“Risk Avoidance” Leads to Over-Classification

When government officials consider whether to classify national security information, they should not aim for perfect security, according to new guidance from the Office of the Director of National Intelligence. Instead, classifiers should seek to limit unnecessary vulnerabilities, while keeping broader mission objectives in view.

“A Risk Avoidance strategy — eliminating risk entirely — is not an acceptable basis for agency [classification] guides because it encourages over-classification, restricts information sharing, [and] hinders the optimal use of intelligence information in support of national security and foreign policy goals,” the ODNI document said.

Rather, “All agencies should reflect in their classification decisions a Risk Management strategy — mitigating the likelihood and severity of risk — in protecting classified information over which they have [classification authority], including clear descriptions in their classification policies of how the strategy is used when making classification determinations.” See Principles of Classification Management for the Intelligence Community, ODNI, March 2017.

This risk management / risk avoidance dichotomy in classification policy has been batted around for a while. It was previously discussed at length in in the thoughtful but not very consequential 1994 report of the Joint Security Commission on Redefining Security in the post-cold war era.

“Some inherent vulnerabilities can never be eliminated fully, nor would the cost and benefit warrant this risk avoidance approach,” the Commission wrote. “We can and must provide a rational, cost-effective, and enduring framework using risk management as the underlying basis for security decision making.”

In short, it is only realistic to admit that some degree of risk is unavoidable and must be tolerated, and classification policy should reflect that reality.

But the risk management construct is not as helpful as one would wish. That is because its proponents, including the Joint Security Commission and the authors of the new ODNI document, typically stop short of providing concrete examples of information that risk avoiders would classify but that risk managers would permit to be disclosed. Without such illustrative guidance, risk management is in the eye of the beholder, and we are back where we started.

Meanwhile, there is persistent dissatisfaction with current secrecy policy within the national security bureaucracy itself.

Classifying too much information is “an impediment to our ability to conduct our operations,” said Air Force Gen. John Hyten of U.S. Strategic Command at a symposium last week (as reported by Phillip Swarts in Space News on April 6).

“We have so many capabilities now,” Gen. Hyten said. “There are all these special classifications that I can’t talk about, and if you look at those capabilities you wonder why are they classified so high. So we’re going to push those down.”

Proposed NSA Headquarters Expansion Under Review

The National Security Agency is proposing to expand and modernize its headquarters site at Fort Meade, Maryland.

“For NSA/CSS to continue leading the Intelligence Community into the next 50 years with state-of-the-art technologies and productivity, its mission elements require new, centralized facilities and infrastructure,” according to a newly released Final Environmental Impact Statement for the site.

Under the proposed action, “The NSA would consolidate mission elements, which would enable grouping services and support services across the NSA Campus based on function; facilitate a more collaborative environment and optimal adjacencies; and provide administrative capacity for up to 13,300 personnel, including 6,100 personnel who currently work on the existing NSA Campus and 7,200 personnel currently located off site.”

The proposal envisions the construction and operation of “approximately 2,880,000 square feet of operational complex and headquarters space consisting of five buildings.” If approved, construction would take place “over a period of approximately 10 years (FY 2019 to 2029).”

See Final Environmental Impact Statement for the East Campus Integration Program, Fort Meade, Maryland, March 2017 (large pdf).

Deterring, and Relying Upon, Russia

In confronting Russia and rebutting its claims, the United States is hampered by unnecessary or inappropriate classification of national security information, according to former Pentagon official and Russia specialist Evelyn Farkas.

“We are not very good at declassifying and reclassifying information that is not propaganda, showing pictures of what the Russians are doing,” Dr. Farkas told the House Armed Services Committee last year.

“We did it a couple of times, and interestingly, the Open Skies Treaty was actually useful because, unlike satellites, that is unclassified data that is gleaned as a result of aircraft that take pictures for the purposes of our treaty requirements.”

“But in any event, I think that we can do more just by getting some information out. That is the minimum that the State Department could do and should do, together with the intelligence community. But it should also be a push, not a pull–not leaders like yourselves or executive branch members saying, ‘Declassify that,’ but actually the intelligence community looking with the State Department, ‘What should we declassify?’ not waiting for somebody to tell them to do it,” she said.

See Understanding and Deterring Russia: U.S. Policies and Strategies, House Armed Services Committee, February 10, 2016 (published January 2017).

