How the NSA fails its Nation
Part four: NSA- The Elephant That Should be a Gazelle
By: James Adams
According to the uber-leaker Edward Snowden, in one thirty day period, one small part of the NSA collected 41 billion records and most of those can only be held for 24 hours because the data banks can’t keep pace with the flood of bits and bytes pouring into the supercomputers every day.
Imagine the opening funnel of data and thus the volume of intercepts as being a half mile wide 20 years ago and being 50 miles wide today. Then imagine the bottom of the funnel, which represents the intercepts that can actually be looked at, as being 100 yards wide 20 years ago and being 2 miles wide today. Then think about the amount of traffic that can actually be decrypted as being two feet wide, you get some idea of the scale of the challenge. All the supercomputers in the world are not able to keep pace with the growth of traffic and the growth of ubiquitous encryption. That’s why we place so much effort on gathering data at rest (before encryption and after decryption). But to gather data at rest requires making decisions on priorities and that is antithetical to the current intelligence culture.
Shortly after being appointed Director of the National Security Agency in 1999, General Mike Hayden strolled out of his office to announce to the team of younger men and women that he called his Skunk Works that he wanted to bring some new blood on to the NSA’s Advisory Board. Until then, the Board had mostly been staffed with retired generals, admirals and career intelligence people so the advice was generally ‘Steady as She Goes”.
The team drew Hayden’s attention to a recent article in Wired magazine that profiled my work as CEO of a cybersecurity company I had founded called iDEFENSE. The picture accompanying the article had me peering from behind some bushes, an image hardly likely to instill confidence. But, by a curious coincidence, I had met Hayden when he was head of Air Force Intelligence and I was researching a book that looked at the future of warfare called The Next World War.
The result was a call from Hayden inviting me to join the Board of NSA. Born in Britain, I had become a citizen of America a year earlier and I can safely say that in no other country in the world could such a recent immigrant be asked to serve at the highest level of the country’s most secret intelligence agency. I considered it a privilege to be asked to serve and willingly agreed in an effort to give back to a country that had given me so much.
Reflecting back, the whole exercise was probably a mistake. I came from a very unforgiving culture of journalism and being an entrepreneur. I had organized two major structural changes, first as Managing Editor at The London Sunday Times and then as CEO of United Press International. In both cases hundreds of people had to be fired and better replacements hired in a culture that was truly the survival of the fittest. No quarter was given to the second rate and indeed I had only survived myself by striving for excellence at every stage of my rise in newspapers from apprentice to senior executive. I was (and am) impatient with bureaucracy, have little tolerance for the average and want to measure success and hold everyone accountable to those measures.
NSA was a shock. Indeed, having spent so many years writing books where I was desperately seeking an NSA keyhole to peer through for a glimpse of the riches that lay behind the door, I was surprised by many of the people, all of the process and the astonishing squandering of taxpayers’ money which seemed to be the norm. It wasn’t so much that the people did not have a strong sense of mission or were not patriots. But it was as if a group of blind people had suddenly been asked to describe a sunset, paint it and then write code to bring the colors to life. So many were completely clueless about how anything could or should be run to best effect.
I arrived at NSA just as the results of two reports that Hayden had commissioned — one internal, the other external — came in. Both were highly critical of everything NSA.
“NSA has been in a leadership crisis for the better part of a decade,” said the internal report. “It is lack of leadership that is responsible for both NSA’s failure to create and implement a single corporate strategy, and for the complete breakdown of the NSA governance process. Lack of leadership is also at the heart of unfortunate organizational behaviors that have created a perception among customers and stakeholders that NSA places higher value on its tradecraft than it does on outcomes for the nation. As a result, NSA has lost credibility with its stakeholders and customers and has failed to begin the organizational transformation necessary for the Information Age.”
The external team’s report was just as forceful: “NSA appears to operate like an entitlement program. Most people in the agency are highly motivated and work very hard but a portion does not. Many of the supervisors in the agency do not have the courage to deal with controversial issues. This lack of courage by supervisors to address controversial issues and make difficult decisions leads to low morale. This situation becomes quite demoralizing when some people in the agency believe that all that they have to do to get a paycheck and be promoted is to show up to work.”
