If we get into a situation in which the technologies do not allow us at all to track somebody that we’re confident is a terrorist, if we find evidence of a terrorist plot somewhere in the Middle East that traces directly back to London or New York, we have specific information and we are confident that this individual or this network is about to activate a plot, and despite knowing that information, despite having a phone number, or despite having a social media address or e-mail address, that we can’t penetrate that, that’s a problem.
It was clear to me that applications of digital technologies had fundamentally changed since 2010, when as USD(I) I’d helped establish US Cyber Command and dual hatted the NSA director as CYBERCOM commander. Because commercial encryption had made cyber espionage exponentially more difficult, and the increased capabilities of our adversaries had made both offensive and defensive cyber operations more challenging, I decided to begin pushing to elevate CYBERCOM’s status to equal that of US Pacific Command or US Strategic Command and to separate it from NSA, preferably before January 20, 2017.
Fortunately, in the middle of dealing with Washington and Pentagon politics, I had an opportunity to travel, meet with deployed military and intelligence officers, and see the results of intelligence work. At the end of June, I went on a whirlwind tour of the Middle East, with a final stop in Israel, our closest ally in the region, where I was scheduled for a rare personal meeting with a head of state. At the time, Prime Minister Benjamin Netanyahu was conducting a very public campaign against the impending Iran nuclear deal, even addressing a joint session of the US Congress. Since I was in Israel as a representative of the president, who, of course, was in favor of the deal, I neither expected nor received a warm welcome, and indeed found myself on the receiving end of an hour-long diatribe. Netanyahu gave me very few opportunities to respond to his critiques of the proposed deal, which he felt, among its other shortcomings, neglected to force Iran to recognize Israel’s right to exist. When I was able to interject, he was uninterested in my pointing out that the deal would be purposefully limited in scope to prevent Iran from developing nuclear weapons, and that diplomatic pressure on Iran for other issues would not stop. While he wasn’t as openly belligerent as General Kim had been in North Korea, I understood that I couldn’t point my finger at the chest of the Israeli prime minister while making counterarguments.
As our meeting came to a merciful end and we were readying to leave, I mentioned that the paternal grandfather and namesake of one of my staff traveling with us, Jan Karcz, had fought the Nazis as the general in charge of the Polish cavalry, then served with the underground resistance and had died at Auschwitz. Jan’s maternal grandfather had hidden two Jewish women in Warsaw, saving their lives, and his mother had served as a squad leader of teenage medics in Poland. Netanyahu’s demeanor changed instantly, and he asked us to be introduced to Jan. We soon found ourselves chatting companionably in his small private office and looking through his memorabilia.
One item he showed us that particularly struck me was a thick hardbound book about the size of Webster’s Dictionary. In about a six-point font, the word “Jew” was printed six million times—once for each Jewish victim of the Holocaust. For me, it was a powerful reminder of why we do intelligence. Our work isn’t just about protecting national security. It’s about uncovering and shining a light on evil throughout the world, to prevent a tragedy like the Holocaust from happening again. As we departed, the prime minister gave me a cigar from his private stock, a consolation to end a tough encounter on a pleasant note.
When the final Iran nuclear deal—the Joint Comprehensive Plan of Action—was signed on July 14, I knew that Prime Minister Netanyahu was probably furious, and truthfully, I, too, felt we had given away too much for what we’d gotten from Iran, but at the same time, I still believed the world had just become a lot safer. Iran regained access to their $100 billion or so that had been frozen by sanctions. In return, they shipped out all of their uranium that was enriched beyond the 3.67 percent mark that capped “low-enriched uranium,” and 15,000 pounds of their low-enriched uranium, leaving just 660 pounds to be used for nuclear power and medical research. They also placed more than two thirds of their first-generation centrifuges into storage monitored by IAEA, along with all of their advanced centrifuges necessary to advance uranium beyond a low-enriched state. They poured concrete into their heavy-water facility in Arak, destroying it, and they allowed unprecedented surveillance—cameras and sensors—into their sole remaining nuclear facility in Natanz. Iran agreed to keep all of these stipulations in place for ten years, a period I wished were longer, but that was not my call. None of this turned Iran into a “shining city on a hill,” but that was never the intent. We had taken a potential nuclear weapon out of their hands for at least a decade, and I was proud of the role the IC had played in supporting negotiations in the three months since the initial framework had been settled.
