leaving command in Anbar Province, Lieutenant General John Sattler, First Marine Expeditionary Force commander, sent a message to NSA headquarters thanking the agency for its work. He noted three recent captures set up entirely by SIGINT and then praised NSA “willingness to partner with our organic SIGINT enterprise [and] most importantly your willingness to put SIGINT based reporting in the hands of operational commanders at the secret level.”

Not bad. We had demonstrated to our enemies that if you radiated on an American battlefield, you were likely to die.

Less certain, though, was our ability to inform broad questions of policy, like the decision to invade Iraq in the first place.

And then there was still that prickly issue of finding terrorists already inside the American homeland.

T
wo days after 9/11, I walked into the large director’s conference room at NSA. The chairs around the semicircular conference table and the rows of stadium seats behind them were empty. In fact, the room was empty except for my public affairs officer, Judy Emmel, and a few technicians.

I was going to speak remotely to the entire workforce, my first chance to do that since the evacuation order two days earlier.

Much of the speech was predictable. We are going to have to play defense for a while, I said. We’ll have to characterize “what has happened” and “identify signs of what may happen.”

I urged patience. “While we will always be alert for warning, our emphasis will shift over time. I think you all understand that the nation does not intend to play just defense forever.” Predictable enough, I thought, although we had not yet received specific word on what the game plan might be.

I acknowledged that many of their loved ones might have been urging them not to come to work that morning, fearing for their personal safety.
I urged them to look on the bright side. “Right now, more than three hundred million Americans wish they had your job.”

I ended with a thought that had been troubling me since the attacks: the preservation of American freedom. The people at NSA (including me) come from the same political culture that motivates all Americans (a reality often ignored by ideological purists in the periodic debates we have over security and liberty) and my liberal arts education had reinforced the idea that freedom was indeed a fragile thing.

I reminded our folks that “it’s not just our safety but our character as a free people that is at stake here. Every nation is required to balance the needs of security with the needs of liberty. Thanks to James Madison and a bunch of his friends, we have planted our flag well on the side of liberty in that difficult question. But if a nation feels itself threatened, feels its children are at risk, it tends to move its banner closer to the requirements of security than those of liberty. That’s what all of us feared when we told our families that we would wake up Wednesday to a different America. You and I have a role here. You and I can and will preserve American liberty and we will do it by making America feel safe again.”

I often think of that speech, which I have kept, when I hear the harshest of our critics act as if we in the intelligence community somehow think less of American liberty than they do.

Right after 9/11, I did a lot of things that were within my own authorities. For example, almost immediately I shifted the standard for minimization of US identities in calls coming out of Afghanistan.

In covering foreign intelligence targets it is not uncommon to pick up communications to, from, or about an American. When that happens, NSA is allowed to continue to collect and indeed to report the information, but the US identity—unless it is critical to understanding the significance of the intelligence—is obscured, or what we call “minimized.” The name of an individual, for example, becomes “US person number one.”

If intelligence customers believe that the identity has to be unmasked
to understand the intelligence, they can ask for reconsideration, and NSA has a regular bureaucratic process for making that judgment.

We had just seen a strategic assault on the homeland mounted from within the United States but planned in Afghanistan, and we had every reason to believe that more attacks would follow. So I directed our analysts to lower the threshold when it came to deciding what constituted “critical to understanding the significance of the intelligence.” If potential al-Qaeda plotters were phoning in, we wanted the FBI to know as soon as possible whom terrorists were talking to and not to demand that the bureau formally request that information.
*

Often we were not getting the content of calls but just the fact of connections between the United States and Afghanistan (the metadata). And to be sure, there were a lot of Afghans innocently in contact with family in America with each asking if everyone was all right. But with metadata alone, all we had was the fact of contact, and we passed many of these to the FBI.

“Anonymous sources” at the bureau later criticized NSA for sending them on what they derisively called “pizza runs,” and I suppose we were. But we didn’t intend these tips to be definitive, just data that could be mixed with other information in the service of analysis. That was our mistake. We thought the bureau did analysis in addition to kicking in doors.

