The new federal strategy for implementing cloud-computing solutions is called “Cloud First”— and with good reason. We now systematically prefer cloud-computing solutions to those based on local servers and laptops. The allure of efficiencies, economies of scale, high-end services and — most importantly — reduced costs are almost irresistible.
But, as American governments at the federal, state and local levels rush headlong toward cloud computing, wouldn’t it be wise to pause and ask, “What’s at stake?”
From a security perspective, as a former director of the National Security Agency charged with stealing other nation’s secrets while protecting our own, I believe these stakes are high and the costs of a mistake particularly grave.
The current structure of the Internet is fundamentally open — open in terms of access and open in terms of use. But this openness has consequences. As deputy secretary of Defense William Lynn said in a speech announcing our military’s Strategy for Operating in Cyberspace: “The Internet was designed to be open, transparent, and interoperable. Security and identity management were secondary objectives in system design. This lower emphasis on security in the Internet’s initial design … gives attackers a built-in advantage.”
The transition to the cloud gives us a chance to change that flawed security paradigm. We can, if we choose to, build in more powerful security principles from the beginning as integral components of cloud architecture. Where more sophisticated and costly security solutions are too expensive for an individual user (or small network), they are more affordable when the costs are distributed among a larger group of users.
Published for The Wall Street Journal, June 2nd, 2011:
The latest lunacy to get a popular hearing is the idea that harsh CIA interrogations yielded no useful intelligence. I guess we should toss out the 9/11 Commission Report.
For all of its well-deserved reputation for pragmatism, American popular culture frequently nurtures or at least tolerates preposterous views and theories. Witness the 9/11 “truthers” who, lacking any evidence whatsoever, claim that 9/11 was a Bush administration plot. And then we have the “birthers” who, even in the face of clear contrary evidence, take as an article of faith that President Obama was not born in the United States and hence is not eligible to hold his current office.
Let me add a third denomination to this faith-based constellation: interrogation deniers, i.e., individuals who hold that the enhanced interrogation techniques used against CIA detainees have never yielded useful intelligence. They, of course, cling to this view despite all evidence to the contrary, despite the testimony of four CIA directors, and despite Mr. Obama’s chief counterterrorism adviser John Brennan’s statement that there’s been “a lot of information that has come out from these interrogation procedures that the agency has in fact used against the real hard-core terrorists.”
The recent dispute over what strains of intelligence led to the killing of Osama bin Laden highlights the phenomenon. It must appear to outside observers like a theological debate over how many angels can reside on the head of a pin. So we see carefully tailored arguments designed to discount the value of enhanced interrogations: the first mention of the courier’s name came from a detainee not in CIA custody; CIA detainees gave false and misleading information about the courier; there is no way to confirm that information obtained through enhanced interrogation was the decisive intelligence that led us directly to bin Laden.
As published for The Washington Post on January 31st, 2010:
In the war on terrorism, this country faces an enemy whose theory of warfare ends the hard-won distinction in modern thought between combatant and noncombatant. In doing that for which we have created government — ensuring life, liberty and the pursuit of happiness — how can we be adequately aggressive to ensure the first value, without unduly threatening the other two? This is hard. And people don’t have to be lazy or stupid to get it wrong.
We got it wrong in Detroit on Christmas Day. We allowed an enemy combatant the protections of our Constitution before we had adequately interrogated him. Umar Farouk Abdulmutallab is not “an isolated extremist.” He is the tip of the spear of a complex al-Qaeda plot to kill Americans in our homeland.
In the 50 minutes the FBI had to question him, agents reportedly got actionable intelligence. Good. But were there any experts on al-Qaeda in the Arabian Peninsula in the room (other than Abdulmutallab)? Was there anyone intimately familiar with any National Security Agency raw traffic to, from or about the captured terrorist? Did they have a list or photos of suspected recruits?
When questioning its detainees, the CIA routinely turns the information provided over to its experts for verification and recommendations for follow-up. The responses of these experts — “Press him more on this, he knows the details” or “First time we’ve heard that” — helps set up more detailed questioning.
As published for the Washington Times on August 20, 2009:
Early next week the Obama administration is expected to release another collection of documents on the U.S. government’s detention and interrogation of al Qaeda terrorists. The documents will likely include a lightly redacted version of the CIA inspector general’s 2004 report on the program, more Department of Justice legal opinions (including the 2007 opinion on which I relied while director of CIA), as well as some reporting on the overall effectiveness of the program.
Many intelligence professionals are simply asking: “Why?”
Indeed, in his own recent op-ed, CIA Director Leon E. Panetta noted that one of his Western allies had recently asked him why Washington seemed to be so consumed with what CIA had done in the past given all the challenges of the present.
There is no simple (or good) answer to that question, but most professionals at Langley knew that more of these kinds of releases were inevitable once the president decided in April to release DOJ memos that revealed substantial details of the interrogation program. If those once highly classified facts would no longer be protected, what would be? Where was the line?
As published for the New York Times on July 27, 2009:
THE recent report of inspectors general on the President’s Surveillance Program operated by the National Security Agency has led some to make hasty and deeply flawed judgments about the value and legality of what was a critical part of protecting America from further attack after Sept. 11.
The program was crucial in addressing one of the most stinging criticisms of the 9/11 commission — the need to reduce the gap between foreign intelligence and domestic security. This was an especially difficult task, which helps explain both the program’s importance and its sensitivity. The program was lawful, effective and necessary.
The reflexive judgments to the contrary seem hasty at best. Although the inspectors general report notes that the compartmented nature of the program hurt its utility (it should be noted that restricting access to especially sensitive data is hardly a unique phenomenon in an intelligence community that forever has to balance using information and protecting it), it also notes that users of the information rated the program “of value,” “useful” and a “key resource,” albeit one that was most often used in combination with other intelligence sources.
Intelligence professionals call that “connecting the dots,” something for which we were roundly criticized after Sept. 11 as not sufficiently doing. The report also suggested that there were counterterrorism successes associated with the program but that these could not be discussed in an unclassified venue. Although little commented on, the report also mentions that “even those read into the program would have been unaware of the full extent” of reporting.
The point of interrogation is intelligence, not confession.
The Obama administration has declassified and released opinions of the Justice Department’s Office of Legal Counsel (OLC) given in 2005 and earlier that analyze the legality of interrogation techniques authorized for use by the CIA. Those techniques were applied only when expressly permitted by the director, and are described in these opinions in detail, along with their limits and the safeguards applied to them.
The release of these opinions was unnecessary as a legal matter, and is unsound as a matter of policy. Its effect will be to invite the kind of institutional timidity and fear of recrimination that weakened intelligence gathering in the past, and that we came sorely to regret on Sept. 11, 2001.
Proponents of the release have argued that the techniques have been abandoned and thus there is no point in keeping them secret any longer; that they were in any event ineffective; that their disclosure was somehow legally compelled; and that they cost us more in the coin of world opinion than they were worth. None of these claims survives scrutiny.
