One office that was critical to get to my level was the Foreign Affairs Directorate. We had lots of partners, but for all but a few of them, relationships were managed at a fairly low operational level and decisions about them were largely based on whether or not the affected NSA office felt they needed any summer help. I wanted these ties based on strategic considerations, not just on who could or could not cover discrete targets, languages, or radio frequencies.
All the reorganization helped, but the real plus was the chance to put new leaders into a bunch of the newly created posts. We reached deep within the ranks, betting that most of these promising rookies would learn to hit a major-league curve ball soon enough. Most did.
We institutionalized that approach, setting up a one-man senior personnel shop just down the hall from my office. Federal bureaucracies are dedicated to process in promotions and assignments, committee upon committee deciding who advances, when, and to what job. That’s designed to reduce favoritism (and lawsuits) and to enhance stability. We didn’t want stability; we wanted disruption, and I was hell-bent to favor some over others.
We eased out a whole generation of leadership and skipped over a big chunk of their obvious successors. These were good people. They didn’t deserve this. At the time, I thought of air force general Curtis LeMay’s legendary ruthlessness when it came to shortcomings. “I can’t tell the difference between unlucky and unskilled because the results are the same,” he once said. I knew that these people were quite skilled, just unlucky. It was a tribute to the agency and to these individuals that they handled this with grace, even though their only offense was being at the wrong place at the wrong time.
My most disruptive choice was my new deputy director. Barbara McNamara was in the position when I arrived and stayed on until June 2000. Barbara was career NSA and loved the agency with every inch of her being. She had started as a linguist and worked her way up the ranks. She was tough as nails and took nothing from her male counterparts. Her middle initial was “A,” and her signing off on countless papers over the years caused everyone to address her simply as BAM.
Barbara was badly treated in a November 1999 New Yorker article by Seymour Hersh, he of My Lai exposé fame and chaser of real and imagined scandals ever since. The lengthy article was a pretty stern critique of where NSA stood (accurate enough), but it then singled out McNamara. “Hayden gets it,” Hersh quoted one intelligence committee aide. “But he’s parachuted in there, and faced with a deputy director whose job is to foil what the director wants to do.”
Not true, but Barbara would never be a ruthless change agent; she was approaching three years in the job, and as a thorough Anglophile she was happy to end her career representing us in London to our British partner.
There was talent in the senior leadership, but no obvious choice for a new deputy, and there was no one in the lot who was close to being the bomb thrower I wanted. So I scoured the alumni association for anyone who had left recently and who had left angry. Bill Black’s name quickly popped up. Bill had been my predecessor’s special assistant for information warfare (see chapter 8) and had resigned from the agency three years earlier. Since entering NSA in 1959, he had been at the heart of the agency’s traditional mission targeting the Warsaw Pact, but he had been frustrated by the slow pace of transformation to a new age. He was also a bureaucratic knife fighter; if he was deputy, I knew he would have my back.
I invited Bill to lunch at a nondescript Korean restaurant outside the back gate of Fort Meade. Over bulgogi and kimchi we covered the state of the agency and his views on what could be done about it. He was firm, but not especially vindictive. It went well. My executive assistant, who was with us, later said that I was the most relaxed she had ever seen me during the meal.
We chose the off-base Korean restaurant to keep all of this quiet. But NSA as a social group permeates eastern Maryland. The next day Bill received an e-mail from a retiree in California asking him how his lunch with the director had gone.
Bill was the choice, but I had one last question. I invited him to my base quarters for a Sunday dinner for just the two of us. My wife was traveling, so I opted for simple roasted vegetables over couscous.
I told Bill that I wanted him to be the deputy, but I had one concern. I knew he could make things happen; he was notorious for his back-channel expertise. “But, Bill,” I said, “we’ve got to institutionalize this. This has to work even if you and I don’t show up for work.” He agreed. We had a deal.
Bill was a great choice. He stayed on for six years and served as acting director after I left. I owe him a great debt. After 9/11, though, in a private moment, I confessed that up to then I should have been thanking him for being there. “Now,” I said, “you need to thank me.” He didn’t argue. He would have died of frustration if he were confined outside after the attack.
To reinforce the shake-up, we hired from the outside to create crosscurrents within our own culture. We were being intentionally disruptive. At the time, I didn’t think there was sufficient expertise in the private sector to delegate mission responsibility to newcomers from the outside, so I didn’t. The closest I got to that was the 2000 decision to outsource our IT to a private consortium in the $2 billion ten-year Groundbreaker program.
In retrospect, I may have missed an opportunity, since American industry was already breaking new ground in what came to be called the cyber domain, and the more I learned, the stronger the parallels became.
But my caution certainly did not apply to a host of support tasks. The new chief financial officer came from Legg Mason, the Baltimore investment firm. We got our new inspector general via an ad in the Wall Street Journal. We created the position of senior acquisition authority and filled it with a former deputy assistant secretary of the navy with thirty-five years of acquisition experience. The chief information officer came from the Federal Trade Commission (and NASA). The chief of legislative affairs had been an executive assistant on the Hill for five years.