I told George Tenet we were doing this, and he told the vice president and the president. They said, “Good. Can he do anything more?” Tenet called me with that question, and I replied, “Not within my current authority.” He shot back, “That’s not the question I asked.” “I’ll get back to you” was the best I could come up with at that moment.

Later the Joint Inquiry Commission (see chapter 3) would criticize NSA for failings prior to 9/11. The most telling of these had to do with terrorists inside the United States, specifically:

“NSA’s cautious approach to any collection of intelligence relating to activities in the United States.”

“There were also gaps in NSA’s coverage of foreign communications
and the FBI’s coverage of domestic communications.”

“NSA did not want to be perceived as targeting individuals in the United States.”

“[In talking about one-end US conversations] there was insufficient focus on what many would have thought was among the most critically important kinds of terrorist related communications, at least in terms of protecting the homeland.”

The JIC findings were published a lot later, of course, but frankly, we didn’t need any help figuring out where our gaps in coverage were. I mention them here only to point out that what then followed, NSA’s Stellarwind program, was a logical response to an agreed issue and not the product of demented cryptologic minds, as some would later suggest. By
Congress’
s definition, what we had been doing had not been enough. What would they have us do if not a Stellarwind
-
like approach to fill the gaps they were so righteously identifying?

In any event, after George’s call, I got my operations and legal team together and said, “All right, blank slate: What more can we do against this threat?” We came up with several courses of action, one of which was aggregating domestic metadata (the fact of calls to, from, and within the United States) and another that effectively allowed us to quickly intercept the content of international calls, one end of which might be in the United States, if we had reason to believe the call was related to al-Qaeda.

Neither of these would follow the procedures of the Foreign Intelligence Surveillance Act, or FISA (the law passed in 1978 after the last great NSA “scandal” and the Church Commission investigations), as the act was then understood and certainly as it was then implemented. FISA would have required detailed, individualized warrants, each approved by the court. To do what we were proposing, the law
would have to be amended or we would have to rely on some other authority.

George invited me to see the president and the vice president at his morning briefing in the Oval Office, and there I laid out the operational advantages these steps would give us. Basically, by being able to query the metadata for possible connections to known terrorist numbers and then quickly go up on suspect numbers, we would increase the odds that we would catch the one thing that most eluded us before 9/11: terrorist-related calls, one end of which were in the United States. I sensed that things were going to move pretty quickly after this session.

George called and told me as much and then invited me back to the Oval. Besides being my boss, George was a good friend. I once blurted out on C-SPAN that I loved him like a brother. So I reminded him that since the ugliness of the Church Commission, NSA had acted like it had had a permanent one ball–two strike count on it. “We don’t take many close pitches,” I reminded him. “We need to be careful about this.”

George clearly passed that on to the president, who no doubt got the baseball metaphor. As I walked into the Oval the next day, the president was offering me reassurances about the welfare of the agency before I had even sat down. He understood my concerns, he said, but we had to do what was right.

After the session, as I was being driven up the Baltimore-Washington Parkway toward Fort Meade, I alerted my office that I wanted to see Bob Deitz, my senior lawyer, as soon as I returned.

“The president is going to do this on his own hook,” I told Bob as he came into my office. “Raw Article 2, commander-in-chief stuff. No new legislation. Probably would take too much time, as well as tipping off al-Qaeda. Justice is going to approve it but I need
your
views. Can he do it? Does he have the authority? Are we going to be OK here?

“By the way, the access control officer on this is the president of the United States. I’m authorized to read you in. No one else from your staff.”

