by Shane Harris
McConnell explained the principles of information warfare to the president. There was something called “computer network exploitation.” This involved stealing and manipulating an enemy’s data, and the NSA traditionally handled that function. Then there were outright “computer network attacks,” hacking into a system and disrupting or disabling its ability to function. That also fell to the Defense Department, which commanded a little-publicized task force to conduct what the Pentagon benignly referred to as “global network operations.” Taken together these two pillars formed the bulk of offensive operations in cyberspace.
McConnell didn’t only explain the tactics of information warfare, he told Bush why they worked. Cyberattacks targeted the devices that were most essential to a nation’s survival and prosperity—phones, computers, and data networks—but also systems that ran critical infrastructures over the Internet. Electrical stations, dams, and air traffic control were all vulnerable to electronic attack. The U.S. government and many large corporations knew firsthand what havoc a cyberattack could cause to this interconnected system. Their networks had been penetrated by hackers in the past several years at an alarming rate. Secrets had been stolen. Operations disturbed. Intelligence officials had collected evidence that they believed showed hackers based in China, working on behalf of the People’s Liberation Army, had wormed their way into the systems that ran electrical generators and the power grid in the United States. The Iraq insurgency depended on a functioning global information network just as the Americans did. And because the system was vulnerable, so were the insurgents who used it.
Bush was impressed. He gave McConnell the go-ahead to begin an information operation in Iraq, the details of which would remain one of the most closely guarded secrets in the military and intelligence communities. As the plan unfolded in the coming months officials credited it with helping U.S. forces track and kill insurgents by compromising their basic communications tools and, in some instances, turning those tools against them. The information operation was credited as one of the most successful aspects of the “surge” Bush ordered in a last-ditch effort to stave off a civil war.
Bush was impressed by the power of these new tactics, but he was also visibly unnerved by the vulnerabilities that McConnell had just described. If the insurgents were this exposed, what about the United States? These phone systems are vulnerable? the president asked. He pointed to the secure phone that sat on his desk. Someone could hack into that?
Bush looked around the room at his trusted advisers. Well . . . yes, they appeared to say. McConnell certainly knew that. At the NSA he’d helped develop the techniques for cracking other nations’ phones. He turned to the president and said, “If the capability to exploit a communications device exists, we have to assume that our enemies either have it or are trying to develop it.”
It was a rude awakening for the commander in chief. Bush, like his predecessors, had never really taken network security seriously because no one had broken through to him as dramatically as McConnell just had. Almost a quarter century had passed since John Poindexter wrote a presidential directive appointing a new official to protect government information, and the system was more vulnerable than ever. McConnell had come into the Oval Office ready to talk about offensive tactics. But suddenly, and quite unexpectedly, he had a rare chance to educate the president about the third and final pillar of information warfare: “computer network defense.”
Ever since leaving the NSA in 1996, McConnell had been thinking about how computer attackers, whether nation-states, terrorists, or criminals for hire, could effectively bring down major U.S. infrastructures or corporations. At Booz Allen he had built a cybersecurity practice that paid particular attention to the financial sector. Working with officials from the New York Stock Exchange, McConnell developed a report on network vulnerabilities that might allow hackers to break into major banks and then steal or—worse, he thought—alter data, so that the entire system of trust and assurance upon which the U.S. economy rested would be eviscerated. McConnell delivered the report to the government; officials found it so revealing that they decided to classify it lest it give ambitious hackers any bright ideas.
McConnell could see that the president was ready to hear the worst about how poor America’s cyberdefenses really were. He turned to Bush and said, “If the 9/11 perpetrators had focused on a single U.S. bank through cyberattack, and it had been successful, it would have had an order of magnitude greater impact on the U.S. economy than the physical attack.”
Bush looked shocked, and he seemed incredulous. He turned to Paulson, the secretary of the treasury and the former chairman and CEO of Goldman Sachs. “Is this true, Hank?” Bush asked. Paulson assured him that it was. In fact, he said, his worst fear at Goldman was that some intruder could manipulate the data of a major financial institution so that no one could be sure it was accurate. That could utterly destroy trust and confidence upon which the entire U.S. economy depended. (A year and a half later Paulson would preside over an economic catastrophe that came not at the hands of hackers but of incautious lenders, borrowers, and bond traders, whose faulty assumptions about risk and reward nearly caused the financial system to melt down.)
Bush stood up from his chair. “This is our competitive advantage for the next seventy to a hundred years,” he said to the room. “Certainly we have to do what’s necessary to protect it.” Bush turned to his intelligence director. “McConnell, you brought this in here. You’ve got thirty days to develop a plan. We’ll do another Manhattan Project if we need to.”
