Dark Territory

by Fred Kaplan

  The directive called for the creation of a National Telecommunications and Information Systems Security Committee “to consider technical matters” and “develop operating policies” for implementing the new policy. The committee’s chairman would be the ASD(C3I)—that is to say, the chairman would be Don Latham.

  The directive also stated that residing within this committee would be a “permanent secretariat composed of personnel of the National Security Agency,” which “shall provide facilities and support as required.” There would also be a “National Manager for Telecommunications and Automated Information Systems Security,” who would “review and approve all standards, techniques, systems, and equipments.” The directive specified that this National Manager would be the NSA director.

  It was an ambitious agenda, too ambitious for some. Congressman Jack Brooks, a Texas Democrat and Capitol Hill’s leading civil-liberties advocate, wasn’t about to let the NSA—which was limited, by charter, to surveillance of foreigners—play any role in the daily lives of Americans. He wrote, and his fellow lawmakers passed, a bill that revised the president’s directive and denied the agency any such power. Had Don Latham’s language been left standing, the security standards and compliance of every computer in America—government, business, and personal—would have been placed under the tireless gaze of the NSA.

  It wouldn’t be the last time that the agency tried to assert this power—or that someone else pushed back.

  CHAPTER 2

  * * *

  “IT’S ALL ABOUT THE INFORMATION”

  ON August 2, 1990, Saddam Hussein, the president of Iraq, ordered his army to invade Kuwait, the small country to the south. Three days later, President George H. W. Bush declared that this aggression “will not stand.” On January 17, 1991, after a massive mobilization, U.S. helicopters and combat planes fired the first shots of a month-long air campaign over Iraq—followed, on February 24, by a hundred-hour ground assault, involving more than a half million American troops enveloping and crushing the Iraqi army, pushing its scattered survivors back across the border.

  Known as Operation Desert Storm, it was the largest armored offensive the world had seen since the Second World War. It was also—though few were aware of this—the first campaign of “counter command-control warfare,” the harbinger of cyber wars to come.

  The director of the NSA at the time was Rear Admiral William Studeman, who, like his mentor, Bobby Ray Inman, had been director of naval intelligence before taking the helm at Fort Meade. When Studeman was appointed to run the NSA, he took with him, as his executive assistant, a veteran Navy cryptologist named Richard Wilhelm, who, a few years earlier, had been the number two at the agency’s large SIGINT site in Edsall, Scotland, running the test bed for Inman’s Bauded Signals Upgrade program, which aimed to decrypt Soviet communications.

  As the planning for Desert Storm got under way, Studeman sent Wilhelm to the Pentagon as the NSA delegate to a hastily improvised group called the Joint Intelligence Center. The head of the center was Rear Admiral John “Mike” McConnell, who held the post of J-2, the intelligence officer for the chairman of the Joint Chiefs of Staff. Like most fast-rising officers in naval intelligence, Wilhelm and McConnell had known each other for years. In the new center, they created a multiservice apparatus that combined SIGINT, satellite imagery, and human spies on the ground into a single cell of intelligence-gathering and -analysis.

  Before the invasion, American intelligence officers knew little about Iraq or Saddam Hussein’s military machine. By the time the bombing began, they knew most of what there was to know. Months before the first shot was fired, McConnell’s analysts penetrated deep inside Saddam’s command-control network. A key discovery was that Saddam had run fiber-optic cable all the way from Baghdad down to Basra and, after his invasion, into Kuwait City. American intel officers contacted the Western firms that had installed the cable and learned from them the locations of the switching systems. When the bombing began in the wee hours of January 17, those switches were among the first targets hit. Saddam had to reroute communications to his backup network, built on microwave signals. Anticipating this move, the NSA had positioned a new top secret satellite directly over Iraq, one of three spy-in-the-sky systems that Wilhelm had managed before the war. This one sported a receiver that scooped up microwave signals.