We even went outside for some direct mission support tasks. Working through a member of the advisory board who was an Academy Award winner in Hollywood, we recruited our new chief of research from the R&D department at Walt Disney Imagineering.
Another advisory board member with deep experience in telecommunications hooked us up with a tech- and business-savvy outsider who became our chief of IT. I interviewed him personally, without fanfare, then simply introduced him and his mandate to a meeting of seniors still trying to decipher the IT meltdown of January 2000.
There was nothing easy about this. We had to transform, but I didn’t want to make war on the agency either, and I certainly did not think that I was the anointed one sent to bring it salvation.
I think I was open to advice, but I had to decide on my own. Folks were candid and insightful, but in an organization as compartmented as NSA, most people viewed issues from their own vantage point and not the broader field of view I had from my office. We had to get off the X of inaction,* and waiting to build consensus or accommodating all concerns would have been a killer.
I had to be really careful with my language. I had been at NSA less than a year; a lot of people had been there (and usually nowhere else) for decades. I always used first person plural: “We’re going to do this.” “We’re going to try that.” Never first person singular. And never, never, never second person. The routine use of “you” would have deepened the chasm that was always threatening to open between me and a talented workforce.
Beginning in November 1999, I communicated regularly in a series of director’s e-mails that we called DIRGRAMs to announce and explain changes and keep an open line for comments and critiques in return. By the time I left in spring 2005, I had issued over four hundred. This made sure that the message got through unfiltered and probably accelerated our pace, but as a career military officer I knew that I was jumping the chain of command, communicating directly with all echelons, ero
ding the real or perceived authority of intervening layers of leadership.
• • •
NOT ALL OF OUR PROBLEMS were internal or self-inflicted. We also had a public relations problem that threatened our future. Even as some members of Congress and outside experts were accusing us of incompetence and being on a path to deafness, some civil libertarians and European parliamentarians were characterizing us as omniscient, stealing industrial secrets and invading personal privacy. The catchphrase for all of this was Echelon, to the Europeans an Anglo-Saxon cabal to steal economic advantage; to groups like the American Civil Liberties Union, “[T]he government . . . once again spying on American’s private communications.”
Never officially or precisely defined, the concept of Echelon was a convenient all-purpose bogeyman for any critic who wanted an audience. The transatlantic handwringers seemed to reinforce one another even if their grievances weren’t exactly the same.
The American handwringers were more important to us. We had to take them head-on. We needed more money, and we weren’t going to get it unless the American people and their elected representatives had a level of trust in us. Trust was especially important, since we were telling our overseers that the signals we were going to chase were no longer confined to isolated target networks, but were on international networks commingled with other, innocent communications, including those of Americans.
As for the Europeans, they were a self-righteous nuisance; I refused to meet with them. They spent more time researching us than their own security services, several of which actually did conduct economic espionage. And the reason that they researched us was that American espionage is far more transparent than European. Talk about looking for your car keys under the lamppost. I suppose we were a little contemptuous. Looking back now, that still feels about right.
We convinced Porter Goss, chairman of the House Intelligence Committee, to hold an open hearing on all this. In April 2000, George Tenet and I testified, as did Congressman Bob Barr, a Georgia Republican passionately committed to civil liberties.
In front of a packed gallery for a full two hours, both George and I freely admitted that we collected information on foreign businesses when it came to things like arms sales, chemical trading, money laundering, and drug trafficking. But we adamantly denied that NSA spied on European companies to collect industrial secrets and pass them on to US companies.
I talked about the challenges NSA faced because of the volume and variety of modern communications and the velocity with which they changed. Anticipating the cyber challenges then beginning to unfold, I said, “Our ability to collect may have increased, but it has increased at a pace far slower and smaller than the explosion of the ones and zeros that are out there.”
With regard to US privacy, I stressed our lawfulness and observed that if Osama bin Laden crossed the bridge from Niagara Falls, Ontario, to Niagara Falls, New York, provisions of US law would kick in, offer him protection, and affect how we could cover him. At the time, I was using this is a stark hypothetical. Seventeen months later it was about life and death.
• • •
EVEN IF WE SUCCEEDED in building some public trust and squeezing a few more dollars out of Congress, we still had the technical challenge of signals that were growing more complex, more numerous, and more encrypted. How to tackle that?
Our answer was Trailblazer. This much-maligned (not altogether unfairly) effort was more a venture capital fund than a single program, with our investing in a variety of initiatives across a whole host of needs. What we wanted was an architecture that was common across our mission elements, interoperable, and expandable. It was about ingesting signals, identifying and sorting them, storing what was important, and then quickly retrieving data in response to queries.
