Little Big Horn – Cyber Edition

1Dec17

The Fort has fallen. Its defenses are down. The armory has been blown wide open and every last weapon stolen. Thousands of defenders manning their positions in a series of layered perimeters were unable to detect, let alone stop, the onslaught. The Fort’s Commander was unable to rally his troops to protect the heartland. The frontier will never be the same again. The insurgents are now in charge. With the weapons they stole they can roam, pillage, and destroy at will. No target is out of their reach. The world will never be the same again.

At Fort Meade, Maryland, cyber-Custer, Admiral Mike Rogers, and his once-invincible forces were not left in a bloody heap. They continue to sit in their cubicles, sipping their lattes, careful not to burn their lips. The absence of physical destruction belies the devastation within. Make no mistake, they have been hit much harder than George Custer and his troops. Their deaths, while tragic, did not change the strategic landscape, the contemporary reprise of Little Big Horn has already eclipsed  anything that has come before it. The Snowden revelations are nothing compared to cyber-Little Big Horn. This assessment will explain the significance of the attack and explore the consequences for US Security going forward.

Edward Snowden did not release his stolen files directly to the web, He handed them over to newspapers, leaving their editorial processes to decide what was, and was not, in the public interest. The worst of the Snowden files exposed Top Secret ‘named operations’ then underway. It revealed a vast surveillance program that operated outside of established conventions and laws. Snowden’s files were very valuable to America’s enemies because they enabled them to ‘connect the dots’ on NSA capabilities and operational focus. By contrast, cyber-Little Big Horn exposed named operations, but went much further – actual weapons were stolen. Weapons that took billons of dollars to develop in the most clandestine labs run by the USG. Weapons that gave their possessor untold power. Weapons that could now be turned against the mist technologically dependent country in the world. The United States of America.

In Confucianism, the TAO is ‘the correct way’ (or ‘Heaven’s way’) to understanding the source of all things. America had decoded the TAO. This precious knowledge was used to create the closest any country has come to omniscience, and thus, omnipotence. The TAO was stolen right from under the nose of the NSA and is now for sale on the dark web to anyone. Iran, North Korea, ISIS, fat kids in basements, for a small fee they now wield the greatest cyber weapons ever invented. In the secret world, particularly at the cutting edge, where imagination and creativity reign, special organizations take on names and unit patches that are in-jokes to the select few who are ‘read-in’ to their programs. Tailored Access Operations, or TAO, was the jewel in the crown of the NSA and US Cyber Command. TAO gave these powerful intelligence and operations arms of government god-like access and control of virtually any system on earth – even ‘air-gapped’ systems. There is almost no human activity on earth that is not dependent at some point on networked computers. TAO gave America the source of all things.

From this secret knowledge, a series if super-weapons were created that facilitated clandestine and covert access, and if needed, control of computer networked operations both military and civil, of any country on earth. Need to shut down an air defense system in order to run a CT mission undetected inside a city? TAO might be one of the arrows in the quiver. Need to ensure an opponent can’t access funds or special components for their WMD programs? TAO might help. Need to break a sufficient number of centrifuges to delay the progress of a secret nuclear program? TAO is there for you.  Need to blow up ICBMs on their launch pads before they are launched against San Francisco> Who ya gonna call?

Often TAOs weapons were not used because the risk of revealing the existence of the program was a far higher cost than the estimated benefit if the deployment if the weapon. This is a serious leadership challenge. Getting the cost/benefit risk assessment right for programs of national significance requires very fine judgement. There will be cases where very important operations that can’t be done by other means, will be passed over simply because the risk of exposure. This should give some sense of the importance and impact of this hack.

The Fort was attacked by a group that goes by the name ‘The Shadow Brokers’. Unsurprisingly very little is known about them and just how, exactly, they took down Ft Meade. The NSA and USCYBERCOMMAND are at the very forefront of cyber security, both defense and offense. It is unimaginable that they were hacked. Unimaginable to whom? Herein lies an important challenge in intelligence, seeing things for what they are, not as we’d like to see them. To date, investigations have focused on three employees. Human error or outright espionage are suspected. The following observations are all made based on alleged conduct portrayed in credible newspapers. One suspect has not been named nor much information released about them at all. Another, Reality Winner [sic] is accused of releasing one Top Secret document that refuted a claim by President Trump. The final person of interest is Harold T Martin III who was arrested after a significant cache of classified materials was found at his home. Based on current reporting, neither of the named suspects appears to have had sufficient data to be part of the Shadow Brokers plot, at least knowingly and directly. Mr. Martin’s story will sound familiar to those who know the Ft. Highly intelligent, a huge nerd (that should go without saying), possibly lacking many friends and certainly lacking any hobbies, was fascinated by his work and took it home with him, despite the prohibition on removing classified information from secure facilities. Reports suggest he was removing classified information from secure facilities. Reports suggest he was over-dedicated to his work, not a spy. Still, the poor guy will pay an outsized price for being an eccentric who lost track of the rules in his laser focus on the fascinating challenges of solving puzzles. It is a crying shame the system didn’t help him before his obsession went this far.