  At every step, then, the NSA, McConnell’s Joint Intelligence Center, and, through them, the American combat commanders knew exactly what Saddam and his generals were saying and where their soldiers were moving. As a result, the United States gained a huge edge in the fight: not only could its commanders swiftly counter the Iraqi army’s moves, they could also move their own forces around without fear of detection. The Iraqis had lots of antiaircraft missiles, which they’d acquired over the years from the Soviets, and they were well trained to use them. They might have shot down more American combat planes, but McConnell’s center figured out how to disrupt Iraq’s command-control systems and its air-defense radar.

  Saddam’s intelligence officers soon detected the breach, so he started to send orders to the front via couriers on motorbikes; but this was a slow process, the war by then was moving fast, and there was little he could do to avoid a rout.

  This first experiment in counter-C2 warfare was a success, but it didn’t go very far, not nearly as far as its partisans could have taken it, because the U.S. Army’s senior officers weren’t interested. General Norman Schwarzkopf, the swaggering commander of Desert Storm, was especially dismissive. “Stormin’ Norman” was old-school: wars were won by killing the enemy and destroying his targets, and, in this regard, all wars were the same: big or small, conventional or guerrilla, on the rolling hills of Europe, in the jungles of Vietnam, or across the deserts of Mesopotamia.

  Initially, Schwarzkopf wanted nothing to do with the feeds from McConnell’s center. He’d brought with him only a handful of intelligence officers, figuring they’d be sufficient for the job. The entire intelligence community—the directors of the CIA, NSA, Defense Intelligence Agency, and others—raised a fuss. It took the intervention of the chairman of the Joint Chiefs of Staff, Colin Powell, an Army general with Washington grooming and a strategic outlook, to bring the center’s intel analysts into a conversation with the war planners.

  Even so, Schwarzkopf put up resistance. When he learned that Saddam was transmitting his orders through microwaves after the fiber-optic cables were destroyed, his first instinct was to blow up the microwave link. Some of his own intel analysts argued against him, pointing to the reams of valuable information they were getting from the intercept. Schwarzkopf dismissed these objections, insisting that destroying Saddam’s communication links, rather than exploiting them for intelligence, would be the speedier path to victory.

  It wasn’t just Schwarzkopf who waved away the Joint Intelligence Center’s schemes; the Pentagon’s top civilians were also leery. This was all very new. Few politicians or senior officials were versed in technology; neither President Bush nor his secretary of defense, Dick Cheney, had ever used a computer. At a crucial point in the war, as the American ground forces made their end run to attack the Iraqi army from the flanks and the rear, the NSA and the Joint Intelligence Center proposed disabling an Iraqi telecommunications tower by hacking into its electronics: the tower needed to be put out of action for just twenty-four hours; there was no need to blow it up (and probably kill some innocent people besides). Cheney was skeptical. He asked the analysts how confident they were that the plan would work; they were unable to quantify the odds. By contrast, a few bombs dropped from fighter planes would do the job with certainty. Cheney went with the bombs.

  * * *

  Those who were immersed in the secret counter-C2 side of the war came away feeling triumphant, but some were also perplexed and disturbed. Richard H. L. Marshall was a legal counselor for the NSA. Before the fighting started, he’d voiced some concerns about the battle plan. At one point, an Iraqi generator, which powered a militar
y facility, was supposed to be disabled by electronic means. But Marshall saw that it also powered a nearby hospital. There was a chance that this attack—though it didn’t involve bullets, missiles, or bombs—would nonetheless kill a lot of civilians, and the most helpless civilians at that.

  Marshall and other lawyers, in the NSA and the Pentagon, held a spirited discussion about the implications. Their concerns proved moot: Schwarzkopf and other commanders decided to drop bombs and missiles on the generator and almost every other urban target—power plants, water-purification centers, communications towers, and various facilities having dual civil and military functions—and the “collateral damage” killed thousands of Iraqi civilians.