And all of this at speeds and volumes no one had ever seen before. One very prominent captain of the IT industry visited me in my office one evening, and when we explained our volume challenge to him, he slowly exhaled before observing that what we were discussing was bigger than anything he had ever encountered.
Despite his caution, we still believed it was important to engage industry on this, even though it stretched industry with its technological challenges and stressed our ability to manage a contract with deliverables beyond just billing for time expended and materials consumed.
Our program office had a logical progression in mind: begin with a concept definition phase, then move to a technology demonstration platform to show some initial capability and to identify and reduce technological risk. Limited production and then phased deployment would follow.
It looked good on paper, and there is no doubt that we got a lot out of the effort, more than just by-products like Velcro and Tang in NASA’s space program. Trailblazer advances were integrated into mission systems, and they contribute to this day.
But there is also no doubt that the overall results were disappointing and took far longer than we wanted. We found that when we went to industry for things they already knew how to do, we got impressive results. When we went to them for things nobody had done yet, we found that at best they weren’t much better or faster than we were. And that was true even with a team that included such defense giants as SAIC, Boeing, CSC, AT&T, and Booz Allen Hamilton.
We were also trying to do too much, too quickly. Trailblazer comprised multiple moon shots. We ended up like a lot of big federal IT programs—like the FBI’s Virtual Case File and DOD’s Navy Marine Corps Intranet. We would have been better advised to pick our spots and work incrementally, trusting to spiral development to eventually get us to where we wanted to be.
We also had to deal with guerrilla warfare. There was a group of talented technologists within the agency who had developed a tool, Thin Thread, to collect and sort metadata (the facts of a communication such as number calling, number called, time, duration, and the like) and then to point analysts to the rich veins of SIGINT ore within a mountain of information.
Thin Thread wasn’t the program of record when I arrived at the agency. I didn’t make it the program of record during my time there, and neither did my successor. We all could have been wrong, of course, but we had our reasons.
Thin Thread technology included e-mails, which was very good, since the volume of global e-mails was about to take off. It had a good packet processor, which meant it could assemble the individual packets that comprise e-mail messaging. It also had very good “session reconstruction,” which enabled it to put communications back together from the individual packets.
A third aspect of Thin Thread was software to actually detect meaningful traffic via the metadata of a massive communications stream (e-mail or voice). By studying the pattern, frequency, and length of calls, the system intended to point to the communications whose content should be explored. Of course, all data streams are different, so the system had to be trained within a particular data stream to pick out the valuable from the other information flowing by.
We gave it a try and deployed a prototype to Yakima, a foreign satellite (FORNSAT) collection site in central Washington State. Training the system on only one target (among potentially thousands) took several months, and then it did not perform much better than a human would have done. There were too many false positives, indications of something of intelligence value when that wasn’t really true. A lot of human intervention was required.
As a FORNSAT site, Yakima was also dealing with a data stream nowhere near the volume of modern cable traffic. A good rule of thumb for FORNSAT speed is about 150 megabits per second. Microwave intercept pushes you over 600. We expected cables, where most traffic was now going, to have multiple strands of fiber, each working at a minimum of 10 gigabits per second, each about 70 times the FORNSAT pace. Even if Thin Thread had performed better, the requirements of space and power for the system would have made applying Thin Thread technology to the mass data flows of cable cost-prohibitive.
The
best summary I got from my best technical minds was that aspects of Thin Thread were elegant, but it just wouldn’t scale. NSA has many weaknesses, but rejecting smart technical solutions is not one of them. In the end, parts of Thin Thread were merged with parts of Trailblazer to create new systems that were indeed quite successful and were used for years.
But the developers of Thin Thread, Bill Binney, Kirk Wiebe, and Ed Loomis, were messianic in their approach, and they had an ally in Diane Roark, a staffer from HPSCI (House Permanent Select Committee on Intelligence) who monitored the NSA account. They were later joined by Tom Drake, a senior outside hire who entered the agency almost as the twin towers were crumbling.
The alliance with HPSCI staffer Roark created some unusual dynamics. I essentially had several of the agency’s technicians going outside the chain of command to aggressively lobby a congressional staffer to overturn programmatic and budget decisions that had gone against them internally. That ran counter to my military experience—to put it mildly.
In April 2000 I sent a message to the workforce that laid out my thoughts. I was simultaneously angry and careful. “Some individuals, in a session with our congressional overseers,” I began, “took a position in direct opposition to one that we had corporately decided to follow. This misleads the Congress regarding our agency’s direction and resolve. The corporate decision was made after much data gathering, analysis, debate, and thought. Actions contrary to our decisions will have a serious adverse effect on our efforts to transform NSA and I cannot tolerate them.”
After endorsing full participation in our internal decision-making process, I went on to say that “once a corporate decision has been reached, I expect everyone to execute the decision to the best of their ability. I do not expect sheepish acquiescence, but I do expect the problems necessitating course corrections will be handled within these walls.”
Playing to the Edge: American Intelligence in the Age of Terror Page 3