The unknown suspect is the most interesting at this stage. He or she was a software developer and arrested for taking NSA classified material home in 2015. It is alleged that Russian hackers accessed some of those files, whether wittingly or not, has not been disclosed. Given the status of this individual, the chances are their identity and details about their activity are being suppressed so that the Russians and/or Shadow Brokers di not learn from the case. He or she might be working with law enforcement, helping to catch the culprits. Human engineering is always the easiest way in to a hard target, so it makes sense that effort is being put in to evaluating operational security protocols. But what if the NSA/USCYBERCOM was hacked pure and simple? Will over confidence prevent the cyber=spooks from really finding out what happened? In WWII the Nazis could not imagine that the British cracked their codes. The German obsession with order was, in part, their undoing. Starting and ending every message with ‘Heil Hitler’, for example, enabled Bletchley Park to often get the key for the day. Likewise, each Enigma operator has a signature style on their Morse key. They soon had personalities. It was then possible to link ‘Operator X’ with his wheel settings, which would always be his girlfriend’s initials or a birthday (for example), the wartime equivalent of using an easy password (such as ‘password’). MI encourages NSA investigators to not be over confident, not to assume anything, and to follow every lead down. If it was a direct hack on the Ft, as embarrassing as that might be, it is essential to know it and act on it accordingly.

What is cyber warfare?

Way back in the 1990s when MI (in a different guise) was writing about the emergence of warfare in the cyber domain, there was a lot of discussion about cyber-Pearl Harbor’s and what ‘virtual war’ would look like. Could it actually kill people? How did hacking a website change anything if military, let alone strategic, significance? We have come a long way since then. Cyber is still rapidly evolving and is still confusing even to those who study it. MI has an easy to understand explanation of cyber warfare.

Cyber warfare operates in two primary dimensions = the physical and the narrative. The 2016 election is a classic case in point. At first, mist of the commentary was concerned about hacking of ballot boxes to change votes. Except, as the news media soon learned, US elections are incredibly distributed, low tech affairs, governed by local laws and/or arrangements. In short, most ballot boxes were manual, not digital. There was almost nothing to hack. It did not take long for evidence of narrative driven cyber ops to come to light. These turned out to be devastating in part because they were largely invisible to victim and systems alike.

Narrative cyber ops are another way of saying digital propaganda. The United States is awash in digital propaganda, both home grown and foreign. In a meeting of senior defense leaders MI (again in another guise) decided to conduct an unwitting test of the audience.  MI said that ‘of course, Fox News has been paid millions by Iran to sow confusion and discord into the American electorate in order to advance clandestine Iranian programs’. Incredibly, the audience didn’t even blink. The response was akin to ‘tell us something we don’t know’. When MI quickly told the group that this was a fake claim to see how they would react to the proposition that America was awash in homegrown propaganda, various viewpoints were expressed but the ‘take away’ was that America was being manipulated both from inside and out. This was not a 2017 discussion, this occurred in 2012. The dangers if the era of ‘fake news’ was apparent ling before even 2012.

One of the greatest ironies of US national security is that while Madison Avenue, media conglomerates, corporations, political parties, super-empowered pundits, and incredibly influential blogs like MI ( ;-)  - not true, only the facts and profound analysis here), have been spinning Americans into complete incomprehension even about simple facts, the US military is utterly hopeless at propaganda and influence operations. They still think pamphlet drops are game-changers, while kids in the west sit for hour after hour and day after day, watching ISIS ‘heroes’ making war on allied forces and being told that they are winning. Efforts to create ‘counter-narratives’ have been laughable, if well intentioned and funded. Just ask the State Department’s experts in this field.