  Still, from his vantage at NSA, Marshall could anticipate a growth spurt in this new sort of warfare—perhaps a time, in the not too distant future, when it matured to a dominant form of warfare. If a nation destroyed or disabled a piece of critical infrastructure, without launching a missile or dropping a bomb, would that constitute an act of war? Would its commanders and combatants be subject to the Law of Armed Conflict? Nobody knew; nobody with the authority to mull such matters had given it any thought.

  Other NSA officers, more highly ranked and operationally oriented, had a different, more strategic concern. They were astonished by how easy it had been to take out Saddam’s communications links. But some knew that, in a future war, especially against a foe more advanced than Iraq, it might not be so easy. The technology was changing: from analog to digital, from radio transmissions and microwaves to fiber optics, from discrete circuits of phone lines to data packets of what would come to be called cyberspace. Even Saddam Hussein had fiber-optic cable. Because European allies had installed it, American officials could learn where the switches were located and, therefore, where to drop the bombs. But one could imagine another hostile nation laying cable on its own. Or, if a war wasn’t going on, if the NSA simply wanted to intercept signals whooshing through the cable, just as it had long been intercepting phone calls and radio transmissions, there would be no way to get inside. It might be technically possible to tap into the cable, but the NSA wasn’t set up for the task.

  The official most deeply worried about these trends was the NSA director, Bill Studeman.

  In August 1988, a few days before Studeman took command at Fort Meade, Inman invited him and another old colleague, Richard Haver, to dinner. Seven years had passed since Inman had run the NSA, and he wasn’t pleased with what his two successors—Lincoln Faurer and William Odom—had done with the place. Both were three-star generals, Faurer with the Air Force, Odom with the Army (the directorship usually rotated among the services), and to Inman, the career Navy man, that was part of the problem.

  Of the military’s three main services, the Navy was most attuned to shifts in surveillance technology. Its number-one mission was keeping track of the Soviet navy, especially Soviet submarines; and the U.S. Navy’s most secretive branches conducted this hunt with many of the same tools and techniques that the NSA used. There was an esprit de corps among the coterie of Navy officers who rose through the ranks in these beyond-top-secret programs. In part, this was because they were so highly classified; having the clearances to know the slightest details about them made them members of the military’s most secret club. In part, it stemmed from the intensity of their mission: what they did, 24/7, in peacetime—cracking Soviet codes, chasing Soviet submarines—was pretty much the same things they would do in wartime; the sense of urgency never let up.

  Finally, this esprit had been the willed creation of Bobby Ray Inman. When he was director of naval intelligence in the mid-1970s, his top aides helped him identify the smartest people in the various branches of the Navy—attachés, officers on aircraft carriers, as well as black-ops submariners and cryptographers—and put them together in teams, to make sure that the most important intelligence got into the operators’ hands and that the operators aligned their missions to the intel officers’ needs.

  Inman was a ruthless player of bureaucratic politics; Bill Studeman and Rich Haver liked to say that Machiavelli was an angel by comparison. As NSA director in the late 1970s and early 1980s, Inman engaged in protracted power struggles over which agency, NSA or CIA, would win control of the new technologies. When Ronald Reagan was elected president, he asked Inman, whose term as NSA director had nearly expired, to move over to Langley and become deputy director of the CIA. The Senate confirmed his nomination to the new job on February 12, 1981, but he remained director of the NSA until March 30. In that five-week period of dual powers, Inman sent several memos to himself—NSA director to CIA deputy director, and vice versa—and thereby settled many of the scores between the two agencies. (Inman’s boss at the CIA, the director, William Casey, was focused more on secret wars against communists in Central America and Afghanistan, so didn’t concern himself with internal matters.) In the end, the NSA was given sole control of computerbased intelligence. (This set the stage, three years later, for Reagan’s NSDD-145, which, until Congress overrode it, gave the NSA the power to establish security standards for all telecommunications and computers; Inman’s self-addressed memos had established the precedents for this authority.) In a few other disputes, Inman split the responsibilities, creating joint CIA-NSA teams. With the roles and missions secure, Inman also boosted both agencies’ budgets for expensive hardware that he’d desired back at Fort Meade—including supercomputers and miniaturized chips that enhanced the collection powers of sensors on satellites, spy planes, and submarines.