Hayden divided NSA into two. One part houses the Signals Intelligence Directorate which intercepts all kinds of signals from emails, faxes and phone calls to military communications of various kinds and then analyses them for different customers. The second part deals with Information Assurance which translates as protecting secure communications from interception or attack. In this section, I’m only addressing the work of SID and will address information security in the next section.
Hayden looked at the structure he had inherited and realized immediately that it was top heavy and largely irrelevant to a new century. He streamlined the top tier, appointed a COO and the equivalent of a CFO while, at the same time, cutting people out of meetings who simply felt entitled to be there. He also saw that much of the organization was run by committees — a cover in many bureaucracies to avoid personal and potential risky decisions. Hayden cut an astonishing 450 such committees and forced senior staff to take personal responsibility for their own actions.
It was also a time when the internet and the information revolution was just taking off. The number of cellphones had grown in a few years from 16m to 741m and the internet had grown to 361m users. The days when the NSA had the time to consider options and the luxury of years to implement each decision were gone forever.
In his autobiography Playing to the Edge, Hayden makes clear that he blames President Clinton for much of the mess he inherited. At best, that is very disingenuous. The reality was that management at NSA had chosen to deal with budget cuts not by making tough decisions and cutting specific programs while enhancing others. Instead, leaders had taken the coward’s way out by cutting across the board and thus weakening everything while avoiding making tough choices. That was nothing to do with Clinton and everything to do with bad management.
In fact, there had been changes within the IC as a result of the Clinton cuts where there had been an enforced refocusing on getting the job done rather than feathering the nests in individual silos.
In the 15,000 strong Signals Intelligence Directorate, there was an overall tooth to tail (NSA people and contractors) of 1:4. In other words, there were four times as many contractors as there were NSA staff a ratio that was exactly reverse of what is common in industry. Second, a study of the HR department revealed that there was a ratio of 1:7 (HR people to NSA staffers) compared with 1:35 which is more normal in industry. In other words, management for years had seen HR as the dumping ground for the incompetent and as a result HR was a legend in its own lifetime for indolence and a lack of care for the people in its charge. Both the tooth to tail ratio and the failure of HR speaks volumes about generations of poor staffing, weak management and even weaker leadership.
One of the first tasks I was given by Hayden was to look at HR. In a long list of major reforms, my first recommendation was to fire the head of HR, someone who was clearly over promoted and incompetent for the task. I should have realized how things work at NSA when Hayden asked me to brief the person and tell her she was fired. Here was I, an outsider with no line management responsibility at NSA, doing the job that should have been done by the Director himself. In the event, it took a year to actually get rid of the person and she was sent to Harvard at taxpayer’s expense to study for a degree.
More importantly, the culture of secrecy had created a sense that the outside world was largely irrelevant to the workings of NSA. There was a fundamental belief that NSA was right and the rest of the world really didn’t matter. Maureen Baginski was then head of the Signals Intelligence Directorate and an exceptionally smart, innovative thinker. She sent a survey round to the thousands of people who worked for her asking how many people had access to the internet. Fifty per cent said they had no access and didn’t want any because it would mean having another computer terminal on their desk.
There was also a sense that NSA was truly exceptional and that the usual rules did not apply. For example, a new software management tool had been bought to manage the NSA staff. It should have cost around $5m to buy and implement but of course the NSA had to make everything special to them rather than adapting themselves to the new technology. As a result, the software was years overdue and cost $30m and then it cost $10m a year to keep running. Crazy.
While Hayden’s management reforms were right, changing the culture was an altogether different problem. Hayden himself was a product of the Air Force and he had risen through the ranks as an innovator and a smart guy with some good ideas. But, he was a product of the system and like most other senior officers, he only knew what he knew and the new reality that was emerging was far outside of his knowledge and experience. For example, Trailblazer, a supposedly innovative program that squandered billions of dollars on his watch and achieved very little, failed in part because he turned to the likes of SAIC, Boeing, AT&T and Booz Allen for advice and guidance. But those companies had, in part, became giants on the back of government contracts and worked at a pace that their customer understood. How many Silicon Valley companies would hire anyone on NSA’s contractor list? Answer: none.
