Playing to the Edge: American Intelligence in the Age of Terror (18 page)

I reminded our cyber warriors that as staged as the
Ostfriesland
event had been for Billy Mitchell’s biplanes, we were even less convincing. We hadn’t yet come close to sinking the
Ostfriesland
.

America’s cyber warriors kept trying, though, perhaps at times a little too hard.

With wars under way in Iraq and Afghanistan and globally against terrorist networks, the Joint Chiefs had issued a standing execute order (EXORD) authorizing action to counter adversary use of the Internet. It went by the unwieldy acronym CAUI (pronounced “cow-ee”). On the surface it appeared like broad authority, but it was actually quite limited, since it required specific, senior-level permission to undertake any operation that wasn’t merely tactical in its conduct and very local in its effects.

In the run-up to one of the 9/11 anniversaries, it was proposed that broad CAUI authorities be used to block a video that Osama bin Laden had prepared to mark the occasion. His purpose was to taunt us and demonstrate that we couldn’t dilute his propaganda. Ours was to visibly frustrate his timetable to get his message online in time for the anniversary. That wasn’t really a strategic effect, but it was attractive enough to be approved at a Deputies Committee meeting.

The plan called for denying al-Qaeda access to Web sites that it intended to use for distribution. Some could be controlled cooperatively. Others had to be taken down.

Among the latter was a site controlled by a counterterrorism partner in the Middle East. It was a pretty vile site, the better to attract genuine jihadists to it, and the debate over taking it down reflected a perennial question for us. Did we want to take jihadists on in the cyber domain, or was it better to just monitor them there to better attack them in physical space? The traditional answer was the latter; in this case we were going with the former.

The attack was quite successful. The site went down hard. The 9/11 anniversary passed without a bin Laden release, but before there were any celebrations, my own regional experts were all over me complaining about the impact on our CT partner. The partner knew they were being attacked and were sure they knew who was doing it. And every time they rebuilt their site, down it would go again.

No one thought we could keep the video off the Web forever. There were just too many sites that could be used. It was time to stop this.

Over our objections, though, the attack persisted, so I called Jim Cartwright, now vice chairman of the Joint Chiefs of Staff. Jim seemed to understand the dilemma: we had achieved a tactical success, but now were threatening an important strategic relationship.

Cartwright approved my calling my counterpart and promising that the attacks would stop within twenty-four hours. I did so on a Saturday morning, confident that this would end by Sunday.

It didn’t. I still can’t explain why. Billy Mitchell had broken some prearranged ground rules to demonstrate his point with the
Ostfriesland
. That really angered the navy. Now it seemed that we were doing the same thing here except that this time we were disappointing, angering, and almost betraying a partner, one who put great stock in personal relationships and trust. I broke ranks and confessed to the partner that we did not support the continued action, but were powerless to stop it.

Later, at my request, Jim Cartwright also apologized personally to our ally in my office.

For my part I requested some private time with Steve Hadley, the national security advisor. “Steve,” I began, “there is no need for CIA to attend future meetings on proposed cyber operations. Until we get a governance structure that is more sophisticated and sensitive than this last ‘fire and forget’ drill, we’ll just mail it in. Put us down as opposed.”

Steve was taken aback. The anger was a little out of character for me, he said. And he was probably remembering that I was JFCC-NW’s first commander. Just shows how mad we were.

To be clear, it wasn’t that we at CIA were ideologically opposed to cyber ops. Quite the opposite. We even had our own cyber force, the Information Operations Center (IOC), chartered to conduct full-spectrum cyber operations, sharpen cyber tradecraft, protect agency systems, and enhance CIA’s cyber analysis. George Tenet had launched the IOC, and it grew steadily under him, Porter Goss, and me.

CIA didn’t try to replicate or try to compete with NSA or JFCC-NW. When asked about it, I explained that the IOC was a lot like Marine Corps aviation, while NSA was an awful lot like America’s air force.

Marine Corps aviation is an integral part of the marines’ air-ground team. It doesn’t try to match the US Air Force; it simply provides airpower to support the marines’ historic missions. The IOC develops cyber power so that the agency can perform its traditional missions too.

In aviation, it is important that both the marines and the air force are on the same air-tasking order. Otherwise, you could have fratricide.

The same is true for the IOC and NSA in the cyber domain. Each has to be aware of the other’s actions, and those actions have to be de-conflicted. That actually works pretty well. There is plenty of work to go around.

