September 22, 2016 | Posted in 4th Amendment, Al-Qaeda, Classified Information, Department of Defense, Director of National Intelligence, E.O. 12333, FISA, FISC, Intelligence, Leaks, NSA, President Obama, Russia, Snowden, Terrorism | By Tom Wither
In recent days, in the run-up to the release of an Oliver Stone helmed movie about him and his self-admitted theft of secrets from NSA and subsequent flight to China and then Russia, Edward Snowden has stated that he believes he deserves a presidential pardon for his crimes.
He bases this on a belief that, “If not for these disclosures, if not for these revelations, we would be worse off,” and goes on to say that a pardon would be appropriate, “…for the exceptions, for the things that may seem unlawful in letters on a page but when we look at them morally, when we look at them ethically, and when we look at the results, it seems obvious that these were necessary things,”. Both these quotes come from a CNN article that cites an interview in The Guardian.
Estimates reported by news outlets vary, but he allegedly stole approximately 1.5 million classified documents from NSA’s internal networks, far more material than anyone could have possibly needed to demonstrate alleged malfeasance and abuse by the government. According to NBC and Defense One, he did so by using computer passwords and credentials belonging to a civilian employee of NSA, a member of the military, and an NSA contractor to hide his criminal acts – in other words, he acted as a thief and con man to gain access to as much classified material as he could before he fled to China, and Russia – two great bastions of freedom and personal privacy.
Much has been made in various media outlets of the alleged impropriety, illegality, or unconstitutionality of NSA’s foreign intelligence efforts, both within the U.S. and abroad. However, after extensive public debate, the most controversial tools that concerned U.S. citizens remain in NSA’s toolbox, one of them, the ‘Section 215’ program, retooled by Congress and the Obama administration to ally the public’s concerns about potential overreach or misuse, but not halt it.
Moreover, NSA’s extensive efforts to preserve and protect the privacy rights of U.S. citizens is now documented the Director of National Intelligence’s ‘IC on the Record’ pages on Tubmlr. Thousands of now declassified documents that demonstrate how the government worked within the constitutional and complex legal framework set up to protect U.S. citizen privacy rights during the conduct of NSA’s SIGINT operations – controls that have been in place since at least 1980.
With regard to Mr. Snowden’s assertion that we “…look at the results…” of his actions to see that his pardon is warranted, we can do that. The report from the DoD Information Review Task Force-2 (IRTF-2) Initial assessment in December of 2013, titled ‘Impact Resulting from the Compromise of Classified material by a Former NSA Contractor’, said in its overall assessment that, “The IRTF-2 assesses with high confidence that the information compromise by a former NSA contractor….will have a GRAVE impact on U.S. national defense.”
In January 2015, Al-Qaeda created a YouTube video after the Snowden leaks teaching its operatives how to evade what the terrorists referred to somewhat erroneously as ‘FBI Secret Spying technology’. In May of 2015, the Henry Jackson Society, a conservative British think-tank published a 78-page report that drew heavily from the testimony from senior security sources outlining how terror groups had changed their communications methods and began more extensive use of encryption to hide terrorist operations from intelligence agencies. A July 2015 report in the New York Times also reported the Islamic State learning communications security from the Snowden leaks.
More recently, a Wall Street Journal article discussed how an Islamic State terrorist who led the November 13th terror attacks in Paris, evaded western intelligence agencies using better operational discipline and technical savvy in his communications. An awareness of which Mr. Snowden’s leaks undoubtedly raised, given the previous reporting.
The results of Mr. Snowden’s theft and leaks are pretty clear to my mind. Operating from a misguided sense of superiority and a flawed and incomplete understanding of the extensive U.S. person privacy protections in place within the intelligence community more broadly, and NSA in particular; he elected himself congressman, attorney general, and judge of a process and an oversight regime he initially tried to cheat his way into, and then barely had three months of experience in as a contractor (I’ll bet none of that is in the movie).
President Obama believes Snowden should stand trial, and so do I.
December 20, 2015 | Posted in Air Force, Author, Blog, Classified, Classified Information, Congress, Cyber attack, Department of Defense, E.O. 12333, FISA, Intelligence, Law Enforcement, Leaks, NSA, PPD-28, President Obama, Privacy, Snowden, U.S. Code Title 10, U.S. Code Title 50, Writing | By Tom Wither
I hope you’ve had a great summer and fall, and are enjoying the holiday season. I’d like to extend my thanks for being fans of my work, and wish you happy holidays and a bright new year.
I’ve been busy crafting my next novel, a project I’ve named ROGUE SENTINEL, and I will finish the manuscript shortly after the New Year. ROGUE SENTINEL will see Shane Mathews take on a solo mission to Jordan to find and capture an Islamic State mission planner known only as ‘Al-Amriki’ – The American.
Up next, I’ll be resuming work on SWIFT JUSTICE, the third and concluding novel of the ‘Aziz Trilogy’ that started with THE INHERITOR and AUTUMN FIRE, with main characters Shane Mathews and Emily Thompson.
During the year I’ve written a few Op-Eds on current issues that have been published in the Baltimore Sun and in The Hill’s Congress Blog. Here’s a list so you can look at them if you’re interested.