The Al Qaeda attacks on 9/11 sent a shock wave through the IC. Not only were the attacks unexpected (attacks in general were expected but the specifics had eluded the IC) but there was also a realization that the game had changed and so had the urgency with which it must be played.
Shortly after 9/11, a very few people with access to Top Secret intelligence were told that a human source had revealed that a nuclear device had been smuggled into New York City and that a second device was also in America and the assumption was it was in Washington DC. The intelligence was from a previously reliable source and included schematics of the devices which convinced the experts that the threat was real. The source also provided a several week window during which the devices were expected to explode.
Several of my close friends in DC and NYC with access to the intelligence had the following conversation with their partners: “I can’t tell you why, but you need to take the kids and go and stay with Grandma.”
For me, it was an especially surreal time. I was flying from my home in Oregon back to DC every few days. I was unable to tell my wife about the threat and each time I left home, I thought it might be for the last time. And looking back through an airplane’s window at the DC landscape I wondered if the next time I saw this city it could be smoking rubble. Fortunately the window passed with no detonation and, as so often happens, apparently hard intelligence turned out to be wrong.
Less personal was the response I saw inside NSA. Hayden met with Dick Cheney in the White House and came back to report that he had basically been given a blank check. “Anything you want,” the Vice President had told him.
Top of the list was money which flooded into the IC and reversed all the refocusing that had been going on in the Clinton years. The old guard, who had resented all the cuts, were able to drop any changes that had been in the works and get back to operating in the familiar silos. The only urgency that remained was to find, fix and finish the bad guys. The IC itself didn’t need fixing. Just as the IC in the 90s couldn’t imagine a world without the Soviet Union, so the IC of today cannot imagine a world in which their primary function is not to kill bad guys. That mindset means the IC is doomed to create that reality and that in turn means that bad things and bad people will surprise us always. There will always be a new enemy to fight because we choose to never look beyond today’s fight. But there’s comfort in the familiar and it removes any need for change.
Any student of counter terrorism knows that over reaction always plays into the hands of the enemy. After all, their propaganda always portrays the good guys as evil, torturing assassins and in the battle of hearts and minds, it’s important to be seen occupying the moral high ground. Ultimately and over the long haul, it’s the strategic plays that really matter and eventually win wars. But the atmosphere back then was one of urgency combined with an almost desperate sense that action — any action — was the right thing to do. The result was torture, rendition and assassination and, for the NSA, a program called StellarWind that tracked millions of phone calls that came through America. The program intercepted the content of calls between American and foreign phones and the metadata on calls made to and from and inside the US, all without a court order.
Critics contended that Stellarwind was a failure and illegal. Hayden believes that it was valuable and essential for the counter terrorist fight. Whatever the truth, its exposure caused a political firestorm and a loss of public confidence in the government and the IC. The combination of Stellarwind and the Snowden leaks were a body blow to NSA which appeared to lose political cover and the confidence of the public.
Behind the scenes, I was given a specific task which was to look at the structure of SID and come up with recommendations for change. I was astonished to find that this huge organization operated almost in isolation from its customers. There was no measurement of customer satisfaction, no real understanding of why particular products were given to particular clients or whether or not they had any value. It was an extraordinary system that defied logic and all experience in the private sector where customer satisfaction is Job 1. I suggested that the organization be reoriented so that 1. The customer is asked what he or she wants 2. An effort is made to find out what is already available through open source 3. A list of priorities be drawn up and decisions made based on the most urgent and valuable need.
The result of this very basic restructuring was that some of the names on the doors were changed but business continued pretty much as before.
