Dark Territory (5 page)

Studeman's second paper, an analysis of NSA personnel and their skill sets, concluded that the balance was wrong: there were too many Kremlinologists, not enough computer scientists. When Inman was director, he'd taken a few small steps to bring the technicians into the same room as the SIGINT operators and analysts, but the effort had since stalled. Most of the agency's computer experts worked in IT or maintenance. No one in SIGINT was tapping their expertise for advice on vulnerabilities in new hardware and software. In short, no one was preparing for the new era.

Studeman's studies—the very fact that he commissioned them—sparked resistance, anger, and fear from the rank and file. Over the years, the NSA's managers had invested, and were still spending, colossal sums on analog technology, and they chose to ignore or dismiss warnings that they'd made a bad bet. The old guard took Studeman's second study—the one on the looming mismatch between the agency's skill sets and its mission—as a particularly ominous threat: if the new director acted on his study's conclusions, thousands of veteran analysts and spies would soon be out of a job.

There was only so much Studeman could do during his three years in charge. For one thing, the world was changing more quickly than anyone could have imagined. By the time Studeman left Fort Meade in April 1992, the Cold War—the struggle that had animated the NSA since its birth—was over and won. Even if the need for NSA reform had been widely accepted (and it wasn't), it suddenly seemed less urgent.

Studeman's successor was Rear Admiral Mike McConnell, who had run the Joint Intelligence Center during Operation Desert Storm.
McConnell had remained General Powell's intelligence officer in the year and a half since the war. In the mid-1980s, he'd spent a year-long tour at NSA headquarters, attached to the unit tracking Soviet naval forces. But returning to Fort Meade as NSA director, at a moment of such stark transition, McConnell didn't quite know what he and this enormous agency were supposed to do.

There were two distinct branches of the agency's SIGINT Directorate: the “A Group,” which monitored the Soviet Union and its satellites; and the “B Group,” which monitored the rest of the world. As its title suggested, the A Group was the elite branch, and everyone in the building knew it. Its denizens imbibed a rarefied air:
they
were the ones protecting the nation from the rival superpower; they had learned the imponderably specialized skills, and had immersed themselves so deeply into the Soviet mindset, that they could take a stream of seemingly random data and extract patterns and shifts of patterns that, pieced together, gave them (at least in theory) a picture of the Kremlin's intentions and the outlook for war and peace. Now that the Cold War was over, what good were those skills? Should the Kremlin-watchers still be called the A Group?

A still larger uncertainty was how the NSA, as a whole, would continue to do its watching—and listening. Weeks into his tenure as director, McConnell learned that some of the radio receivers and antennas, which the NSA had set up around the globe, were no longer picking up signals. Studeman's “Global Access Study”—which predicted the rate at which the world would switch to digital—was coming true.

Around the same time, one of McConnell's aides came into his office with two maps. The first was a standard map of the world, with arrows marking the routes that the major shipping powers navigated across the oceans—the “sea lines of communication,” or SLOCs, as a Navy man like McConnell would have called them. The second map showed the lines and densities of fiber-optic cable around the world.

This
is the map that you should study, the aide said, pointing to the second one. Fiber-optic lines were the new SLOCs, but they were to SLOCs what wormholes were to the galaxies: they whooshed you from one point to any other point
instantaneously
.

McConnell got the parallel, and the hint of transformation, but he didn't quite grasp its implications for his agency's future.

Shortly after that briefing, he saw a new movie called
Sneakers
. It was a slick production, a comedy-thriller with an all-star cast. The only reason McConnell bothered to see the film was that someone had told him it was about the NSA. The plot was dopey: a small company that does white-hat hacking and high-tech sleuthing is hired to steal a black box sitting on a foreign scientist's desk; the clients say that they're with the NSA and that the scientist is a spy; as it turns out, the clients are spies, the scientist is an agency contractor, the black box is a top secret device that can decode all encrypted data, and the NSA wants it back; the sleuths are on the case.