‘The NSA data collection program isn’t criminal; ending it is’ – http://www.baltimoresun.com/news/opinion/oped/bs-ed-nsa-data-20151203-story.html
‘Open Letter from a cyber terrorist’ – http://thehill.com/blogs/congress-blog/homeland-security/255370-open-letter-from-a-cyber-terrorist
‘Stand with our watchers’ – http://thehill.com/blogs/congress-blog/homeland-security/261237-stand-with-our-watchers
‘Access to encrypted communication, a balancing act’ – http://www.baltimoresun.com/news/opinion/oped/bs-ed-encryption-data-20151001-story.html
‘Clinton E-mails: Who else was involved?’ – http://www.baltimoresun.com/news/opinion/oped/bs-ed-clinton-emails-20150908-story.html
‘The country is vulnerable without CISPA’ – http://www.baltimoresun.com/news/opinion/oped/bs-ed-cispa-redux-20150209-story.html
Thanks again for being fans of my stories, and feel free make them presents for the fiction reader on your holiday list – they can be purchased from Amazon or Barnes & Nobel as e-books or hardcopies in trade paperback. You can even contact me via email@example.com for a signed copy if you like.
Take care and Happy Holidays!
As the new Congress comes into session in January, it will have many issues to address. One of the most important will be changes and improvements to the Foreign Intelligence Surveillance Act, commonly known as FISA. Some of its Patriot Act created provisions, like the better known Section 215 used to collect bulk phone records, and the less well known Section 702 authority compelling telecommunication providers to provide the government non-U.S. person communications have been hotly debated in Congressional committee hearings and by the general public during 2014.
The Senate recently failed to advance ‘USA Freedom Act’ to change FISA, ensuring that the debate will be rekindled in the next Congress early in 2015. Hopefully, the next version of the bill will address some of the concerns that Judge John Bates (a federal district judge who has served on the FISA Court) described – laid out about the concerns the FISA Court might have, and challenges it might face in its processes, if that version of the USA Freedom Act had become law.
Congress will work its will in passing a final set of changes to FISA from these bills, enhancing existing privacy protections in light of the rapid advances in modern communications and the public outcry over government access and storage of telephone and internet activity by ordinary citizens.
Once signed into law, I am certain the professionals within NSA, both military and civilian, will comply with the changes to the FISA statute, whatever their final form. That compliance is not only an integral part of their oaths to the Constitution, it is also completely consistent with the professional attitudes of the many men and women at NSA I have worked with over the years.
However, in light of this long debate, three ‘lessons learned’ are abundantly clear in this era of rapidly evolving modern telecommunications and the ‘internet of things’:
The public needs a better understanding of exactly what information they surrender when they use communications technology. This is a difficult goal to attain given the technological complexity of modern personal communications devices and the limited time or desire someone may have to delve into the privacy related issues attendant to the device or service they use. Do you know what personal information the operating system on your mobile device stores when you use an application? During the INFOSEC 2014 conference in Orlando earlier this year, an iPhone demonstration proved that while the app you use may keep your personal information secure, the phone’s underlying operating system may be storing much of it in a very unsecure manner.
Next, Congress and local legislatures need to play a more active role in the oversight of law enforcement and intelligence activities where they involve modern telecommunications technology. Law enforcement and intelligence organizations operate within the laws they are given, and the law must keep pace with advances in technology. As such, laws like FISA must continue to have yearly ‘sunset’ clauses built into them to force legislatures to engage regularly and keep pace with the leaps forward in technology. Police and intelligence services will leverage new technologies to conduct their missions, and they need laws adopted at a quicker pace, not just to constrain their actions within our Constitutional principles, but also properly enable them to bring criminals to trial or monitor agents and actions of a foreign adversary.
Lastly, a level of increased transparency is required. The days of ‘No Such Agency’, borne from the Cold War era, are long over, and a new balance needs to be struck. I believe law enforcement and intelligence organs must have and foster public trust, but intelligence organs cannot operate effectively if operational means and methods are exposed to the whole of the American public, and therefore, our adversaries. Adversaries would exploit such knowledge to kill our citizens, damage or destroy our critical national infrastructure, or win in battles with our military. We have begun to see the first steps towards increased transparency with the release of unclassified versions of FISA Court opinions and reports of aggregate counts of FISA warrants and NSLs. Among other things, greater transparency can be achieved by: providing unclassified titles for the closed door briefings to intelligence oversight committees; including in the aggregate counts of FISA warrants actively in use by each government agency; and releasing unclassified versions of all damage assessments produced as a result of unauthorized leaks of classified information. The government cannot claim damage due to leaks, without backing the claim in a credible manner in a public forum – something I believe can be done without exposing sources and methods or risking lives.
U.S. intelligence and law enforcement agencies exist and operate from the bedrock of public confidence. More transparency, consistent with protecting sources, methods, operational intelligence, and our troops in the field, is achievable, and since the Snowden leaks and the misinformation that has stemmed from them, something I believe is now mandatory.
Tom Wither is the author of the military/intelligence thrillers: “The Inheritor” (Turner Publishing, June 2014) and “Autumn Fire” (Turner Publishing, September 2014). He is also a 25 year veteran of the intelligence community. The views and opinions expressed are his own and are not those of any organization or element of the intelligence community or Department of Defense. His email is Tom@TomWither.com.
July 27, 2014 | Posted in 4th Amendment, Department of Defense, Director of National Intelligence, E.O. 12333, FISA, FISC, Intelligence, Leaks, NSA, PPD-28, Privacy, Snowden, U.S. Code Title 50 | By Tom Wither
Over the last year, some media outlets have used the leaked classified material from Edward Snowden to write news stories that imply NSA has either: allegedly violated the privacy rights of ‘every American’ or exceeded its authorities. In every one of these stories, what is usually missing is a SIGINT professional’s level of understanding on the part of the journalist, admittedly difficult to gain when SIGINT operational training is classified.
Signals intelligence, referred to as SIGINT, is both technically complex due to the nature of modern communications technologies, and legally complex, due to the heavy legal and Constitutional burdens placed on the professionals at NSA who conduct it.
These professionals spend months and oftentimes years during a career training in the operational, technical, and legal aspects of conducting SIGINT – which includes training in the protection of U.S. person privacy.