At the turn of the century, staff members of the House Permanent Select Committee on Intelligence (HPSCI) became so frustrated at their inability to influence the profligate spending and lack of accountability at NSA that they won authorization to establish a Technology Advisory Panel at NSA that would have a mandate to oversee all programs and make recommendation about them both to NSA and the HPSCI. I was asked by Congress to become Chairman of the Panel and I made sure that members were almost entirely outsiders (not a general or an admiral among them) and primarily drawn from high technology industries. A requirement was that each member had to be able to read a balance sheet and understand the concept of value (cost vs outcome).
The Panel devised a four point rating scale for each project: red meant that it was failing, yellow that it was off plan and needed management attention, Green on plan, Gray insufficient data to evaluate. The criteria used for assessment included Strategic Alignment, project plan and deliverables, management/leadership, solution/technical assessment, execution of program, customer alignment and stakeholder management.
By far the majority of the projects that the Panel evaluated were either classified Red or Yellow and only a tiny fraction were green. In every case there were clear recommendations for action and yet nearly a year in, The first chart I briefed to Maureen Baginski read:
We were chartered by Congress
We made Recommendations to you
You accepted those recommendations
Your people failed to execute.
A fairly typical exchange occurred with the head of Mission Assurance who resisted my efforts to come and brief the panel because he claimed he really didn’t manage a budget. My email back to the person charged with getting him to turn up read:
“I thought he told us he had $60m this year and $68m next and- oops — he forgot another $120m in there somewhere. So what does he mean “without funding and resources”? I thought he was the lead guy on mission assurance. If he is assuring no mission then he should go back where he came from. If he’s actually spending the tens of millions of dollars he claimed he had last time then he has a plan and must show it to us. What’s with this guy?”
Effectively, the system had united to expel the foreign body with the result that Maureen decided to leave, my three year term on the NSA Advisory Board was not extended and, as soon as I left, the Congressionally mandated panel no longer reviewed current projects but instead was given a meaningless mandate looking at future plans.
In June 2002, the HPSCI was holding hearings about the post-9/11 intelligence reforms. I wrote to the Committee and part of my email is worth quoting:
Within the IC there has been much finger-pointing about pre-9/11 but no accountability and no acceptance of responsibility (3,000 people died and nobody was fired). Everywhere I operate (NSA, DoD, CIA, NIMA, NRO) there was a spasm of effort to change the old ways of non-cooperation and concealment but now things have settled back into the usual routine. That argues a failure of leadership.
Everyone in every agency agrees that one of the basic questions is how the huge volume of information can be culled to produce the real gems of intelligence. What we know is that there was pre-9/11 intel around but it was never put together effectively either within agencies or between agencies. What is now happening? Every single agency that I know about is creating its own massive knowledge management solution. These efforts, which total many billions of dollars, are being run independent of each other, in competition with each other and are essentially addressing the same problem. The result will be a massive squandering of taxpayers’ money and a series of solutions that will fail to answer the whole problem and will instead likely exacerbate an already failing system.
Ironically, the Director of National Intelligence had been working hard to create a new program called ICITE (the Intelligence Community Intelligence Enterprise) which includes putting all the information silos in a single cloud architecture. Unfortunately, the work was never done on the front end to agree on data standards so agencies have been simply forklifting their data into the cloud in an effort to comply with the instruction to move to the cloud. The result has been the terrestrial silos are now replicated in the cloud and nothing much has changed.
The challenge for the intelligence community in general and NSA in particular is the bargain it makes with the people it serves. The world where that bargain can be trusted to the government of the day is over. The trust that the people have in their government has diminished such that a significant majority trust neither their government nor individual congressmen and certainly not the bureaucracy. As Stellar Wind clearly demonstrated, actions that NSA takes in the shadows will likely find the light of day and probably much sooner than the intelligence community would wish.
This is partly a fact of transparency: so much is available through so many different mediums, all of which can be Googled, that true secrecy, which was taken for granted just a generation ago, no longer exists. There has also been a shift in the relationship between some of the intelligence professionals and the organization which pays their salary.