  Inman stayed at the CIA for less than two years, then retired from government, moved back to his native Texas, and made a fortune in start-up software and commercial-encryption companies. From that vantage, he saw how quickly the digital revolution was spreading worldwide—and how radically the NSA would have to change to keep pace. He remained active on government advisory boards, occasionally checked in with former underlings at Fort Meade, and grew frustrated that Linc Faurer, then Bill Odom, weren’t paying attention to the sharp turns ahead.

  Now, in the final year of Reagan’s presidency, Bill Studeman—not only a Navy man with experience in classified projects, but also a fellow Texan and one of Inman’s top protégés—was about to become the director of NSA. Rich Haver, who joined the two for dinner that summer night, was the deputy director of naval intelligence.

  When Inman had been director of naval intelligence, Studeman and Haver had worked on his staff. Studeman had worked on the advances in surveillance and computer processing, including the Bauded Signals Upgrade, that gave America a leg up on Russia at the beginning of Reagan’s presidency. Haver, a persuasive figure with a slide show and a pointer, was the one who briefed the president and his top aides on the advances’ implications. The three of them—Inman, Studeman, and Haver—had degrees in history, not physics or engineering. The world was changing; the Cold War was entering a new phase; and they saw themselves as frontline players in a realm of the struggle that almost no one else knew existed.

  Inman called together his two former underlings that night to tell them—really, to lecture them, through the entirety of a three-hour dinner—that they had to push the intelligence community, especially the NSA, out in front of the technological changes. They had to alter the way the agencies did business, promoted their personnel, and focused their energies.

  Among the first things that Studeman did when he assumed the helm at Fort Meade a few days later, was to commission two papers. One, called the “Global Access Study,” projected how quickly the world would shift from analog to digital. It concluded that the change wouldn’t take place all at once or uniformly; that the NSA would have to innovate in order to meet the demands (and intercept the communications) of the new world, while still monitoring the present landscape of telephone, radio, and microwave signals.

  Studeman’s second paper, an analysis of NSA personnel and their skill sets, concluded that the balance was wrong: there were too many Kremlinologists, not enough computer scientists
. When Inman was director, he’d taken a few small steps to bring the technicians into the same room as the SIGINT operators and analysts, but the effort had since stalled. Most of the agency’s computer experts worked in IT or maintenance. No one in SIGINT was tapping their expertise for advice on vulnerabilities in new hardware and software. In short, no one was preparing for the new era.

  Studeman’s studies—the very fact that he commissioned them—sparked resistance, anger, and fear from the rank and file. Over the years, the NSA’s managers had invested, and were still spending, colossal sums on analog technology, and they chose to ignore or dismiss warnings that they’d made a bad bet. The old guard took Studeman’s second study—the one on the looming mismatch between the agency’s skill sets and its mission—as a particularly ominous threat: if the new director acted on his study’s conclusions, thousands of veteran analysts and spies would soon be out of a job.

  There was only so much Studeman could do during his three years in charge. For one thing, the world was changing more quickly than anyone could have imagined. By the time Studeman left Fort Meade in April 1992, the Cold War—the struggle that had animated the NSA since its birth—was over and won. Even if the need for NSA reform had been widely accepted (and it wasn’t), it suddenly seemed less urgent.

  * * *

  Studeman’s successor was Rear Admiral Mike McConnell, who had run the Joint Intelligence Center during Operation Desert Storm. McConnell had remained General Powell’s intelligence officer in the year and a half since the war. In the mid-1980s, he’d spent a year-long tour at NSA headquarters, attached to the unit tracking Soviet naval forces. But returning to Fort Meade as NSA director, at a moment of such stark transition, McConnell didn’t quite know what he and this enormous agency were supposed to do.