The same hearing featured testimony from Fiona Hill of the Brookings Institution. She has just been offered a position in the Trump White House as senior director for Europe and Russia, Foreign Policy reported today. See Trump Taps Putin Critic for Senior White House Position, by John Hudson, March 2.

“Putin is a professional secret service operative,” Ms. Hill told the House Armed Services Committee. “He is very unusual among world leaders at present. Putin has also been trained to conceal his true identity and intentions at all times. This is what makes him particularly difficult to deal with.”

Meanwhile, yesterday the National Reconnaissance Office successfully launched a new U.S. spy satellite aboard an Atlas V rocket — that was powered by a Russian RD-180 engine. (“All in a day’s work,” tweeted Bill Arkin.)

Though it might seem incongruous that U.S. intelligence collection would be dependent on Russian space technology, that is how things stand and how they are likely to remain for some time.

“Goodness knows we want off the Russian engine as fast as any human being on the planet,” said Gen. John E. Hyten of US Air Force Space Command. “We want off the Russian engine as fast as possible.”

But there is a but. “But, asking the American taxpayers to write a check for multiple billions of dollars in the future for an unknown is a very difficult thing to do, and for the Air Force, that will be a very difficult budget issue to work,” Gen. Hyten told the House Armed Services Committee last year.

Pentagon official Dyke Weatherington concurred: “The Department continues to be dedicated to ending use of the Russian manufactured RD-180 engine as soon as reasonably possible, but still believes that access to the RD-180 while transitioning to new and improved launch service capabilities is the optimal way forward to meet statutory and Department policy requirements for assured access to space in both the near and long term.”

Even a new US-manufactured rocket engine will not suffice, Mr. Weatherington added. “Any new engine still has to be incorporated into a launch vehicle. The Department does not want to be in a position where significant resources have been expended on an engine and no commercial provider has built the necessary vehicle to use that engine.”

Their testimony was presented at a 2016 hearing on military and intelligence space programs that has recently been published. See Fiscal Year 2017 Budget Request for National Security Space, House Armed Services Committee, March 15, 2016.

Army Intelligence: A Look to the Future

Collection of more intelligence-related information does not necessarily translate into better intelligence.

“Because of limitations associated with human cognition, and because much of the information obtained in war is contradictory or false, more information will not equate to better understanding.”

What makes that sensible observation doubly interesting is that it was written by Lt.Gen. H.R. McMaster, the newly designated National Security Advisor to President Trump.

It appears in the Foreword to the updated U.S. Army Functional Concept for Intelligence, 2020-2040, TRADOC Pamphlet, 525-2-1, February 2017.

The Army document, a somewhat speculative and aspirational look into the future of Army intelligence, presents a stark view of future threats, projected intelligence gaps, and directions forward. Some excerpts:

“International conditions will change more rapidly based on the increased velocity and momentum of human interactions and events. Technologies will become universally available and create a potential to overmatch U.S. capabilities. Weapons of mass destruction (WMD) proliferation among state and nonstate actors will pose an increased threat to U.S. security interests. Advanced cyberspace and counter-space capabilities will spread to state and nonstate actors, allowing them to protect their access and disrupt or deny access to others. Operations will occur among populations in cities and complex terrain.”

“Geospatial databases support the understanding of existing infrastructure and potential entry points but do not fully address the complexities of large urban centers, such as megacities. Country studies establish an overview, but city studies and transnational studies are lacking. While infrastructure and order of battle information remain valid, understanding networked and transnational enemy organizations, social media, and biometric identity information have equal or greater importance in some missions. Commanders must also understand critical infrastructure, assets, and terrain in the cyberspace domain. Nonstate ideological movements or political competition may drive national and subnational change more rapidly than conventional analysis may indicate. Proliferation of technology and WMD between states and nonstate actors disrupts normalcy faster than country studies can update.”

“Current information collection techniques are not robust enough to understand the rapidly changing urban environment. The speed of human interaction is greatest in a large urban environment. Operations in urban environments are not traditional adversary centric problems — the environment itself offers significant challenges to a conventional force and provides ample concealment to the enemy. Social networking, flows, infrastructure layering, radical variations by neighborhood, multiple authority structures, and others, complicate information collection against populations, infrastructure, and physical environment signatures. Government, religious, economic, and ideological actors use social and traditional public media to influence the population. Understanding the environment requires collecting and exploiting relevant signatures, many of which are either as of yet undiscovered, or lack sufficient technical exploitation to be useful.”