For example, a recent Washington Post article on July 11th, ‘How 160,000 intercepted communications led to our latest NSA story’; written to amplify its July 5th story ‘Non-targets far outnumber targets in NSA data collection’, states that the rules for ‘minimization’ of U.S. person information are ‘opaque’ – in fact, they are not opaque at all.
The minimization rules come in two forms, both of which are written in black and white for anyone to read, now that they have been declassified. They are contained in the Foreign Intelligence Surveillance Court’s minimization instructions as part of its numerous court rulings, and United States Signals Intelligence Directive 18 (USSID 18). USSIDs provide implementation guidance and direction to NSA’s civilian and military workforce, ensuring our Constitutional principles, current laws, Executive Orders, and binding court orders are implemented and enforced within the entire United States SIGINT System. For the purposes of this blog post, we’ll focus on USSID 18.
USSID 18 is titled, “Legal Compliance and U.S. Persons Minimization Procedures”, and is fifty-two pages long. Naturally, portions of many paragraphs are blanked out as part of the declassification process, but the direction in, and intent of USSID 18 are very clear, and I can tell you from my experience in the intelligence community that it is binding and followed by all SIGINT professionals.
Discussing all the limits USSID 18 places on SIGINT operations would take several blog posts worth of space, but we can look at one instance where USSID 18 applies in the Washington Post’s July 5th story.
The Post’s story states that, in the sample of surveillance files it reviewed, ‘NSA analysts masked, or “minimized,” more than 65,000 [references to U.S. citizens or residents], but the Post found nearly 900 additional e-mail addresses, unmasked in the files, that could be strongly linked to U.S. citizens or U.S. residents.’ This line is clearly meant to bolster the implication that U.S. person identities or identifiers incidentally collected under the legally authorized, and court monitored FISA Amendments Act (the Patriot Act) Section 702 program are not properly minimized.
If this element of the Post’s story is accurate, that translates to a 98.7% accuracy rate (based on (900 / 65,900) x 100) of minimization, as required under USSID 18 – an operational standard that many U.S. corporations would envy. The Post didn’t word it that way, but it is example of how the professionals at NSA take protection of U.S. person privacy seriously, rather than supporting the Post’s implication that NSA treats U.S. person data in a cavalier manner.
The Post’s explanatory piece on the 11th also expresses its concern about the volume and nature of incidental collection, the Director of National Intelligence’s assertion that it is unable to estimate how many Americans are affected, and that no outside watchdog – the Congress, courts, or the President’s Privacy and Civil Liberties Oversight Board have access to the content to judge for themselves.
The reason for this is obvious to a professional. Although the Post could traipse at will through its purported pile of 160,000 intercepts (reviewing U.S. citizen’s private information under the comforting blanket of the 1st Amendment) – the government cannot legally look through incidental collection to identify and characterize it because laws, and both executive and court orders forbid it. Laws and orders every American citizen, including those working at NSA, must obey.
At this stage of the debate, I had hoped to see stories covering how NSA adheres to law and policy to conduct their assigned foreign intelligence mission, using background interviews with NSA’s professionals and managers in a more transparent environment. Instead, we continue to see stories from some members of the media filled with a selected set of ‘facts’ provided by a man charged with theft and violations of the espionage act, filtered through well-intended, but only partially educated journalist guesswork, resulting in implications or insinuations of impropriety or illegality. There is more to the story than just what Mr. Snowden, or the journalists who support him, would have you believe.
When you get a chance, please read my Op-Ed in the Baltimore Sun.
Please feel free to contact me with your comments using the e-mail address in the tag line at the end of the piece. We live in a free society and I respect any point of view that you may have, so long as you express it in a civil manner.
Thanks to all who have already sent me comments. I’ve enjoyed reading them, and I am doing my best to respond to all of them individually. Also, I’d like to thank Tricia Bishop and the other members of the Sun’s Editorial Board who thought my Op-Ed was worth publishing.
As I’m sure you’re aware, President Obama gave a speech Friday to describe the ‘reforms’ he was directing NSA to implement to restore the American public’s confidence in NSA’s activities, and reassure the citizens of our foreign partners and allies that NSA’s capabilities were not being used against them.
These confidence building measures (I won’t call them reforms again) were well thought out, and articulated well. Based on the news reports after the President’s speech, many commentators, pundits, politicians, and newspaper editors believe the President outlined some good ‘first steps’ but did not believe he went far enough. It seems to me that Obama the President, as opposed to Obama the Candidate for President, has a much firmer grasp and understanding now, not just about what the U.S. Intelligence Community is capable of doing, and under which legal and other oversight authorities they do it, but also the extreme value of their intelligence products in the maintenance of national security, the development of foreign policy, and the conduct of diplomacy. He also has a great appreciation and respect for the hard work and sacrifices of the intelligence professionals at NSA (none of the NSA’s leaders are political appointees) and throughout the intelligence community.
Let me highlight some of the lines from his speech and talk about them a little.
“…the folks at NSA and other intelligence agencies are our neighbors. They’re our friends and family.” – Yes they are. They are civilian employees and members of the United States military who have sworn their lives to defend our nation. They are also people just like you and I, and they have taken the extra step of surrendering some of their personal privacy for the protection of their fellow citizens by permitting the government to conduct background checks to be sure they are people of good character. The aren’t required to be perfect people, just people of good character, as are the majority of our fellow citizens. Friends and colleagues were interviewed and vouched for them. They were looked at to determine if they had criminal pasts or any associations with any foreign government or groups advocating the violent overthrow of the U.S. government. Their citizenship, places of residence, and education were all verified. For senior leaders, they have also exposed their personal financial situation to examination to be sure undue monetary influences, foreign or domestic were not present. All of them are strapped to a polygraph machine on a recurring basis so their suitability for a position of trust could be confirmed. How many of you would allow that kind of intrusive look at your lives?