July 2015 also presented an unexpected opportunity to work on protecting our people, when DOD announced that—after taking a brief period to study how best to implement the change—it would allow transgender troops to serve openly in uniform, including those stationed at the intelligence agencies. Given the glacial pace of bureaucracy in the Department of Defense, this announcement came surprisingly fast—less than four years after gay, lesbian, and bisexual service members were first allowed to serve openly. The major forces that made the transgender decision possible were simple: One was that the United States had quickly become aware of its transgender citizens after Caitlyn Jenner’s very public, reality-show transition that spring—something the transgender community had very mixed feelings about, at best—and a second was that there was tremendous outside pressure from LGBT groups that were seasoned from fighting for gay, lesbian, and bisexual Americans’ rights and had embraced transgender rights as the next battlefield. The third factor was the fact that all the problems the military had expected to encounter when gay, lesbian, and bisexual troops were allowed to serve openly had never materialized.
I would like to think the IC’s example also played a part into DOD’s decision. We’d shown that it was not only workable, but advantageous to employ openly transgender employees, who brought unique perspectives to mission challenges and contributed to successes. We also had a tremendous model for support. The LGBTA group I’d addressed a year and a half earlier had created a cross-agency, transgender “fly team” that could deploy quickly when an employee decided to come out. They could swoop in, both to help and support the employee through a difficult transition and to normalize the concept of being transgender and candidly answer questions and concerns from coworkers. That was certainly not an application of intelligence integration I had thought of, but I was proud that someone else had.
In just a few years, we had made great strides toward inclusion of our LGBT employees, but as much as we’d made public our business case for diversity, we still fell below the federal government averages in employing black and Hispanic intelligence officers. Those numbers hadn’t substantially improved in decades, despite Marine Corps Lieutenant General Vince Stewart’s having been sworn in at DIA as the first African American director of a major intelligence agency in January—a long overdue event. Likewise, the high-profile appointments of Tish Long, Betty Sapp, and Stephanie O’Sullivan didn’t lead to more women in broader management positions. The annual IC demographics report we submitted to Congress that summer was disheartening, but since it was classified, only the few select congressional members who had taken on workforce diversity as a pet project were tracking the information. So I tasked our equal employment opportunity and diversity chief, Rita Sampson, to find a way to publish an unclassified report in 2016, to hold us—and, more important, future leaders—accountable for our shortcomings.
I don’t want to leave the impression that we worked on integration and transparency for a while, then we worked on advancing technology, then provided intelligence to support policy
makers, and then focused on protecting people. The truth is, we were doing all of those things, all the time and all at once. We were not, however, as a significant number of Americans seemed to believe in the summer of 2015, conspiring with US Special Operations Command to seize control of states across the southern United States during the Jade Helm 15 military exercises. Radio host and conspiracy theorist Alex Jones, who called Texas home, pushed out daily updates about what was “really” going on, seemingly unbothered by contradicting himself from one day to the next. Some days he seemed to be pushing his own conspiracy theories, and on others, he just reported what he’d read on social media. His only real consistent message was that the president and the liberal elites in Washington were preparing to use military force to impose their will on southern rural conservatives. Some people were so taken by the fear that Obama was going to declare martial law, seize their guns, and impose his agenda that citizens armed with AR-15 assault rifles started showing up at military bases, declaring themselves “citizen observers” of the exercise. Asked about it later, President Obama remarked that Jade Helm was his “favorite conspiracy.” I don’t know the level to which he was being sarcastic in that interview, but to me, the situation was ominous, and we were very fortunate that heated discussions between soldiers and armed civilians never turned violent.