“Population and structural and signal density in urban environments produce physical and virtual clutter that reduces the effectiveness of intelligence collection, and complicates target acquisition. Market saturation of cell phones and other web-enabled devices produce a signal dense environment which complicates target acquisition and SIGINT collection…. Increasing proliferation of personal mobile communications is making connectedness more robust at the personal level adding to the difficulty of identifying relationships. The density of information and communications technologies may slow our ability to identify actionable intelligence.”

Meanwhile, the document says, the Army should anticipate “budget and force reductions.”

“Fiscal constraints demand near-term solutions that preserve the balance of readiness, force structure, and modernization necessary to meet the demands of the national defense strategy now, while setting the stage to begin evolving the force in the mid-term (2020-2030) and bringing innovative solutions to fruition to meet the challenges of the far-term (2030-2040).”

Domestically, “Legal constraints govern intelligence support to operations conducted within the homeland, specifically Defense Support to Civil Authorities (DSCA) and homeland defense. The U.S. is a litigious environment within which the Army operates; intelligence leaders must understand the role legal limitations and authorities play in shaping intelligence support.”

Spy Satellite Agency: Winter is Here

The National Reconnaissance Office (NRO) has modified its classification policies in favor of heightened secrecy, withholding budget records that were previously considered releasable and redesignating certain unclassified budget information as classified.

NRO is the U.S. intelligence agency that builds and operates the nation’s intelligence satellites.

Since 2006, and for most of the past decade, the NRO has released unclassified portions of its budget justification documents in response to requests under the Freedom of Information Act.

But in a January 23, 2017 letter, the NRO said it would no longer release that unclassified budget information, which it now deems classified.

“The NRO has determined that a series of unclassified items in the [FY 2016 budget justification] document in the aggregate reveals associations or relationships not otherwise revealed in the unclassified items individually; thus, in the aggregate, this information meets the standard for classification under E.O. 13526 Section 1.7(e),” wrote Patricia B. Cameresi, NRO FOIA Public Liaison, in her FOIA denial letter.

As a purely technical matter, the latter claim is probably a misreading of the Executive Order, which states in Section 1.7(e):

“Compilations of items of information that are individually unclassified may be classified if the compiled information reveals an additional association or relationship that:  (1) meets the standards for classification under this order; and (2) is not otherwise revealed in the individual items of information.”

Properly understood, the fact that various unclassified items reveal additional information in the aggregate does not mean that those items meet the standard for classification. That requires a separate determination which, in any case, is discretionary. Classifying compilations of unclassified budget information is a threshold which was never crossed in the past and which has not been explicitly justified by NRO here.

The NRO also invoked a statutory exemption in 10 USC 424, which says that NRO (along with DIA and NGA) cannot be compelled to disclose “any function” at all.

The upshot is that the NRO is abandoning the budget disclosure practices of the past decade, and is positioning itself to withhold anything and everything that it prefers not to release.

An administrative appeal of the NRO FOIA denial was filed yesterday.

Crisis Management in the Intelligence Community

Last month, outgoing Director of National Intelligence James R. Clapper issued new guidance on how the U.S. intelligence community should pivot in response to a crisis.

A “crisis” is defined here as “An event or situation, as determined by the DNI, that threatens U.S. national security interests and requires an expedited shift in national intelligence posture, priorities, and/or emphasis.”

The new guidance explains how that shift in intelligence posture is to be executed.

See Intelligence Community Crisis Management, Intelligence Community Policy Guidance 900.2, December 23, 2016.

Rebooting the IC Information Environment

Over the past several years, former Director of National Intelligence James R. Clapper led an ongoing transformation of information policy in the U.S. intelligence community that stresses information sharing among intelligence agencies based on a common information technology infrastructure.

On his way out the door last week, DNI Clapper signed Intelligence Community Directive 121 on Managing the Intelligence Community Information Environment, dated January 19, 2017.

The goal is for each IC member agency “to make information readily discoverable by and appropriately retrievable to the [entire] IC.”

Although the policy makes allowance for unique individual agency requirements, and acknowledges legal and policy restrictions on sharing of privacy information, a common IC-wide information architecture is otherwise supposed to become the new default for each intelligence community agency.