Whatever Snowden’s psychology might be, he decided that it was his duty to betray the secrets that he had sworn to keep. In other words, he had a higher duty than simply that of service to the NSA. This generation of recruits who are coming into the IC on the back of rendition, torture and what many see as wholesale illegal surveillance of US citizens, can no longer be counted on for their unswerving loyalty. Instead, the IC will have to devise a new bargain which will require not just an order but persuasion and buy in.
After I left NSA, I continued working for various parts of the intelligence community on a range of projects that included cyber, psychological operations and rapid prototyping of some cool stuff. Many of those at NSA with whom I worked have remained friends and I have a great deal of respect for many of them. But, the institutional inertia that I found so frustrating remains in place. Projects routinely run late, management remains weak and billions of dollars are wasted while the organization continues with a playbook that was obsolete at the end of the last century.
There have been many technology improvements and some of the work done against the terrorist threat is very impressive but speed and agility are going to be critical as we move forward rapidly into a world where the Internet of Things is everywhere and for everyone, Artificial Intelligence goes mainstream, Virtual Reality becomes much of our world and our enemies have access to much of this at the same time as we do. Keeping ahead of the threat with proactive intelligence requires forceful, visionary leadership and a willingness to cast aside the old and embrace the new.
I see little sign of any real changes happening. Both CIA and NSA are reorganizing and this is being sold both to Congress and the public as essential change for the new world. But this is a fantasy and doesn’t begin to tackle the real issues at hand which is not simply hunting down the bad guys today but looking ahead to the new challenges that are just over the horizon.
When I left NSA, I sent a note to Hayden giving him my impressions of what I had learned and what I thought might be done better. It’s worth quoting at length because everything I said then remains relevant today (some of the names have been changed):
I wanted to close out with a debrief that includes my experience, thoughts and recommendations after three years of dealing with NSA. When I was a CEO, I made it a rule to debrief personally any senior person who I had either fired or who had chosen to leave so I could learn from their anger, frustration or happiness and apply those lessons going forward.
First, I want to reflect on my own poor fit with NSA. I am impatient and aggressive, handicaps that are often off putting and can appear as arrogance. I loathe confrontation but have learned how to steel myself to tackle hard problems head on and my style is clearly unsuited to a different culture. Impatience leads to a determination to speak honestly and forcefully as time is always short and I expect a vigorous dialog in the search for the right answer. While none of these handicaps or attributes have caused me too much difficulty in the past, they are unsuited to NSA which has grown to operate in a very different way. This difference in approach has caused me enormous frustration. I see things happen that in any other place would be summarily addressed but at NSA go either unnoticed or unpunished. I see a nation threatened and so many things that could be done to provide better security and yet so little actually happens. I also fully accept that if I advance into the front line and lead the attack, I must expect to be shot and accept that fate.
You as Leader
You are a powerful visionary and as such have been able to bring insiders and outsiders along with you as you have tried to move NSA forward. But as the NSAAB observed some time ago, you are not an executioner and so to fully articulate a vision you needed to hire a COO. Rather than getting somebody from industry who has actually executed against a strategic vision for a large organization, you chose an insider who had a reputation for stirring things up. The reality is that your choice is not a COO in any sense of the term. This is a view shared by the NSAAB and by every leader inside NSA and those outside who work with the organization. An easy way to measure this is to ask yourself what plan has your COO delivered to your desk that sets out every major goal and how he is going to deliver against those goals and be measured for effectiveness. The reality is that I am not aware of a single major program that is on target and on budget. In any organization, it is the COO who is held accountable for such a record.
The Structure
I was shocked when I saw a chart a few months ago that set out the numbers of people who report to you. I recall I counted about 26. There is no organization I have ever come across where the CEO has 26 direct reports. A requirement of direct reports is that you meet with them every week, probably for an hour or so, to check on how they are doing and to provide direction. You cannot and should not do that for 26 people. At most, you should have five direct reports (CFO, COO, CTO and, in your case, SID and IA). The consequence of your structure is that you cannot lead effectively and the structure is too unwieldy to operate smoothly. Hence, accountability does not exist and lines of responsibility are unclear — the two things you were determined to change.