“If any individual who objects to government policy can take it into their own hands to publicly disclose classified information, then we will not be able to keep our people safe, or conduct foreign policy.” & “…revealing methods to our adversaries that could impact our operations in ways that we may not fully understand for years to come.” – These two items speak to Mr. Snowden’s alleged criminal activities. If you are hoping Mr. Snowden will be welcomed home a hero, or should be given credit for fomenting the debate in this country about personal privacy, I suggest you reconsider. The President is obviously unimpressed with his actions, as are all of the Senators and Representatives I’ve heard speak on the issue. Congressmen Rogers and Ruppersberger, the Chair and Minority Leader of the House Permanent Select Committee on Intelligence, both spoke last week about the serious damage Mr. Snowden has done to U.S. national security after reading the Defense Department’s initial damage assessment. According to them, that assessment spoke to the tens of thousands of documents related to military operations and activities across all the services taken by Mr. Snowden and leaked to the media as well. Congressman Rogers has also stated previously that Al-Qaeda affiliated terrorist organizations are changing their communications methods as a result of the leaks. If you know someone who is, or have a family member serving in the armed forces at home or abroad, Mr. Snowden didn’t do them any favors.
“…nothing in that initial review, and nothing that I have learned since, indicated that our intelligence community has sought to violate the law or is cavalier about the civil liberties of their fellow citizens.” & “…the men and women of the intelligence community, including the NSA, consistently follow protocols designed to protect the privacy of ordinary people.” – These two statements clearly affirm that NSA is not a ‘rogue agency’ as some media outlets would prefer to characterize it, ‘spying on Americans’. Moreover, members of both parties on the intelligence and judiciary committees in both houses of congress have taken great care to laud the professionalism and sacrifices of the men and women in the intelligence community during the hearings that have been held since the unauthorized disclosures began in June. Additionally, since the declassification of USSID 18, we can clearly see that U.S. person privacy protections were in place since at least as early as 1993 within NSA, something Mr. Snowden, in his egotistical rush to steal what he could and run to China and then Russia (where privacy protections are so obviously the norm), chose to ignore.
BULK DATA & THE REST OF THE REVIEW GROUP’S RECOMMENDATIONS
The changes to bulk data collection the President proposes are modest, and the President has called on Congress to fulfill its role as the legislative authority. The President obviously feels that the bulk data collection of telephone call records under FISA 215 is a tool he wants the intelligence community to have, but given the public’s concerns about the privacy implications, he has ordered that another FISA Court warrant will be needed to query the collected records, and that the Attorney General and Director of National Intelligence report back to him on a way to have the data held outside of the government, but still available. (I’m sure they will examine the issue as the President has directed, but the phone companies don’t want to hold it, so we’ll need to see what happens.) Also, the NSA will not be able to retrieve records from a query beyond two ‘hops’ from the seed telephone number. This will limit the number of returned call records, and reduce the number of U.S. person phone records reviewed by a professional analyst.
Congress will now need to perform its role in debating and amending as they see fit the FISA law, and the composition/functioning of the FISA Court based not just on what they have heard in open testimony, but also what the intelligence community and NSA has shown them in a classified setting, where I suspect the individual member’s opinions are less influenced by the proximity of reporters and video cameras, and more on practical application of law and the real threats and adversaries in the world.
The President chose not to address many of the remaining review group’s recommendations, ordering some for study, and ignoring (at least in the public speech) others. For example, he did not address the personnel and computer security portions of the review group’s report, which will undoubtedly be actioned within the intelligence agencies, under the watchful eye of the DNI and Congress. The detailed specifics will likely be left to classified briefings to Congress to ensure our adversaries don’t learn too much about the internal security mechanisms of our intelligence agencies. They’ve obviously already learned more operational details than they could have ever hoped for.
PRIVACY PROTECTIONS FOR NON-U.S. CITIZENS
The last item to address then is the extension of privacy protections to foreign (i.e. non-U.S.) persons. Let me say at the outset that in all my professional experience, which is consistent with the testimony heard before Congress over the last eight months and the statements the President has made: the U.S. Intelligence Community is tasked, and therefore interested only in: collecting, analyzing, and disseminating foreign intelligence – just like every other nation on the face of the planet.
During all that testimony, and all those speeches, no one in the U.S. intelligence community ever stated that they cared about or were tasked to gather information on the general public of any country. Moreover, given Congressman Rogers’ assertion during a hearing last fall that ‘the committee has access to all the classified tasking and resulting intelligence reports’, I would expect any number of members to object to any collection effort outside of valid foreign intelligence tasking, if it were in fact occurring.
The U.S. Intelligence Community performs their foreign intelligence mission based on requirements received by the President and the Combatant Commanders around the world. While stated plainly in Executive Order 12333, President Obama’s Presidential Policy Directive PPD-28 re-affirms that and formalizes the ‘rules of the road’ for intelligence collection in the 21st Century. With PPD-28, those rules now include a formal declaration and direction to the U.S. intelligence community to protect foreign citizen’s privacy as they would a U.S. person’s, and it is direction that I’m sure, based on my direct knowledge of the professionalism of the 100,000+ member intelligence community, will be adhered to.
In doing so, the professionals in the U.S. Intelligence Community (of which NSA is a large part) will be doing exactly what it has been doing since 9/11, conducting its operations within the law as it exists, under the oversight regime Congress has put in place, based on the direction and prioritization given to it by the President. Which, by the way, is not a set of circumstances you will find in Russia or China.