With the benefit of hindsight, the persistence of the Jade Helm conspiracy theory reminds me—far too much—of Putin’s social media campaign to turn the Russian-speaking region of Ukraine against its national government. In both instances, the purveyors of the conspiracy focused on a geographic region whose population viewed itself as physically isolated and culturally different from the people who were running their country. Both conspiracies had their roots in social media, with trolls quickly generating new, outrageous content. Both played on racial and ethnic prejudices and targeted people who were predisposed to believe they were victims of their national government’s agenda. In the summer of 2015, it would never have occurred to us that low-level Russian intelligence operatives might be posing as Americans on social media. As far as I know, we’ve never checked to see if Russia was involved in promoting the Jade Helm conspiracy, but it certainly followed their playbook, and it took place at around the same time that they launched their social media campaign to undermine Democratic candidate for president Hillary Clinton.
On the opposite side of the world, Russia was very open about what it was doing in Syria, and in September, any hopes that the United States held for ridding Syria of Bashar al-Assad’s tyranny evaporated. By then Assad’s crimes against humanity far outpaced what Gaddafi had done in Libya. Hundreds of thousands of Syrians were dead, including perhaps as many as a hundred thousand civilians, and of Syria’s prewar population of 22 million, about a quarter had fled the country, while another quarter were internally displaced. Assad had intentionally targeted civilians, including with chemical attacks, and as bad as the casualties inflicted by the Islamic State were, nine of every ten civilian deaths in Syria could be attributed to Assad’s regime. The US government wanted him gone—and said as much—but efforts to oust him had been continuously frustrated by two realities: first, the Russians and Chinese blocked any UN Security Council resolutions with real teeth, and second, no ready options emerged to replace the Assad regime.
By 2015, there were still hundreds of resistance factions in Syria, unable or unwilling to unite. The only group that had managed to seize and hold any real power or territory and who had made any effort—however sadistic—to govern had been the Islamic State. Fighting IS was very difficult, as they blended with the population and used civilians as cover, which made both intelligence targeting and actual strikes difficult to carry out. But the narrative asserting that President Obama was afraid to attack them was simply untrue. According to statistics published by the Council on Foreign Relations, the United States conducted more than twenty-two thousand strikes against the Islamic State and other terrorist groups in Iraq and Syria in 2015, and that number was limited only by the intelligence available to generate targets. Those efforts, as well as US support of Iraqi troops and other Syrian groups, were gradually wearing down the Islamic State.
Then, in September 2015, following a prenegotiated script, Assad’s regime formally asked Russia to intervene on its behalf in the civil war, and Russia responded by securing a Syrian air base on the coast of the Mediterranean and flying in fighter jets and attack helicopters. The Black Sea Fleet moved into the Mediterranean, and the Russians went to work, targeting anyone who didn’t support Assad’s regime. As is the Russian military modus operandi, they publicly claimed almost every strike was carried out against IS, but month after month, Russian air attacks killed more civilians than they did Islamic State fighters. We monitored the strikes and assessed that they were conducting so many that it was impossible that they were operating on credible intelligence for targeting. They were simply blowing up cities and towns whose people didn’t support Assad. I’m not convinced these raids made a significant difference against IS, and many were counterproductive, targeting groups who were actively fighting the Islamic State. But Russian engagement in the civil war certainly escalated the pain and suffering of the people of Syria as it accomplished the real goal of keeping Assad in power.
As Russian military intervention in Syria was ramping up, the Syrian migrant crisis in Europe hit a flash point. On September 2, a journalist published a photograph of a three-year-old Kurdish-Syrian boy whose body had washed ashore in Turkey. His family had fled Syria into Turkey and were trying to cross into Europe aboard a tiny inflatable boat, loaded well past its maximum occupancy, when it capsized just offshore. The vests the passengers were wearing turned out not to be flotation devices, and in the chaos, young Alan Kurdi was lost and drowned. The current carried him back to Turkey, and a few hours later the journalist captured the image of him, facedown in the sand. After the picture sparked worldwide outrage, his father told the media that they were ultimately trying to reach Canada. The incident and sympathy for the refugee crisis became major factors in the 2015 Canadian election and helped sweep the liberal politician Justin Trudeau into office as prime minister.