Another consequence of such a structure is that you come to be seen as remote and disinterested, something you might find a surprise. The three most senior people who have resigned would all say, if you had asked, that they felt unsupported by you. It’s simply not enough to say that people are left in their jobs and that is visible evidence of your support. Did you know that Maureen got married a couple of weeks ago? Did you send her a present or a card? If the answer to both questions is no, you should ask yourself why. You are obviously familiar with the analogy of the cavalry general who comes in from a campaign and first makes sure his men have food, then that the horses have food and water, then that his horse has food and water and then he takes care of himself. I have never been so lonely as when I was at the top of the tree and part of the reason is that everyone else came first.
Communications
You have proved to be a good communicator. But, to be effective, a communications strategy has to constantly evolve both to keep those receiving data engaged and to apply lessons learned. Based on available feedback, this has not happened. For example, a recent survey conducted by some folks in HR revealed that a very high percentage of people did not understand where NSA was going or why. ASnd, more disturbingly, a similarly high percentage of senior NSA people either did not understand what was happening or had no confidence in the plan or both.
Leadership
The caliber of leaders in NSA remains lamentable. I know you appreciate this is a problem, but I’m not clear if you know how bad it really is. I’ve now received dozens of briefings and I can count on one hand the number of people I have met who I would hire to a position of responsibility. By and large, NSA managers, who are often passionately committed, just do not understand what is required of a leader. And why should they? They have no proper training, no peers to emulate and no outside experience. Yet all, in my experience, are eager to learn. Leadership remains such a problem because the existing leaders, including you, give it such a low priority. For example, a year or so ago, we had a conversation about leadership and you agreed that something should be done. I introduced you to someone and you agreed to move forward, delegating it to someone else to make it happen. After three months of promises, assurances and inaction, my guy moved on with his life nothing having been done. What happened to the person who casually disregarded your precise instructions because, as I understand it, “she didn’t want to do it.”? Nothing. So there is a clear message you can disregard the Director and there is no consequence so why should anybody obey anybody about anything?
Another example is the way Frank handles Congress. He gave very specific instructions to a team briefing Congress not to tell the truth about a program. I was in the briefing, saw it unfold and was appalled by my first direct insight into relations between NSA and Congress. I taxed him about it afterwards and his view seemed to be that Congress had no right to know the truth (if Frank worked for me and had done such a thing, I would have fired him on the spot). The Technology Panel made some recommendations which were passed to Frank for action. He lied to his staff about what he had been told to do and simply ignored the instructions of his superior. It was the view of the Technology Panel that every program for which Frank has responsibility is in trouble and he appeared to have no understanding of how to resolve matters and the Panel felt he should be fired. Frank took the COO out to dinner, the COO tells Maureen that nothing can be done to Frank and so a signal is sent that there is no accountability for a lack of integrity and incompetence. A sad message for an organization that has truth as a core value.
Programs
Almost without exception, the programs reviewed by the Technology Panel were seen as inadequately planned, poorly executed to time and budget with unclear outcomes and a blurred strategy. The result is a wholesale squandering of scarce resources of people and cash. In 25 years in business, I have never seen such waste or lack of concern about what, in any other business, would result in a collapse in the share price and an inevitable slide into bankruptcy. This may be my government at work, but it is something that truly appalled the Technology Panel and has always outraged the NSAAB.
It seems to me that this goes to the heart of your business. You are as familiar as I am with the exponential increase in the rate of technology change. Every analysis I’ve read seems to accept that Moore’s Law will continue for some time. Or, to put this another way, in the first decade of this century we will experience a thousand times the technological progress achieved in the whole of the 20th century. This has profound implications for your business which can simply be described as an urgent need to meet and embrace change as a constant. Indeed, when you first stepped up as Director, you explicitly recognized this by creating Trailblazer which, as I recall, was to be a piratical enterprise that would force change on the rest of the business and produce its first product within six months. Here we are three years later with no product and Trailblazer seen as a symbol for everything that is wrong about NSA (expensive, all process and no product, behind the technology curve, poorly managed etc.) This matters because by the time programs like Trailblazer and others finally deliver something, they will already be irrelevant. And unless NSA grips this basic issue, NSA itself is ensuring its own demise as the gap between relevance and obsolescence grows daily.