Over the last week, Mr. James Clapper (US Air Force, Lieutenant General, Retired) Director of National Intelligence, General Alexander, Director of NSA and Commander of US Cyber Command, Mr. Chris Inglis, Deputy Director of the NSA, and Mr. James Cole, Deputy Attorney General, DOJ testified before the House Permanent Select Committee on Intelligence, as more news stories about NSA, GCHQ, and foreign partner intelligence operations were reported by the media, and Mr. Snowden asked for clemency and the opportunity to testify before Congress.
First of all, I urge you to watch the past week’s testimony on C-Span’s website. In my opinion, it’s informative and straightforward, and far better than any of the news reporting I saw about it.
On Sunday, the White House, and the chairs of the Senate Select Committee on Intelligence, and the HPSCI all agreed that there would be no clemency for Mr. Snowden. I will point out that Mr. Snowden’s request does seem to indicate that he is guilty of the crimes he is charged with, since you wouldn’t ask for clemency to avoid or mitigate a criminal penalty unless you felt you would be found guilty.
Let’s talk about privacy for a minute. Privacy is a right that every U.S. citizen expects, as do most people in modern nations with educated populaces operating in a modern telecommunications environment. The testimony last Tuesday re-affirmed that the mission of the NSA is the production of foreign intelligence from SIGINT, which does not include the invasion of U.S. citizen’s privacy without a court order or warrant. It also highlighted that NSA’s mission (like all the other U.S. intelligence agencies) is driven by foreign intelligence requirements issued from the White House and the President’s national security staff in the form of the National Intelligence Priorities Framework (NIPF). Further, that the NSA’s mission is conducted in accordance with US law, and where U.S citizen’s privacy rights are concerned, with the added protections of oversight by the Office of the Director of National Intelligence, the Department of Justice, and the FISA Court.
In case you think I don’t know what I’m talking about, you can find out for yourself. Do a little research of your own into the legal authorities for the missions of the intelligence community. Read Executive Order 12333, and USC Title 50, Chapters 36 (FISA), 45 (Intelligence Community Authorities), 46 (CIA), 47 (NSA), and the Intelligence Community Directives (ICD) available on the Director of National Intelligence’s website. All of these require adherence to the U.S. Constitution’s Fourth Amendment protections against unreasonable search and seizure.
As for the on-going concerns expressed in the media of gross intentional violations of U.S. citizen’s privacy, I believe they are unfounded, based on the NSA’s now declassified internal reporting and the declassified legal opinions now available on the FISA Court and ICONTHERECORD web sites. For those that harbor concerns about the telephone metadata collection, read the posted court opinions and other material yourself. As you do so, remember two things: the call records were provided to NSA under a series of court orders applied for by the DOJ, under a law repeatedly approved by Congress. We also know now that those orders cited long standing Supreme Court precedent and placed specific controls on how the call data can be accessed and used. Those controls were developed and directed by the FISA Court, across multiple judges’ tenures, based on the knowledge of the professionals at NSA and the experience of honest error that occurs in any process humans engage in.
General Alexander also made some remarks in Baltimore last week where he took the media to task for continuing to write articles from the classified material Mr. Snowden took, and for writing stories that were inaccurate and/or mischaracterized what they were reading in the material. Personally, I wouldn’t want a journalist, not trained as a medical professional, looking at a set of power point slides or other internal hospital documents and then drawing a conclusion that every heart surgeon in that hospital was using improper technique and placing patient’s lives at risk – they just aren’t qualified to understand what they are looking at. Intelligence activities operate (in the U.S.) under the U.S. Constitution, U.S. law, and all the policies and procedures each agency derives from them. It is a complex professional environment that took me years during my career to truly master, and I assure you Mr. Snowden’s understanding of them, based on his statements and his alleged criminal acts, is sadly lacking.
I place much more weight on the statements of people like General Alexander, Mr. Inglis, and Mr. Cole; as well as people like Representative Rogers, Senator Feinstein, and many others on the relevant committees, particularly when they all resoundingly castigate Mr. Snowden for his apparent crimes, and demonstrate understanding and predominate agreement with these senior members of the intelligence community. Mr. Cole alone effectively recused himself, as the Snowden matter is an on-going investigation/item of litigation and he cannot comment under the requirements of professional ethics. As with any human endeavor, I’m sure there may be improvements to be made in the conduct of all intelligence operations, but those changes need to come from more Senators and Congressmen and women doing their ‘homework’ as Mr. Rogers put it during the hearing this week, not from a public debate on sources and methods that gives our nation’s adversaries the means to avoid U.S. intelligence scrutiny and places U.S. citizens, military members, diplomats, and our allies’ citizens in danger at home and abroad.
Moreover, I think you should keep something else in mind. According to the official statements, there are more than 100,000 men and women in the intelligence community of the United States, and more than 30,000 men and women working for NSA. Only one lone man, a systems administrator with no intelligence training to speak of, with an apparent surfeit of ego and naïveté, decided to steal and leak tens of thousands of classified documents to the media because he alone felt that illegal acts were being committed. I find it difficult to believe, based on my own extensive experience working with the dedicated, trained professionals at NSA and the rest of the intelligence community that ANY of those people would be shy about speaking up if anything they were asked to do was outside the law or their assigned intelligence mission.
I am also sure they would use the proper channels to reach out to the NSA Inspector General, the National Security Division of the Department of Justice, and the relevant committees in Congress where their concerns would have been given fair hearing and extreme scrutiny, rather than risk the lives of American citizens, military members, and innocent people abroad by exposing classified sources and methods information.
As Congress debates changes to the FISA law, the need for increased transparency to assure an understandably concerned public, and some its members reexamine the vigor with which they make themselves aware of the on-going intelligence operations of the U.S. government, I have no doubt that whatever direction the President issues or oversight requirements or changes in law Congress puts in place will be obeyed faithfully by the intelligence community – just as they have over the years since 9/11.