Toward the end of the film, there was a scene where the evil genius (played by Ben Kingsley), a former computer-hacking prankster who turns out to have ordered the theft of the black box, confronts the head sleuth (played by Robert Redford), an old friend and erstwhile comrade from their mischievous college days, and uncorks a dark soliloquy, explaining why he stole the box:

“The world isn't run by weapons anymore, or energy, or money,” the Kingsley character says at a frenzied clip. “It's run by ones and zeroes, little bits of data. It's all just electrons. . . . There's a war out there, old friend, a world war. And it's not about who's got the most bullets. It's about who controls the information: what we see and hear, how we work, what we think. It's all about the information.”

McConnell sat up as he watched this scene. Here, in the unlikely form of a Hollywood movie, was the NSA mission statement that he'd been seeking:
The world is run by ones and zeroes . . . There's a war out there . . . It's about who controls the information.

Back at Fort Meade, McConnell spread the word about
Sneakers
, encouraged every employee he ran into to go see it. He even obtained a copy of the final reel and screened it for the agency's top officials, telling them that this was the vision of the future that they should keep foremost in their minds.

He didn't know it at the time, but the screenplay for
Sneakers
was cowritten by Larry Lasker and Walter Parkes—the same pair that, a decade earlier, had written
WarGames
. And, though not quite to the same degree,
Sneakers,
too, would have an impact on national policy.

Soon after his film-inspired epiphany, McConnell called Rich Wilhelm, who'd been the NSA representative—in effect, his right-hand man—on the Joint Intelligence Center during Desert Storm. After the war, Wilhelm and Rich Haver had written a report, summarizing the center's activities and listing the lessons learned for future SIGINT operations. As a reward, Wilhelm was swiftly promoted to take command of the NSA listening station at Misawa Air Base in Japan, one of the agency's largest foreign sites. In the order of NSA field officers, Wilhelm was king of the hill.

But now, McConnell was asking Wilhelm to come back to Fort Meade and take on a new job that he was creating just for him. Its title would be Director of Information Warfare. (
There's a war out there . . . It's about who controls the information.
)

The concept, and the nomenclature, spread. The following March, General Colin Powell, chairman of the Joint Chiefs of Staff, issued a policy memorandum on “information warfare,” which he defined as operations to
“decapitate the enemy's command structure from its body of combat forces.” The military services responded almost at once, establishing the Air Force Information Warfare Center, the Naval Information Warfare Activity, and the Army Land Information Warfare Activity. (These entities already existed, but under different names.)

By the time McConnell watched
Sneakers
, he'd been fully briefed on the Navy and NSA programs in counter-C2 warfare, and he was intrigued with the possibilities of applying the concept to the new era. In its modern incarnation (“information warfare” was basically counter-C2 warfare plus digital technology), he could turn SIGINT on its ear, not just intercepting a signal but penetrating its source—and, once inside the mother ship, the enemy's command-control system, he could feed it false information, altering, disrupting, or destroying the machine, disorienting the commanders:
controlling
the information to keep the peace and win the war.

None of this came as news to Wilhelm; he'd been skirmishing on the information war's front lines for years. But six weeks into the new job, he came to McConnell's office and said, “Mike, we're kind of fucked here.”

Wilhelm had been delving into the details of what information
war
—a
two-way
war, in which both sides use the same weapons—might look like, and the sight wasn't pretty. The revolution in digital signals and microelectronics was permeating the American military and American society. In the name of efficiency, generals and CEOs alike were hooking up
everything
to computer networks. The United States was growing more dependent on these networks than any country on earth. About 90 percent of government files, including intelligence files, were flowing alongside commercial traffic. Banks, power grids, pipelines, the 911 emergency call system—all of these enterprises were controlled through networks, and all of them were vulnerable, most of them to very simple hacking.

When you think about attacking someone else's networks, Wilhelm told McConnell, keep in mind that
they
can do the same things to
us.
Information warfare wasn't just about gaining an advantage in combat; it also had to be about protecting the nation from other countries' efforts to gain the same advantage.

It was a rediscovery of Willis Ware's warning from a quarter century earlier.