So the 2016 election was the natural outgrowth of homegrown spin. An unstable polity was angry and ripe for disruption. There was a great story early in the election about a bunch of kids in Macedonia who ran fake news sites with the most outrageous headlines, all for a lark. There were soon shocked to discover that not only were their obvious lies making money (clickbait) but people were taking their prank seriously, and in some cases to absurd ends. A 61yr old interviewed for the story said he could not believe anyone would take the stories seriously, it was a prank, and they had no intention of changing an American election.

There were much more extreme examples of digital manipulation. The conspiracy theory site info-wars ‘reported’ that Hilary Clinton was murdering people and chopping them up. Then came the ‘Cosmic Pizza’ story. It alleged that a presidential candidate for a major political party was running a child sex ring from a suburban DC pizzeria while running for the highest office in the land. That’s not the shocking bit. Thousands of citizens took this very seriously, as fact. One was so distressed by the story he drove to DC from NC and shot up the pizzeria with an assault rifle in an attempt “to free the children”. These and hundreds of stories like them were circulating and significant portions of the voting public believed them.

Think about that for a minute.

In Britain, the tabloids have always been full of what we now call clickbait. They are a source of amusement as people ride the Tube home after a hard day’s work. It’s tongue-in-cheek and everyone knows it is frivolous ‘entertainment’. In America, clickbait is treated as if it came directly from Walter Cronkite. At the same time, quality established news sources, like The New York Times, and BBC America, are derided as elitist and manipulative, but a kid’s website in Macedonia is credible. Fox News, which never fails to proclaim that it’s the most authoritative, most watched, most highly rated news channel, simultaneously claims to be the underdog fighting the insanity if the ‘mainstream media’.it does not get more mainstream and controlling than Fox. The fact they can pull this blatant propaganda off without being called on it blows MI’s collective mind. [Their current attacks on the Muller probe as being a new KGB is the kind of ‘journalism’ MI condemns].

It was reported in the New York Times that “nearly one in three Americans cannot name a single branch of government. [and] When NPR tweeted out sections of the Declaration of Independence…many people were outraged. They mistook Thomas Jefferson’s fighting words for anti-Trump propaganda”. This led Tim Egan to assert that “a huge percentage of the population cannot tell fact from fiction” (“Look in the Mirror: We’re With Stupid”, NYT, 11/18/17, p.A18).

With a population that gullible, the Russians had a field day with the US election. Is there a ‘smoking gun’ that proves beyond all doubt that cyber narrative ops swung the election to Trump? No. That’s why it’s the perfect weapon.  The Russians didn’t need to break into ballot boxes; they just had to play with the fears and rage Americans were ‘feeling’. It was embarrassingly easy, a bunch of kids could have done it… oh wait….  Not only could the NSA and USCYBERCOM not stop the Shadow Brokers, they couldn’t stop a bunch of kids in the Balkans from brain washing the American public.

Cyber warfare and Social Media: Narrative Ops Gone Wild.

Remember the old New Yorker cartoon “On the internet, no one knows you’re a dog!” That author completely nailed it. He did so in the pre-social media era, which makes his insight that much more impressive.

 

During the 2016 election Facebook became a doggy day care center. First, conservatives assailed Mark Zuckerberg for manipulating people’s news feeds to downplay conservative viewpoints. The algorithm was quickly reset. Then, right after the election, allegations began to surface that the Russians had manipulated Facebook via its ‘troll armies’, creating fake profiles for individuals and groups, as well as buying advertisement space. Again, Zuckerberg came out with denials, and again, he soon changed his tune. Turns out, Russia was willing to pay. The old Soviet toolkit of ‘active measures’ has been updated for the digital age and applied to social media. The outcome? American citizens facing off against each other in the streets and fighting erupting between them, all thanks to fake groups stirring up tension and organizing protests. It was remote control protest from Moscow and Americans mindlessly doing their bidding.

It’s not just bogus advertisers and bogus accounts; it’s the manipulation of users’ emotions. It was undetected (at the time) and was incredibly successful. In the old days, agi-prop took time, effort, money, and most of all, a lot of people. Now it’s instigated with a few hundred thousand bucks and the click of a mouse. The best thing? It’s impossible to prove if it happened and if it gave the election to Trump. There can be no counter-call to action when it’s impossible to prove an action took place. This changes politics.