McConnell had an idea where to start. The Defense Department had managed to secure its internal networks by limiting their connections to the public Internet, down to a mere eighteen gateways, McConnell explained. His old agency, the NSA, had an “exploit capability” that it used to find malicious signals emitted by viruses and worms that foreign hackers launched against computers in the United States. The trick was distinguishing those threatening signals from the harmless information that sped around the globe. The NSA knew how to find those signals in the noise, he explained. The agency could start looking for foreign threats to American utilities, electrical stations, and financial organizations coming through those eighteen gateways used by the Defense Department and then block them. Cyberanalysts had developed tools and techniques for warfare that now could be brought to bear for civilian defense. The NSA could work in cooperation with another Defense Department agency that had statutory authority to protect military networks, and also with the Homeland Security Department, which was the only department legally allowed to work with U.S. companies and utilities to set up cyberdefenses. Homeland Security lacked the resident cyberexpertise and political clout to do the job effectively. The NSA would provide the technical assistance to the department, McConnell said. As long as the NSA wasn’t officially in the lead, and was monitoring attacks coming in from abroad, then it was operating within its legal limits.
McConnell knew the political dangers and how the headline news of a bold, new cyberinitiative would play: “NSA spies monitoring U.S. computers for hackers.” The smell test stank already. McConnell believed that despite Americans’ love of spy novels and James Bond movies, they mostly associated intelligence with duplicity and dirty dealings. And lately they associated it particularly with illegal surveillance. People seemed to think that intelligence was something nice to have in a crisis but not something to sustain, he thought. The Berlin Wall had come down in November 1989, and by the next month Washington was full of talk about a peace dividend. The intelligence budgets were slashed in the 1990s. Staff pruned back. The system had atrophied, McConnell thought. He decided that it was his job to build it back up.
But McConnell also thought that if the administration didn’t handle this program delicately, it could backfire. At some point they’d have to face the far more daunting question of how to guard against domestic cyberthreats. That would mean rewriting privacy laws and enacting a slew of regulations, and having a pub
lic debate that would make the Clipper chip look like an academic discussion. But that was a battle for another day, and maybe another intelligence director.
It took ninety days for McConnell, the White House, and the intelligence community to come up with a plan for the president. Bush signed an executive order giving the NSA the go-ahead to stand guard on the Internet gateways. The plan was eventually dubbed the Comprehensive National Cybersecurity Initiative. Initial estimates pegged the price tag of a full defense system at tens of billions of dollars. A second component called for slashing the number of Internet gateways used by civilian government agencies from more than a thousand down to fifty. From the outset the plan was so ambitious and complex that it was guaranteed to outlast Bush’s presidency. It was an unprecedented reach of authority for what McConnell thought was an unprecedented threat. The spy chief truly believed that he had protected the rule of law and the security of the nation. But another fight, one that McConnell had in some ways been preparing for his entire professional life, would finally test the balance between those often competing interests.
McConnell was more familiar than most spies with the Foreign Intelligence Surveillance Act, but he hardly knew the law inside and out. That was because, as director of the NSA, he had rarely used it. Most of the agency’s work was directed at foreign targets—non-U.S. persons located overseas. FISA came into play when the government wanted to monitor people inside the country.
The 9/11 attacks had turned that arrangement on its head. McConnell knew from the New York Times that his old agency was in new waters. The president’s secretive terrorist surveillance program had become a public spectacle, and it had imperiled both the NSA and the administration. As McConnell prepared to return to government, it was his opinion that Bush had not been well served by the framing of the program in its early stages. The more appropriate step, he thought, would have been for administration officials to work with Congress to amend FISA back in 2001, at the same time they were making changes to surveillance rules through the Patriot Act. That sweeping piece of legislation passed with near unanimous agreement in Congress. There was every reason to believe that lawmakers would have been equally accommodating with FISA.
McConnell considered himself a civil libertarian. He grew up in segregated South Carolina, where his father was a union organizer and an outspoken progressive. Black men and women were frequent guests at the McConnells’ dinner table, which probably couldn’t be said about most of the other families in the neighborhood. And the conversations around that table were filled with the father’s advice to the son; how he should be thinking about the world around him, whom he should be emulating. Once, while driving with his dad in Greenville, McConnell looked up at a billboard on the side of the highway: “Impeach Earl Warren,” it read.
“Dad, who’s Earl Warren?”
“He’s the chief justice of the Supreme Court.”
“Well, why do they want to impeach him?”
“Because he’s for integration.”
Throughout the South “wanted” posters of Warren proclaimed him “a dangerous and subversive character” at whose “instigation federal marshals and bayonet-equipped federal troops have been employed to terrorize and intimidate white citizens opposed to his integration decrees.” As far as McConnell’s father was concerned, the chief justice was probably the kind of man his son should try to be. Courageous. An unapologetic arbiter of the law. As McConnell got older and went off to college, Justice Hugo Black became one of his heroes for his stance on integration, expressed most famously in the unanimous Brown v. Board of Education decision. Black was a paradox to McConnell, and an unlikely champion for civil rights. As a young politician in Alabama, he’d joined the Ku Klux Klan to win votes, and in the Senate he’d participated in filibusters of antilynching bills. But Black eventually disavowed his former affiliations, and on the Court he distinguished himself as a literalist, a strict interpreter of the Constitution and an ardent supporter of the rule of law. That endeared him to McConnell, who prided himself as possessing those same qualities.