 • • • 

I
LEFT GOVERNMENT
in February 2009. A few months later the secretary of defense directed STRATCOM to plan for a new cyber command. In May 2010 JFCC-NW went the way of IOTC, and US Cyber Command stood up at Fort Meade, just the way Minihan and I and scores of others had envisioned more than a decade before. Keith Alexander, the DIRNSA, got a fourth star and became the new commander.

Keith eventually stayed at NSA for a total of eight years. Combined with my six, that was nearly a decade and a half of fairly consistent vision. That is a very unusual phenomenon within the federal government.

Alexander continued the tradition of aggressively proselytizing the cyber mission. From the outside it looked from time to time like he had overachieved and was getting out in front of the administration’s more cautious cyber headlights. There were reports of his going downtown for meetings with Howard Schmidt, the cyber czar, and even being taken to the woodshed by John Brennan, the president’s homeland security advisor.

By mid-2010, though, a little more than a year after I left government, there was little doubt that cyber weapons had come of age. Someone, almost certainly a nation-state (since this was something too hard to do from your garage) used a cyber weapon that was popularly labeled Stuxnet to disable about a thousand centrifuges at the Iranian nuclear facility at Natanz.

For someone of my background, that was almost an unalloyed good. It set the Iranian program back some six to twelve months, according to estimates.

But let me describe that achievement in just a slightly different way.
Someone had just used a weapon composed of ones and zeros, during a time of peace, to destroy what another nation could only describe as critical infrastructure.

When the fact of the attack became public, I commented that—although this did not compare in any way in destructive power—it felt to me a little bit like August 1945. Mankind had unsheathed a new kind of weapon. Someone had crossed the Rubicon. A legion was now permanently on the other side of the river.

We were in a new military age. What had been concept and anticipation only two decades earlier in Texas was now reality.

I had been a part of it. Probably pushed some of it along. Certainly got a chance to be present at some important milestones and decisions.

And now I knew that we would all have to live with the consequences.

T
he modern American intelligence community traces its roots to Pearl Harbor. Everything since that attack has been designed to prevent strategic surprise. We were surprised on September 11. People wanted to know why.

Everyone had a view, including a commission headed by former Indiana congressman Lee Hamilton and former New Jersey governor Tom Kean. They launched their work with a congressional mandate in November 2002 and were clever enough not to drop their report or its recommendations until July 2004, as the presidential campaign was getting into full swing.

The recommendations amounted to a major restructuring of American intelligence even as, that summer, the intelligence community was waging a relentless and largely successful global war against al-Qaeda; the intelligence community’s analysis that post-invasion Iraq would be inherently unstable was proving spot-on; and a CIA officer, Steve Kappes, was running back-channel communications that would eventually convince the Libyans to abandon their nuclear and chemical weapons programs.

There were few in the intelligence community at the time who thought that restructuring was a good idea. I certainly did not. Operational tempo was extremely high, and we all knew that this would be a time and energy sink. But we also knew that we had not prevented the horror of 9/11. The American people had forgiven us for getting some things wrong, but they and their representatives in Congress wanted to see some
visible
change.

Candidate John Kerry endorsed the findings of the 9/11 Commission within hours of their release, certainly before he had read them. President Bush waited a decent interval and then followed a few days later.

Following the elections, Congress returned to Washington and to the question of intelligence reform with rare energy.

For many of us in the business it seemed that the Hill had sprouted 535 intelligence experts, practically overnight. John McLaughlin, acting DCI while the law was being debated, used to liken discussions at both ends of Pennsylvania Avenue to being on a hospital gurney, with a lot of people in white smocks poking at you, with nary a medical degree in sight.

It’s hard for Congress to legislate better analysis or more aggressive collection or more foolproof covert operations. Choices are limited. Congress can move money (it had already given us a lot), it can add people (we were recruiting at record rates), and it can restructure organizational charts and strengthen authorities.

In adopting many of the Kean-Hamilton recommendations in the Intelligence Reform and Terrorism Prevention Act of 2004, Congress decided to restructure the intelligence community and strengthen authorities. Once you cut through the empty and emotionally charged criticisms of “Cold War mentalities,” “stovepipes,”
*
and “bureaucratic turf,” it was clear that the Hill was trying to recalibrate the critical balance that any complex organization has to manage—the balance between freedom of action for the parts and unity of effort for the whole. Too little autonomy for the parts leads to inaction, inflexibility, hesitation, and lost
opportunities. Too little unity of effort means that individual agency achievement is not synchronized, harmonized, exploited, or leveraged.