Finally, I’m sure that certain elements of the press will continue to publish articles from the classified material Mr. Snowden provided them, just as I’m sure our Russian friends are doing their level best to learn everything they can from Mr. Snowden about his brief time in the U.S. intelligence community. Remember, he can only stay in Russia for a year, and the extension of his stay is a very big carrot (and stick) to encourage him to talk. Otherwise, he might find himself on the next plane out of Russia – to a courtroom in the United States in the company of some U.S. Marshals.
Given the recent huge leaks of classified information by Mr. Snowden, and the large volume of press reporting resulting from it, I was struck by some of the comments by politicians and journalists about the ‘over classification’ of information by elements of the executive branch or the excessive amount of information classified by the United States government.
Since most Americans have no direct experience with generating or handling classified information as part of their daily lives, I thought I’d cover some of the basics of the subject and hopefully lend a little knowledge and background information as food for thought.
The first thing you should know is that the high level guidance for classifying information is not classified at all. That’s right, the basic instructions and guidelines are completely unclassified and available to anyone if you do a little digging. In fact, the guidance comes from the President as an Executive Order, which is binding on all executive branch departments and agencies, including all elements of the Defense Department (which includes the DIA and the NSA) and all sixteen agencies/elements of the Intelligence Community (the CIA, the Department of Energy, etc).
All of the recent Presidents: Regan, Bush, Clinton, Bush, and Obama have issued Executive Orders laying out the rules for determining what can be considered classified national security information, and in my experience, those rules have not substantially changed the basic guidelines or criteria for determining what information to classify. They have altered the length of time information can remain classified, as well as some of the review timelines, but that’s about all.
The current Executive Order, EO 13256, entitled ‘Classified National Security Information’ was signed by Barack Obama on December 29, 2009 and remains in force.
In order to start classifying information, you need to know a few things: What levels of classification are there, who is allowed to classify information, and what information should be classified.
No surprises here, you’ve all heard or seen them in the movies, but I’m listing them along with the definitions because these are the only classification levels in use by the U.S. Government (unless some statute creates others) and the definitions are key to allowing a classification authority to make a decision about which level a piece of information should be classified at.
- “Top Secret” is applied to information, the unauthorized disclosure of which reasonably could be expected to cause exceptionally grave damage to the national security that the original classification authority is able to identify or describe
- “Secret” is applied to information, the unauthorized disclosure of which reasonably could be expected to cause serious damage to the national security that the original classification authority is able to identify or describe
- “Confidential” is applied to information, the unauthorized disclosure of which reasonably could be expected to cause damage to the national security that the original classification authority is able to identify or describe
A key takeaway here is the last phrase in each definition: ‘that the original classification authority is able to identify or describe’. No parlor games or hidden items here. The damage that may result has to be able to be identified and described in writing by the classifying authority, otherwise known as the Original Classification Authority.
Who Can Classify Information?
If you think any government official or employee of the government can classify information just to keep it from the public, you are misinformed or have made a poor assumption. The real world is not what Hollywood or the more conspiracy minded among us might think.
EO 13256 establishes two classification authorities – Original Classification Authority and Derivative Classification Authority.
Original Classification Authorities (OCA) are the President, Vice President, Agency and Department heads designated by the President, and U.S. Government Officials delegated in writing. These Officials are usually General Officers in the military or Senior Executive Service level civilians in the civil service, not front line worker bees or managers. Once they have been trained (yes they Order requires that they be trained), an OCA can make decisions, in writing, about exactly what information their department or agency creates should be classified. To make those decisions, they must apply and adhere to the criteria described in the President’s Order (more on that in a bit). Out of the entire federal workforce of 2.2 million people in 2012, only 2,326 were OCA.
A Derivative Classification Authority (DCA) is one of those worker bees or managers in an organization or entity who might create a document, power point slide, or some other material that would need to be classified. They work solely off the written decision of the OCA discussed earlier. They do not get to decide what is classified at which level, they must follow the written guidance they have received from the OCA.
What Information Gets Classified?
Under the President’s Order, information can only be classified if it meets ALL of the following criteria:
- An original classification authority is classifying the information
- The information is owned by, produced by or for, or is under the control of the United States Government
- The information falls within one or more of the categories of information listed in the order
- The original classification authority determines that the unauthorized disclosure of the information reasonably could be expected to result in damage to the national security, which includes defense against transnational terrorism, and the original classification authority is able to identify or describe the damage.
Moreover, the Order also states that “If there is significant doubt about the need to classify information, it shall not be classified.”
The categories of information the Order allows an OCA to classify are:
- Military plans, weapons systems, or operations
- Foreign government information
- Intelligence activities (including covert action), intelligence sources or methods, or cryptology
- Foreign relations or foreign activities of the United States, including confidential sources
- Scientific, technological, or economic matters relating to the national security
- United States Government programs for safeguarding nuclear materials or facilities
- Vulnerabilities or capabilities of systems, installations, infrastructures, projects, plans, or protection services relating to the national security
- The development, production, or use of weapons of mass destruction
Note that under the order, you are not permitted to classify information for political purposes (i.e. claiming ‘national security’ when you are covering up a crime like Nixon did), to hide crimes or malfeasance, or simply because you don’t want to share information with the public. In our system, it meets the criteria or it doesn’t get classified.
That’s quite a bit to take in quickly, so lets walk through a simplified practical example. For the next five minutes, we’ll assume I’ve been appointed Secretary of Defense. Consequent to my appointment, The President appoints me in writing as an OCA.
Soon after, the Commander of Central Command walks into my office to inform me that he’s able to track the movements of the terrorist Usama bin Bad Guy. Bad Guy calls his wife every day at noon to check in with her and he often tells her where he is, and CENTCOM has the ability to monitor the phone calls using NSA’s SIGINT capabilities. Since Bad Guy is planning terrorist operations in Europe and the U.S., the CENTCOM Commander wants to capture or kill Bad Guy before he can carry out his plans.