McConnell’s bedrock values were shaken when, as a young intelligence officer, he had learned that the FBI had secretly tapped the phones of both Warren and Black, under orders from bureau director J. Edgar Hoover. It was a searing experience. McConnell would later tell people that “my community” had spied on two men he admired because of how they thought and what they said. Intelligence was McConnell’s trade, but it could be a rotten business. By the time he took over at the NSA, he was well acquainted with the agency’s own dark days, as was the nation. For thirty years NSA analysts had received daily copies of international telegrams sent to and from the United States. The covert program, known as Operation Shamrock, was believed to have collected 150,000 messages per month at its peak. The NSA had access to almost all the international telegrams of Americans. In scenes reminiscent of the days after 9/11, representatives from the Army Signals Security Agency, the NSA’s predecessor, approached telegraph companies in August 1945 asking for access to their traffic and their facilities. The companies’ lawyers advised that such interceptions would be illegal in peacetime, but executives agreed to participate after they received the personal assurances of the attorney general, and later the president, that their participation was in the highest interest of national security, and that the companies would be protected from lawsuits should the secret ever get out. The government told the executives that the program was only monitoring foreign targets, but Americans’ communications were routinely swept up and disseminated throughout the intelligence community. Some Americans’ names ended up on “watch lists” of political undesirables. The watching didn’t stop until 1975, when Shamrock was exposed in a wave of hearings on intelligence abuses, the same hearings that led to the passage of FISA.
McConnell was schooled in these scandals, as were all intelligence officers of his generation. The mistakes of the past formed a kind of baseline for how to conduct operations. Targeting Americans for political purposes was forbidden. When officers said that the intelligence community “didn’t spy on Americans,” that’s usually what they meant. Targeting Americans because they might be terrorists, however, was never out of bounds. FISA had been created to allow such surveillance and to keep it under the rule of law. But after 9/11 the law failed, both as a check on unlimited executive power and as a tool that the government could use to successfully monitor threats. McConnell thought that FISA had to be fixed, as part of a fundamental overhaul of the intelligence community. He outlined his vision in an essay for Foreign Affairs magazine. Channeling his former colleague John Poindexter, McConnell declared that the agencies should jettison archaic techniques and laws. The walls that had separated foreign and domestic intelligence were coming down, and now was the time to finish the job. “Sticking rigidly to these historical distinctions would be a serious impediment to protecting U.S. national security,” McConnell wrote. He called for more investment in cutting-edge technologies “to access and process vast amounts of digital data to find terrorist-related information.” He praised efforts being run by the outfits now under his command that took over TIA. And he took on the unresolved debate over when, and how, to spy on Americans, casting it as an integral part of the intelligence community’s evolution. “Another challenge is determining how and when it is appropriate to conduct surveillance of a group of Americans who are, say, influenced by al-Qaeda’s jihadist philosophy. On one level, they are U.S. citizens engaging in free speech and associating freely with one another. On another, they could be plotting terrorist attacks that could kill hundreds of people. . . . The intelligence community has an obligation to better identify and counter threats to Americans while still safeguarding their privacy.”
As McConnell saw it, amending FISA would be the first and perhaps most important step. The law had been tweaked in the past. But Congress had never undertaken a fundamental revision to bring the law in line with twenty-first-century technology. McConnell wanted a cra
ck at that. But while he was preparing for his confirmation hearings, the administration did an about-face on warrantless surveillance, one that seemed to render the debate over amending FISA moot.
On January 10, 2007, a judge on the secretive FISA Court issued orders that essentially blessed much of what the administration had already been doing under its own authority. Without revealing any technical details of the arrangement, Attorney General Alberto Gonzales wrote to the Judiciary Committee a week later and said that the administration had submitted the program to court review. It was now operating under the supervision and authority of a judge.
Gonzales asserted that as early as the spring of 2005, well before the New York Times blew the NSA’s cover, the administration had been looking for some way to bring its secret operation before the court and still maintain “the speed and agility necessary to protect the nation from Al Qaeda.” Now, Gonzales said, they’d found their solution. Gonzales never mentioned whether the Democrats’ recent takeover of Congress might have motivated the administration to move with particular haste, so as to avoid an onslaught of oversight hearings and investigations.
The judge’s orders, Gonzales wrote, were “innovative” and “complex.” It had taken “considerable time and work” for the administration to come up with an approach that would meet its needs and still pass judicial muster. The White House press secretary acknowledged that the NSA program “pretty much continues.” And a senior Justice Department official told reporters that neither the “objectives” nor the “capabilities” of the program had changed because of the judge’s orders. Problem solved.