“IC elements shall first use an IC enterprise approach, which accounts for all IC equities and enhances intelligence integration, for managing the IC IE [Information Environment] before using an IC element-centric solution,” the new directive says.

Further, “IC elements shall […] migrate IC IT capabilities to IC IT SoCCs [Services of Common Concern] as quickly and efficiently as possible.”

Increased sharing of information naturally entails increased vulnerability to compromise of the shared information.

To help mitigate the increased risk, “all personnel accessing the IC IE [must] have unique, identifiable identities, which can be authenticated and have current and accurate attributes for accessing information in accordance with IC policies, guidance, and specifications for identity and access management,” the directive says.

The new IT Enterprise approach has received congressional support and seems likely to continue for the foreseeable future.

But in the current period of turbulence everything is uncertain, including the future of the Office of the Director of National Intelligence itself.

In its report on the FY2017 Intelligence Authorization Act last week, the Senate Intelligence Committee mandated a new review of the roles and missions of the ODNI.

“It has been more than ten years since the Congress established the position of the DNI in the Intelligence Reform and Terrorism Prevention Act of 2004, building on its predecessor, the Director of Central Intelligence. Given this experience and the evolving security environment, the Committee believes it appropriate to review the DNI’s roles, missions and functions and adapt its authorities, organization and resources as needed,” the new Committee report said.

An Outgoing Wave of Disclosure

In the final days and weeks of the Obama Administration, intelligence officials took steps to promote increased transparency and made several noteworthy disclosures of intelligence policy records.

On January 9, DNI James Clapper signed a new version of Intelligence Community Directive 208, now titled “Maximizing the Utility of Analytic Products.” The revised directive notably incorporates new instructions to include transparency as a consideration in preparing intelligence analyses.

Thus, one way of “maximizing utility,” the directive said, is to “Demonstrate Transparency”:

“Analytic products should follow the Principles of Intelligence Transparency for the Intelligence Community, which are intended to facilitate IC decisions on making information publicly available in a manner that enhances public understanding of intelligence activities, while continuing to protect information, including sources and methods, when disclosure would harm national security. The degree to which transparency will be applied depends upon the nature and type of the analytic product.”

Interestingly, the revised directive was issued without any public notice or press release. Though unclassified and published online, it appears to be genuinely inner-directed rather than a mere public relations gesture.

*    *    *

The Central Intelligence Agency posted more than 12 million declassified pages (930,000 documents) from its CREST archive on the CIA website. The CREST (CIA Records Search Tool) database had previously been accessible only to those researchers who visited the National Archives in person.

By making the records broadly available online, their utility and the benefits of their declassification are multiplied many times over.

Release of the CREST database had been sought by researchers and advocates for many years. It was advocated internally by the CIA Historical Review Panel and the Panel’s chair, Prof. Robert Jervis. It was recently the subject of a Freedom of Information Act lawsuit by the Muckrock news site.

Joseph Lambert, CIA Director of Information Management, said that online access to CREST recently became possible only after technical limitations on the CIA website were “dissolved.” He said that the quality of the online search engine would not be inferior to that on the original CREST system.

One experienced researcher disputed that. Based on an initial survey, “I think it is safe to say that the level of functionality for searching is less than CREST,” the researcher said. From his perspective, “the losses are very significant.” A detailed comparison was not immediately available.

In any case, Mr. Lambert said that newly declassified records, and less redacted versions of previously redacted records, would be periodically added to the online collection.

*    *    *

Also last week, the CIA released updated guidelines for the collection, retention and dissemination of U.S. person information. The Agency also posted declassified documents concerning its interrogation program, released in response to FOIA litigation by the ACLU.

The Office of the Director of National Intelligence released an updated report on counterterrorism strikes outside of areas of active hostilities, a report on equal opportunity and diversity in the Intelligence Community, and a paper on the Domestic Approach to National Intelligence describing the organization of U.S. intelligence. ODNI published the remainder of the captured bin Laden documents that have been declassified, the third annual SIGINT progress report, and three semi-annual reports on compliance with Section 702 of the Foreign Intelligence Surveillance Act.

*    *    *

With the exception of records released in response to litigation or legislation, these moves and these disclosures were voluntary. They seem to represent a realization that increased transparency, though occasionally awkward in the short term, serves the long-term interests of U.S. intelligence.