They were going to strengthen the center of the community and create more centripetal forces at the expense of centrifugal ones. They were also going to relocate and rename the center. The director of Central Intelligence (DCI) would become the director of National Intelligence (DNI), and whatever else he might be, he would
not
be the head of CIA. He would not even be allowed to have his offices at Langley.

The diagnosis that we needed more “glue” was only partly right. When it came to integration and synchronization, we got plenty of criticism, usually about as sophisticated as “You guys are all screwed up.” But a line I
never
heard following that one was “So you need to be more like the ——.” Because there wasn’t a country to fill in that blank that made the sentence true. Even if we might need more integration, and we did, on 9/10 the American IC was already the most integrated intelligence community on the planet.

DCI George Tenet was actually a powerful figure. As director of NSA, I was called and directed to act by George more than any combination of people in the Department of Defense or anywhere else in government, for that matter. George had the ear of the president, with whom he met six days a week. He had an outsize personality and a work ethic to match. He also headed up CIA, and that “C” still stood for
Central
.

When George called me, he would usually begin the conversation with, “Mike, my guys were just in here,” and usually end it with “and here’s what I want you to do.” And the antecedent of George’s “guys” in these conversations was not his relatively small Community Management Staff, but rather his operational, analytical, and technical folks from CIA proper. In other words, in terms of creating unity of effort and operational cohesion, the strongest “glue” we had was the fact that the head of the community (the DCI) also headed up its most operationally relevant agency (CIA).

And Tenet wasn’t alone. Charlie Allen had nearly a half century of CIA experience and had touched all the agency’s sensitive operations
during that span. Based on my observations, he never slept. He was George’s chief of collection for the entire intelligence community, and he conducted the collection orchestra like a maestro.

My standing orders to NSOC, my operations center at NSA, was simply to do what Charlie told them: “If he calls and says we have to move satellite collection in the Persian Gulf from Iraqi air defenses to Iranian test ranges because they are preparing a missile shot, just do it. And you can tell me in the morning. Unless someone else is going to call me and complain, you don’t need to call me.”

So the diagnosis that the DCI was not especially strong was wide of the mark. But there was a corollary that a source of his strength—that he was the head of CIA—brought with it inherent limitations, and that was closer to the truth.

When I became director of CIA (the first occupant of that suite not to have also been DCI) I would regularly tell the CIA workforce that one of the advantages of the new ODNI structure was that I could concentrate on just being director of CIA. Indeed, hardly a day passed that I did not wonder aloud how any of my predecessors could have done both tasks.

John Negroponte or Mike McConnell, the first two DNIs, would have to wake about 5:00 a.m. and begin their day by climbing into their armored SUV with their PDB briefer en route to the DNI’s office in the Old Executive Office Building. There they would prep for the morning meeting with the president, reading cables and field reports, reviewing specific PDB articles, adding or cutting as required, demanding more information on this or that matter. The DNI and the president’s briefer would cross West Executive Avenue and gather outside the Oval Office a few minutes before 8:00 a.m. The meeting with the president would last thirty to forty-five minutes and would often be followed by a formal or informal huddle with the national security advisor. And then the DNI would get back into the SUV for the drive to his office, arriving (on a good day) just before 9:30 a.m. At that point I would have been in my office, fully focused on CIA, for about three hours. How could someone with those demands run both CIA and the larger community?

A second limitation on the DCIA as head of the intelligence community was a little more subtle. There is an argument that any director of CIA would inevitably view the world through a CIA lens. Can the head of the nation’s human intelligence (HUMINT) service be counted on to make wise resource trade-offs between HUMINT, which he directly controls, and, say, signals intelligence (SIGINT), which he does not? My experience with George Tenet says that he can, but the question is not an unfair one.

I often wondered what President Bush really thought of the move to the DNI. Politically he had no choice but to support it; to oppose the 9/11 Commission during the campaign would have been read as an endorsement of failure. And the president paid a lot of personal attention to implementing the new structure once the law was passed and the campaign was behind him.

But his father had been DCI, and based on my contact with Bush 41, he had loved the job. The agency reciprocated the feeling. During our sixtieth-anniversary celebrations in 2007, we had a Texas barbecue on the lawn in front of the Original Headquarters Building. As I emerged from the lobby with Bush 41, the applause was instantaneous, warm, and sustained.