Obviously, I need to give the Commander some guidance on classifying some important national security information.
First of all, does the information meet all four criteria? Yes. The President appointed me as an OCA, the information is produced and under the control of the U.S. Government (the DoD), it all falls within two of the categories of information that can be classified (military plans and operations and intelligence), and as the new Secretary of Defense, I’ve determined that disclosing the information may damage national security.
So here are the results of my classification decisions as an OCA, in writing for the CENTCOM Commander:
The fact that we can track Usama bin Bad Guy’s movements will be classified TOP SECRET
The fact that NSA & CENTCOM can monitor Usama bin Bad Guy’s phone calls will be classified TOP SECRET
Any information about Bad Guy’s terrorist plans in Europe or the U.S. will be classified SECRET
The CENTCOM operations to capture or kill Bad Guy will be classified TOP SECRET
This written listing forms the Classification Guide that CENTCOM and all other subordinate elements of the DoD will follow. The practical effect of this is that all military and civilian personnel will now use this guide to exercise their Derivative Classification Authority under EO 13256 to classify any information about Bad Guy’s movements, the content of his phone calls, his evil plans for Europe and the U.S., and the CENTCOM operations to stop him.
Depending on how long Bad Guy keeps calling his wife, and CENTCOM takes to plan and execute operations to capture or kill Bad Guy, hundreds or thousands of documents containing classified information may be generated, from just this one activity alone.
How Many Classified Documents Are There?
According to the National Archives’ Information Security Oversight Office’s 2012 Annual Report, which covers all U.S. Government executive branch agencies, the 2,326 OCA’s made 73,477 original classification decisions.
The employees across the government who create and handle classified material made 95,180,243 derivative classification decisions during that year. That seems like a large number, but given the proliferation of office automation technologies and computer networks, you need to remember than every e-mail, every word or power point document, or field or record in a database is counted because it was subject to a derivative classification decision.
Moreover, given the wording in the report, (i.e. decisions versus documents) you should remember that decisions themselves may not equate to just an individual ‘document’. One derivative classification decision on a paragraph in a twenty page word document can result in twenty classified pages because of the procedures used when classifying the whole document. Each classified page may be counted as one ‘classification decision’ based on the instructions issued by that organization to comply with the National Archives annual need. Having been part of some of the counting that happens once a year, I can tell you that the number of decisions is a reasonable benchmark, but probably under counts the actual number of classified items (call them documents, pages, or whatever you like) created due to the counting method in use and the usual bureaucratic processes in government.
Surprisingly, the Department of State made the most original classification decisions in FY 2012 – 39,770, while the Department of Defense only made 19,121.
Hopefully, you now have a better understanding of how classified information is generated by the government and why there is so much of it.
If you are skeptical about NSA operations and activities reported over the recent weeks, that’s certainly understandable, particularly since most Americans do not work within the intelligence community or understand the rigorous training, oversight (from the courts and Congress), and professionalism the men and women of the intelligence community bring to their work every day.
I’ll ask that you keep in mind a few things as you read news reporting from journalists that may have only incomplete or partial facts drawn from briefings or other documents outside of their proper context, and/or an incomplete understanding of the law, rules, and oversight in place. Every civilian employee and military member in the U.S. Intelligence Community (I.C.), including those at NSA, are U.S. Citizens, just like you are. They are highly trained professionals that take an oath to defend our nation and uphold the Constitution; not to any executive branch organization or institution. In fact, many have spent their entire professional lives quietly and unobtrusively working without fanfare or acknowledgement outside of the close knit intelligence community to defend our nation, provide our policymakers with the information needed to make informed decisions, and protect our troops in battle when needs be. To be allowed to serve, they have allowed themselves to be subjected to repeated background investigations, financial reviews, and polygraph examinations every few years to prove that they are responsible men and women of good character, worthy of being trusted with their nation’s most highly valued secrets. These investigations, when done properly and thoroughly (as most are), are an invasive process that many of their fellow citizens might find unacceptable or intolerable with regards to their personal privacy. These men and women are given their nation’s (actually every American citizen’s) trust, and are no more interested in violating the privacy or other constitutional rights of U.S. citizens than you are. Remember, these men and women are citizens of this nation, just like YOU are.
Undoubtedly, more news reports about the size, scope, and capabilities of NSA’s activities will be appearing in print and electronic news sources, given Mr. Snowden’s admitted removal and provision of classified material to an activist/journalist like Mr. Greenwald, and Mr. Greenwald’s recent statements that ‘new revelations‘ are coming. As you read these future stories, bear in mind that NSA’s activities are governed by Executive Order 12333, and constrained by the Foreign Intelligence Surveillance Act, and the Foreign Intelligence Surveillance Court, as well as regular oversight by Congress. Moreover, publishing of more ‘sources and methods’ information by Mr. Greenwald and his contemporaries will serve primarily to give away any advantage we may have over our adversaries and result in exceptionally grave damage to U.S. national security.
We citizens are reliant upon our members of Congress to provide proper and regular oversight of the I.C. elements. To date, Congress has held three hearings (House Intel Senate Judiciary House Judiciary ) addressing the legitimate concerns voiced by the public and some members of Congress about the programs and activities Mr. Snowden and his enabler Mr. Greenwald have shared. The law often fails to keep up with the rapid pace technology changes, and some members of Congress are not likely giving the activities of the intelligence community regular scrutiny due to time constraints, current committee assignments, or just simply because their activities aren’t the ‘hot button’ issue of the day. I do believe that the majority of members on the House and Senate Intelligence Committees have it right. The programs exposed thus far are legal, in that they are operating under the FISA law as enacted, and they are Constitutional, given the strict oversight and compliance requirements outlined by the Foreign Intelligence Surveillance Court, and the process and procedures NSA put in place to adhere to those requirements, as outlined in the public testimony and statements (Mr. Litt from ODNI). Having said that, given that Congress is paying more attention now, certain senior members like Senators Chambliss and Feinstein, and Congressmen Rogers and Ruppersberger have offered not only endorsement but in some cases reasonable improvements to the programs and oversight regime (note that they do not advocate stopping it, nor does the administration). Should Congress change the law or oversight requirements, I am certain that the Attorney General, FBI, and the NSA will abide by those changes.