“Today, whether you are a U.S. citizen or a non-U.S. citizen abroad, you now have more confidence about what the United States does and does not do with regard to signals intelligence collection because of steps this Administration has taken to provide an unprecedented level of transparency regarding these activities,” according to an Obama Administration report on privacy that was briefly published on the White House web site last week.

This posture of increased transparency, if not these specific disclosures, can be easily reversed or abandoned. But an infrastructure of disclosure has been established, along with a pattern of releases, that will generate expectations for the future and a certain momentum that may yet be sustained and developed.

Improving Declassification: Not Yet

A new report on improving declassification procedures in the U.S. intelligence community implicitly suggests that no such improvements are likely to emerge any time soon.

The report, published yesterday by the Office of the Director of National Intelligence in response to congressional direction, is largely devoid of new ideas and instead calls for greater “integration” and “coordination.”

“Improving the declassification process across the Community will require an integrated and multifaceted set of initiatives fully coordinated with organizations that have AD [automatic declassification] programs. No single step will suffice in addressing satisfactorily the areas for improvement that have been identified in this report.”

See Improving the Intelligence Community’s Declassification Process and the Community’s Support to the National Declassification Center, ODNI, December 2016.

The core of the report is in a section entitled “Proposals to Improve the IC’s Declassification Process.” But it does not actually present any declassification policy proposals. Instead, in a near-parody of a government report, it calls for establishment of new working groups to write other reports and generate further recommendations.

Thus, the “Proposal on Process” calls for “a Declassification Improvement Working Group (DIWG) to conduct a zero‐based study of the IC’s AD process and prepare a report–by a specified deadline– that includes recommended actions to increase the program’s effectiveness and efficiency across the Community.”

The “Proposal on Electronic Records” says that “A joint task force […] should be formed to aggressively pursue the identification, development, and validation of technological capabilities — tools and infrastructure — for incorporation in the AD [automatic declassification] process.” (Aggressively!)

This is not helpful. In fact, it is practically a declaration of helplessness.

The new report is lacking in specific actionable proposals that could be evaluated, debated, perhaps modified and ultimately adopted in practice. It does not ask or answer any penetrating questions. Such as:

*  What if agency “equity” in older records, requiring review by those agencies, simply lapsed at some point in time, eliminating the need for such review?

*  What if certain defunct intelligence compartments could be altogether excused from multi-agency referral and review?

*  What if a fixed fraction of agency information security expenditures were routinely and predictably allocated to performing declassification?

*  What if new metrics could be devised to measure the success of declassification programs based on requester demand and disclosure impact, not just on number of pages processed?

*  Fundamentally, what if intelligence community tolerance for risk were recalibrated to facilitate more expeditious declassification of both current and historically valuable records?

Interestingly, the report notes that agencies favor numerous revisions to President Obama’s executive order 13526 on classification policy, so that “updating the E.O. will be a major undertaking.”

But those revisions mainly seem geared toward relaxing existing declassification requirements, not strengthening them. So, for example, IC officials believe they could place increased emphasis on declassifying historical records of broad public interest if they could be assured that other records of lesser interest would not be automatically declassified as they become 25 years old, as the Obama order nominally directs.

Information Operations: It Takes a Thief

At a Senate Armed Services Committee hearing yesterday on foreign cyber threats to the U.S., there were several references to the saying that “people who live in glass houses should not throw stones.” The point, made by DNI James Clapper, was that the U.S. should not be too quick to penalize the very espionage practices that U.S. intelligence agencies rely upon, including clandestine collection of information from foreign computer networks.

But perhaps a more pertinent saying would be “It takes a thief to catch a thief.”

U.S. intelligence agencies should be well-equipped to recognize Russian cyber threats and political intervention since they have been tasked for decades to carry out comparable efforts.

A newly disclosed intelligence directive from 1999 addresses “information operations” (IO), which are defined as: “Actions taken to affect adversary information and information systems while defending one’s own information and information systems.”

“Although still evolving, the fundamental concept of IO is to integrate different activities to affect [adversary] decision making processes, information systems, and supporting information infrastructures to achieve specific objectives.”

The elements of information operations may include computer network attack, computer network exploitation, and covert action.

See Director of Central Intelligence Directive 7/3, Information Operations and Intelligence Community Related Activities, effective 01 July 1999.

The directive was declassified (in part) on December 2 by the Interagency Security Classification Appeals Panel, and was first obtained and published by GovernmentAttic.org.