Yet, when you consider what NSA has done since 9/11, it is obvious that there is a rich reservoir of talent at NSA that can do wonderful things. The question to be asked though is not what NSA has done since 9/11. Instead, the question is what is being done now that could not or should not have been done five years ago. I recall very clearly being given a briefing a year or two ago about how terrorists communicate. I asked a question then about their use of computers and the Internet and was assured that it was insignificant. And where do we get much of our intelligence today? So, the answer to the question was not only wrong but I suspect it was wrong because nobody had looked properly. Why? Because to look and find out the answer that nobody wanted would have threatened existing programs. NSA must be out on the edge leading the way against an enemy who is changing very fast, is inchoate and will use all the opportunities that technology has to offer to exploit our weaknesses. These are the very weaknesses that NSA must try to secure with timely, proactive intelligence.
The Threat
All this needs to be laid against a rapidly evolving threat. Yet, I have been struck by how little has really changed since the end of the Cold War. To me, it is truly inconceivable that the relative market value of the different branches of the intelligence community have remained the same post-Cold War. And despite the recognition that better sharing of information and better analysis is vital, I’ve been briefed by NSA, CIA, NRO and NIMA who are all working on parallel programs to solve the same problem at huge cost and little apparent concern for the collective national need.
And now we have the Department of Homeland Security which will have its own intelligence function, ostensibly to act as gatherer and distributor of actionable intelligence. That sounds remarkably like what the DIA was supposed to do for the military and all it did was create another huge bureaucracy. Ah well.
I hope that some of this you can accept as useful. I write this to you with all the passion I brought to NSA three years ago. That passion is undimmed as is my devotion to country, community and the protection of this great nation.
I never received a reply.
Recommendations
Create a management structure that reflects NSA’s role as a business operating in a market. The Director must have an intelligence background but also understand both business and leadership. The line management direct reports (COO, CFO, CTO) come from the private sector (but not from the big consulting firms) with two other Directors (IA and SID) from within NSA.
Develop a leadership cadre with a consistent program that sponsors the best and brightest to take leadership courses as well as spending time in high technology companies in the private sector.
Develop a new strategy designed around three questions: What does the customer want; what is already publicly available; and what adds the most value?
NSA has Tailored Access Operations who do clever and very secret operations to gain access to networks. The CIA has the Information Operations Center which does roughly the same thing. The CIA has also recently created a Directorate of Digital Innovation that has absorbed the IOC and the Open Source Center. There is huge duplication between CIA and NSA which simply further institutionalizes the rivalry and waste of money and people that has gone on for decades. NSA should become the single center for all electronic interception and analysis.
Abandon the current plan to combine Signals Intelligence with Information Assurance. Signals Intelligence (the gathering, decrypting and analysis of data) is a separate function from Information Assurance. Instead, IA should be a function carried out jointly with the private sector where much of today’s knowledge resides.
Sever the joint leadership of NSA and Cyber Command. NSA can be either a national intelligence agency or an arm of Cyber Command but not both. The current relationship is endangering the nation’s cryptologic capability and weakening both NSA’s signals intelligence mission and its information assurance mission.
Increasingly, intelligence collection is becoming a commodity that can and is provided by entities outside of the intelligence community. The IC discriminator it that it can bring the entire information space (classified and unclassified) to bear on answers for decision-makers. Re-establish the IC as an expert analytic community instead of a collection community and organize it accordingly.
Create a joint public/private sector partnership to evaluate and integrate technology.
Any reorganization by NSA must fit into the broader context of the intelligence community as a whole. For 70 years, the IC has developed largely in isolation from the rest of government and certainly out of sight of the citizens it is supposed to serve. We live in a new world of transparency that, for the first time, allows for a real conversation about what this country needs in terms of intelligence and how the best value can be provided with the money available. In the next section I will take a look at the community as a whole and show just why reform is needed urgently if we are to successfully meet the many threats that confront us now and in the future.