We all knew that Bush 41 had advised Bush 43 to keep George Tenet on as DCI after the 2000 election. Bush 41 had been in the job less that a year under President Ford and he had wanted to stay. He didn’t think that the job should be political. Incoming president Carter disappointed him and picked Stansfield Turner.

President Bush 43 was in my office at Langley with my family just before my ceremonial swearing-in in June 2006. He casually commented, “So, this was my dad’s office.”

My wife then asked, “Did you visit your dad while he was here?”

“No. I was considered too much of a security risk back then,” the president deadpanned.

He then looked around at the empty bookshelves (I had not yet moved in) and added, “They say you can tell a lot about a man from his library.”

Whatever the president or his father might have felt or exchanged in their personal conversations, in 2004 we all knew that the new law was going to take direct control of CIA away from the new head of the community. That meant that the legislation had to deal the new office a
very
powerful hand and had to do it formally and specifically. That’s what I told Senators Collins and Lieberman, key architects of the law, when I met with them that summer. That’s why Jim Clapper and I warned the House Intelligence Committee in late summer that a feckless DNI would actually make things worse.

Jim and I hit the same theme in front of a group of intelligence community seniors at the Wye River Plantation, on the Eastern Shore of Maryland. We were even less inhibited there, since this was within the family, in a classroom setting, and was totally off the record.
Right
.

Before we finished our meals and left for the Bay Bridge and the trip home, somebody in the class had called the under secretary of defense for intelligence, Steve Cambone, and delivered a Stasi-like
*
report on our views.

That quickly got us invited to a lunch with Secretary of Defense Rumsfeld that included his deputy, Paul Wolfowitz, General Pete Pace (vice chairman of the Joint Chiefs), and Cambone. Clapper and I were lined up across the table from the DOD leadership and were invited to make our case. The alignment reminded me a bit of the table at Panmunjom, where I used to negotiate with the North Koreans, except that we had Mexican food between us rather than miniature national flags.

Rumsfeld was more cold than angry during the meal. He had some justification. The sitting heads of two of his agencies (I was head of NSA, Jim of NGA) had been going around town trying to strengthen legislation that he and his department opposed. We should have let him know. We should have gone to him first.

We certainly knew where the secretary stood. Brent Scowcroft, the
former national security advisor, had shopped an ODNI-like structure around town in 2002 when he was head of the president’s intelligence advisory board. Rumsfeld had labeled it the dumbest idea ever.

Rumsfeld had also worked out a good relationship with George Tenet; even before he returned to government, he had made it clear that he thought CIA an essential partner of DOD. He and Tenet routinely settled their inevitable issues over Friday lunches. The last thing Rumsfeld wanted was another player in that mix or another bureaucracy to deal with. Besides, he reasoned, what would a DNI be able to do that a DCI could not do
if
the president really wanted something to happen?

That was correct, of course, but it really didn’t matter. We were going to get a DNI, and there was real danger that Congress would create a leader of the IC who had less power than DCIs had actually wielded. We told Rumsfeld that this would be ruinous and argued for legislative language that would codify a robust role for the DNI even over those big national collection agencies (the National Security Agency, the National Geospatial-Intelligence Agency, the National Reconnaissance Office) inside DOD. Jim even suggested a future where those agencies would be outside DOD and directly under the DNI.

As lunch ended and the secretary and his team were leaving, certainly dissatisfied with our explanation, I plaintively commented that we could be headed for disaster unless DOD could find it in its heart to be “generous.”

Secretary Rumsfeld understood the importance of intelligence. He made that clear to me very early on, well before 9/11. After his confirmation in the spring of 2001, he invited me to his office for a “get acquainted.” It was just the two of us, he in his characteristic sweater vest at a small table. I had a few paper slides outlining NSA and its work, but I didn’t get very far. “Who do you work for?” he quickly interrupted.

“You and George Tenet, Mr. Secretary.”

“Which line is solid and which line is dotted?”

“They’re both solid,” I replied, “and I suppose that could present me with a problem if someone around here paid any attention to us.”

I went on to explain that the “Good” in my “Good morning, Mr. Secretary” that day was the first syllable I had exchanged with a secretary of defense, even though I had been at NSA more than two years.

Rumsfeld fixed that condition. He paid attention.

By 2004 the nation had been at war for three years and it should come as no surprise that the defense character of NSA, NGA, and NRO had become more pronounced as the years of war rolled on, even though a significant portion of their mission remained national and their first initial remained “N.”