McConnell instantly grasped the importance of Wilhelm's message. The Computer Security Center, which Bobby Ray Inman created a decade earlier, had since lured little in the way of funding or attention. The Information Security (now called Information Assurance) Directorate was still—literally—a sideshow, located a twenty-minute drive from headquarters.

Meanwhile, the legacy of Reagan's presidential directive on computer security, NSDD-145, lay in tatters. Congressman Jack Brooks's overhaul of the directive, laid out in the Computer Security Act of 1987, gave NSA control over the security of
military
computers and
classified
networks, but directed the National Bureau of Standards, under the Department of Commerce, to handle the rest. The formula was doomed from the start: the NBS lacked technical competence, while the NSA lacked institutional desire. When someone at the agency's Information Assurance Directorate or Computer Security Center discovered a flaw in a software program that another country might also be using, the real powers at NSA—the analysts in the SIGINT Directorate—wanted to exploit it, not fix it; they saw it as a new way to penetrate a foreign nation's network and to intercept its communications.

In other words, it wasn't so much that the problem went ignored; rather, no one in power saw it as a problem.

McConnell set out to change that. He elevated the Information Assurance Directorate, gave it more money at a time when the overall budget—not just for the NSA but for the entire Defense Department—was getting slashed, and started moving personnel back and forth, between the SIGINT and Information Assurance directorates, just for short-term tasks, but the idea was to expose the two cultures to one another.

It was a start, but not much more than that. McConnell had a lot on his plate: the budget cuts, the accelerating shift from analog circuits to digital packets, the drastic decline in radio signals, and the resulting need to find new ways to intercept communications. (Not long after McConnell became director, he found himself having to shut down one of the NSA antennas in Asia; it was picking up
no
radio signals;
all
the traffic that it had once monitored, in massive volume at its peak, had moved to underground cables or cyberspace.)

In the fall of 1994, McConnell saw a demonstration, in his office, of the Netscape Matrix—one of the first commercial computer network browsers. He thought, “This is going to change the world.”
Everyone
was going to have access to the Net—not just allied and rival governments, but individuals, including terrorists. (The first World Trade Center bombing had taken place the year before; terrorism, seen as a nuisance during the nuclear arms race and the Cold War, was emerging as a major threat.) With the rise of the Internet came commercial encryption, to keep network communications at least somewhat secure. Code-making was no longer the exclusive province of the NSA and its counterparts; everyone was doing it, including private firms in Silicon Valley and along Route 128 near Boston, which were approaching the agency's technical prowess. McConnell feared that the NSA would lose its unique luster—its ability to tap into communications affecting national security.

He was also coming to realize that the agency was ill equipped to seize the coming changes. A young man named Christopher Mellon, on the Senate Intelligence Committee's staff, kept coming around, asking questions. Mellon had heard the briefings on Fort Meade's adaptations to the new digital world; but when he came to headquarters and examined the books, he discovered that, of the agency's $4 billion budget, just $2
million
was earmarked for programs
to penetrate communications on the Internet. Mellon asked to see the personnel assigned to this program; he was taken to a remote corner of the main floor, where a couple dozen techies—out of a workforce numbered in the tens of thousands—were fiddling with computers.

McConnell hadn't known just how skimpy these efforts were, and he assured the Senate committee that he would beef up the programs as a top priority. But he was diverted by what he saw as a more urgent problem—the rise of commercial
voice
encryption, which would soon make it very difficult for the NSA (and the FBI) to tap phone conversations. McConnell's staff devised what they saw as a solution to the problem—the Clipper Chip, an encryption key that they billed as perfectly secure. The idea was to install the chip in every telecommunications device. The government could tap in and listen to a phone conversation, only if it followed an elaborate, two-key procedure. An agent would have to go to the National Institute of Standards and Technology, as the National Bureau of Standards was now called, to get one of the crypto-keys, stored on a floppy disk; another agent would go to the Treasury Department to get the other key; then the two agents would go to the Marine base at Quantico, Virginia, to insert both disks into a computer, which would unlock the encryption.