Encourage your member of Congress and Senators to pay closer attention if you have concerns, and choose to take their word or not when they tell you an agency is doing what is supposed to under the law and Constitution. Fortunately, it’s YOUR choice, because we live in America; not Russia or China; but get all the facts, not just the ones a particular journalist may offer as you evaluate what you’ve been told.
As to whether Mr. Snowden is a ‘whistle blower’ / leaker, or a traitor, I’ll say this. In my view, a whistle blower sees illegality or unconstitutional acts and reports them to competent legal (the FBI or Attorney General) or agency authorities (a supervisor, a senior manager, an inspector general, an internal counsel) first, then to Congress and the media if the existing process fails. Along the way that person may suffer the loss of a job, the travails of our legal process including: possible pre-trial confinement, and a trial for his or her belief in the truth or ‘rightness’ of their actions, consistent with our Constitution and laws. In the end, they will either be vindicated, not only in court, but in the court of public opinion, or convicted under the law. Moreover, if this whistle blower is working in a classified information environment, that person uses the processes established to ‘blow the whistle’ in a way that does not expose the sources and methods of intelligence operations to our nation’s adversaries, endangering the lives of our men and women in uniform, our diplomats overseas, and our citizens (and those of our allies and friends) at home and abroad.
A traitor takes whatever classified information he can, boards a plane to a foreign country beyond the reach of U.S. law enforcement, and barters that information for notoriety, monetary gain, or presumed safety in the hands of one or more foreign governments. Mr. Snowden is not a whistle blower. People like Bunnatine ‘Bunny’ Greenhouse are whistle blowers.
It seems that every couple of months or so, some professional news outlet, or the on-line site WikiLeaks, releases or reports what is described as classified material. Once an organization or entity reports it, other professional journalists tend to jump on the story quickly, hitting up their sources and reporting on the story in whatever unique way or angle they believe they can.
Today’s case in point is the Washington Post’s initial reporting (based initially on a WikiLeaks release of classified State Department cables between the U.S. and the host governments), on the locations of the bases used to purportedly launch and recover unmanned drones like the MQ-9 REAPER. These drones are used, in part, to carry the U.S. war against Al-Qaeda and its affiliates directly to the leaders in those organizations. REAPER drones have launched missiles and bombs directly at identified Al-Qaeda or Al-Qaeda affiliate leaders to kill them with pinpoint strikes, giving the U.S. an unmatched capability to strike and limit collateral damage, while reducing risk to U.S. forces.
The Post reporting picked up and expanded upon by Fox News today, is obviously something that would be judged a ‘newsworthy’ item by an editor. There is just one problem. The revelation of even the general location of these bases has placed the lives of American military personnel in extreme danger.
Did the Washington Post or Fox News provide specific geographic coordinates for these bases? No. Did the classified cables posted on the WikiLeaks site? I’m not going to look and find out (I have no interest in making WikiLeaks think they are providing a useful service.) It doesn’t matter if they did or not. Anyone with any reasonable amount of deductive reasoning and an Internet connection can look at the publicly available information on the MQ-9’s performance characteristics, check Google Earth for the overhead imagery of the airfields capable of allowing a REAPER to land in country X, and then send people to stay in nearby towns for a day or two and wait to see a REAPER takes off from, or lands at the airfield nearby to confirm the presence of the drones. And Al-Qaeda has more than proven itself to have people capable of deductive reasoning and Internet access and usage.
What comes next is obvious. Al-Qaeda conducts a little more reconnaissance of the security at the airfield, some planning, obtains some weapons and explosives, and conducts a little more planning. Suddenly there is an attack on the airfield, killing the American military members who act as the REAPER’s ground crew and maintenance team, and damaging or destroying one or more of the drones at the base. Al-Qaeda gains a propaganda windfall within the Arab world and the Jihadist community, while a few more American soldiers, sailors, airmen or marines are shipped home in coffins to grieving family members.
So where is the problem? The problem is the person or persons who leaked the State Department cables to WikiLeaks that kicked off the journalistic process of ‘they reported the news worthy item, why don’t we?’ inside the editorial offices and journalist’s minds.
The U.S. news outlets can’t be faulted for anything other than what I view as being in ‘rush to publish’ mode and what I view as less than ideal judgement. The Constitution of the United States explicitly allows the freedom of the press, but I will argue that in my personal opinion, the editors at the Post and Fox News should have recognized the potential danger and elected not do a story on the leaked cables. However, they are journalists first, and I’m sure they did not see (or likely consider) the potential repercussions beyond the immediate gratification of trumpeting this previously unknown facet of U.S. drone operations before more of their colleagues did, and the perceived ‘luster’ of the story faded.
What can be done is that the people who leaked the cables need to be identified by the appropriate law enforcement agencies, investigated, and prosecuted within the fullest extent of all applicable laws. They have compromised the security of the United States and its allies in a time of war, imperiled U.S. confidential diplomatic discourse with other nations, and potentially endangered the lives of U.S. and Allied military personnel. If any U.S. or Allied service member or person is harmed or killed by the leak of this information, the individuals who leaked the cables should also be charged as accomplices to assault or murder.