Tough challenge. Bob told me he would get back to me the next day. He spent a sleepless night thinking a lot about the Constitution and the
Fourth Amendment. Next morning he told me that it was a hard case, but that he had developed a more-than-plausible theory about its lawfulness:

The Fourth Amendment posed no problem because, as he interpreted what the president was authorizing, we needed probable cause to believe that one end was foreign
and
one of the parties was a terrorist before we intercepted a communication;

with regard to metadata, the Supreme Court had already held 5–3 in a 1979 case [
Smith v. Maryland
] that such information was not constitutionally protected;

with respect to the Foreign Intelligence Surveillance Act [FISA, which
did
protect metadata], the statute did not allow us the speed or the agility to respond to this threat;

and, finally, there must be an implicit exception to FISA in an emergency or, to that extent, the statute was unconstitutional.

We talked a bit about the legal theory. When I asked him what the Supreme Court would do, Bob refused to predict an outcome, but stressed that his theory was sound and the argument forceful. Bob knew a little bit about the turf; he had clerked at the court for Justices Stewart, Douglas, and White. Later he confided to me that he thought we would win it, 6–3.

Bob had his own questions for me. Just to make sure that we were on the same page, he asked what I would do when (and it was always a question of when) the program leaked and I was called to the Hill. His concern was that we would never lie to Congress. I assured him that I wouldn’t. He also encouraged me to seek authority to brief the Hill or at least the senior leadership and the FISA Court. I strongly agreed.

Bob was comfortable with his opinion, but there was a lot of legal firepower at NSA that he couldn’t access because of the president’s
restrictions. He obliquely raised my question with the agency’s top operational lawyer and a real hard-liner on NSA’s limits. Bob spoke abstractly and hypothetically, of course, but his comfort level increased when the lawyer endorsed Bob’s legal theory. Within a week or so we were able to get other lawyers read into the program. There was no way we could play this close to the edge without a lot of legal oversight. The additional lawyers were quite comfortable with our legal position, by the way.

Even as he was content with his own reasoning, Bob wanted to understand the legal theory used by the Department of Justice’s Office of Legal Counsel about why it thought the program was lawful and to compare it to his own. He called the vice president’s lawyer, David Addington, within a couple of weeks on the secure phone asking to see the legal opinion. Addington refused, but he did read some of the operative paragraphs over the phone. Bob thought that John Yoo’s approach actually proved too much and was unnecessarily broad, a kind of “Article 2
über alles
,” whatever the president thinks is necessary to preserve the nation, he may do. Deitz said his training at Harvard was in the common law tradition, which relies heavily on facts to achieve a case-by-case development of the law. Yoo’s broader theory was typical of Yale, he told me. No rivalry there.

When the Department of Justice opinion on this program became public, it was clear that it had expanded its justification beyond the president’s Article 2 powers as commander in chief to include the congressional Authorization for the Use of Military Force (AUMF) against those responsible for 9/11. That argument was contentious, since the law didn’t specifically talk about intercepting communications, and the administration had not specifically requested that authority. In the complex 2004 Hamdi decision, however, the Supreme Court did seem to uphold the legality of detention—even the detention of a US citizen—as a legitimate incident of war even though it, too, was never mentioned in the AUMF. If you could detain an enemy without trial, intercepting his communications seemed a lighter legal lift.

My guys seemed to split the difference between unrestricted executive
power and narrow reliance on the implied intent of a single statute. They believed and so advised me that the president as commander in chief had the authority to do
this,
and any congressional limitations to the contrary were unconstitutional attempts to limit the executive’s power. It’s all still contentious and the subject of much debate, but twice the FISA appellate court has held that “we take as a given that the president has inherent constitutional authority to conduct electronic surveillance without a warrant
for foreign intelligence purposes.
” I think my lawyers got it right.

I had one more requirement to fill in on my checklist. The afternoon I came back from the White House knowing that we were going forward (the same day I huddled with Bob Deitz), I left work early and invited my wife, Jeanine, on a walk through a patch of Fort Meade’s largely sylvan campus. While on the walk I pointed out that we were fixing to do something controversial, that I was comfortable with doing it because it was right, but that at some point there was going to be high political and reputational risk, and I couldn’t rule out legal risk either.