According to records of the UN High Commissioner for Refugees, more than 137,000 people had crossed the Mediterranean in just the first six months of 2015—nearly double the number from the same period in 2014. The vast majority were refugees, fleeing Syria, Iraq, Afghanistan, or North Africa, trying to reach Greece or Italy as entrance points into the European Union. Horrifyingly, in the month of April alone, 1,308 refugees had drowned or gone missing in their desperate attempts to cross. As terrible as the human toll had become, many European nations were wary of harboring those fleeing violence. Fully one third of the refugees were from Syria, and even the combined efforts of US and European intelligence agencies couldn’t guarantee that a handful of the hundreds of thousands of people making the crossing weren’t sleeper-cell terrorists with the Islamic State or al-Qaida. By the end of 2015, the refugees had become a moral crisis for the entire Western world.
On November 13, the risk the European Union was taking came into sharp focus, as half a dozen suicide bombings and mass shootings occurred almost simultaneously across Paris, killing 130 people and wounding more than 400 at a soccer match, a concert, and in crowded streets and cafés. The Islamic State claimed responsibility, saying the attacks were carried out in retaliation for French targeting of its fighters in Syria. The terrorists came from a prepositioned cell in Belgium and were not refugees, but the attack stoked anti-Islam sentiment across Europe and caused many European nations to halt taking in the “huddled masses” requesting asylum—precisely the Islamic State’s goals.
Less than three weeks later, terrorism hit the United States. A married couple in San Bernardino, California—he a US-born citizen and she a Pakistani-born US permanent resident—opened fire at the Christmas party for his office, the county Department of Public Health. In just a few minutes,
they killed fourteen people, wounded another twenty-two, and fled. A few hours later, the police caught up with and killed them in a bloody shootout. The Islamic State baselessly tried to take responsibility for these murders before eventually settling for having “inspired” the attack. The incident inflamed tensions with US Muslim communities again, and despite neither perpetrator’s having any connection to Syria, Americans began asking their elected representatives about the US policy for resettling refugees.
The response to the shooting demonstrated the real-world effects of commercial encryption on intelligence and law-enforcement work, and it underscored the post-Snowden tension between the US information technology sector and the US government. Fearing that other conspirators could still be at large, the FBI seized the San Bernardino shooter’s iPhone 5 but the government was unable to penetrate the device’s encryption and security without triggering mechanisms that would delete all its data. So the FBI quietly asked Apple to create a program that would disable the security on the phone, but the company declined. Jim Comey publicly acknowledged the FBI’s difficulties in unlocking the device, and publicly requested Apple’s help. CEO Tim Cook, in turn, wrote an open letter to Apple’s customers, stating that Apple would refuse the FBI’s request and reassuring them that it would never do anything to weaken the security features of its products. The FBI filed a court petition, and tensions escalated until, just before the court deadline, the bureau announced it no longer needed Apple’s help.
This is an issue that is still unresolved in this country. I certainly understand the imperative for personal privacy, but there has to be a better balance between societal safety and individual privacy. Stephanie attended a series of working group meetings at the White House to try to arrive at a reasonable compromise and way ahead. One proposal I thought had merit was a system of what’s called “key escrow,” in which as many as three separate, independent entities would hold a part of the encryption key, and a court order would be required to gain access to each of the keys held by the key holders. What I have found frustrating is the unwillingness of industry to apply all its great technical acumen to this problem. But since we were dealing with absolutist positions on both sides, we decided to pass this issue on to the next administration—and we informally knighted Jim Comey to be the continuity, since he had more than six years remaining in his statutory term as FBI director.
Facts and Fears Page 39