This is not the first time that Facebook has been used to create a mass effect. Social media is free. You do not pay a subscription for it’s services. Yet social media companies are some of the most highly valued corporations in the world. Where does the money come from? Data mining. Facebook has changed how people discover they really needed something they were not thinking about two minutes ago. Previously ads were wide-cast on TV. Great for mass consumption but not helpful for boutique interests that were hard for retailers to target. Facebook solves all that. If you have listed your interest in Taylor Swift or ancient Egyptian artifacts, moments later direct and indirect suggestions will come flooding in. The same applies to your political beliefs. Hate Hilary? Then guess what suggestions ‘you might like’ will come up with in both news feeds and other merchandise on offer. What the railroads and oil were to the 18^th and 19^th centuries, datamining is to the 21^st century. The best thing is you no longer buy a ticket or fill a tank, you just ‘like’ stuff and you are instantly surrounded by it, whether it’s physical or narrative.

Social media has changed society in so many ways, but the most pernicious is its impact on out attitudes to privacy. Think about the information you freely give to social media. On dating sites, for example, you provide pictures as well as highly personal and detailed sexual, drug, employment and social histories. Some sites employ Miers-Briggs psychological surveys. Often in-depth mini narratives are required revealing all sorts if incredibly persona; preferences. In a court case in NY, Facebook submitted the following summary to the court, as reported in Robert Scheer’s They Know Everything About You, (2015, p96):

People use Facebook to share information about themselves, much of it personal. This information includes:

·        The person’s age, religion, city of birth, educational affiliations, employment, family members, children, grand-children, partner, friends, places visited, favorite music… movies, television shows, books, quotes, [foods, beverages], things ‘Liked’, events to attend, affiliated groups, fitness, sexual orientation, relationship status, and political views.

·        The person’s thoughts about: religion, sexual orientation, relationship status, political views, future aspirations, values, ethics, ideology, current events, fashion, friends, public figures, celebrity, lifestyles celebrations, grief, frustrations, infidelity, social-interactions, or intimate behavior.

·        The person’s photographs and videos [Here he quotes a long list of examples, most containing geo-location and time-stamped data.]

·        The person’s private hardships [and] intimate diary entries….

Targeted marketing is nothing new but its reach in the information age has become almost limitless. Data broking is a multi-billion dollar industry. It combines mass consumer surveillance derived from patterns in spending collected by credit and loyalty cards, with off-line data collected from real estate and motor vehicle records, warranty cards, home ownership and property values, marital status, annual income, educational levels, travel records, credit records, to provide a detailed picture of an individual’s life. The biggest corporation in the personal data field in the US, Acxiom advertises its ability to soon reach “more than 99% of the adult US population…across all channels and devices.” (Scheer, p.59).

If almost total access to your data was not enough, people are now handing over their DNA to corporations – not digital DNA (corporations have had that for years), actual biological DNA. For the low, low, fee of $24.99 a variety of companies will now collect and analyze your biological DNA, ostensibly for the purposes of helping you understand your ethnic background and to assist working on family trees. Smart watches are now mini all-purpose health monitors, assessing everything from heart rhythm, sleep patterns, insulin levels, exercise monitoring, and so on. People are paying for corporations to monitor their every word said in the ‘privacy’ of their homes. Alexa and her sisters are always listening and recording, sending big sister all of your utterances (not just commands). Alexa and the girls have to listen to ensure they know when you call, but people have not yet cottoned to the fact that Amazon has sold them a baby monitor for their house and the consumer is the baby. Alexa has already been subpoenaed to testify in a murder trial.  I’m not making this up. Her constant surveillance and recordings were collected in order to determine what really happened in someone’s living room where an occupant was left dead. No one called out “Hey, Alexa, I’m about to kill someone.” Every Google and YouTube search you do is recorded. That’s how they get the predictive searching as you type something into the search window.  The metadata collected forms fascination patterns that are mined for commercial purposes. The same patterns can be mined for other purposes, too.

When the Obama Administration went after journalist James Risen, on suspicion of printing leaks of classified material, they did not have to threaten Mr. Risen with contempt and thus jail time. They just had to access his cell phone and laptop data and/or records to harvest the metadata, see the patterns and find the leaks. There is a case before the Supreme Court right now, US v Carpenter, which will determine if 3^rd party data, such as phone records, should be protected under the 4^th Amendment. Current law states that no warrant is required to harvest 3^rd party data. The Onion satirical newspaper and video YouTube page, which masquerades as a “news site”, has a video of “CIA Special Agent Mark Zuckerberg” getting a special award for making the job of intelligence and law enforcement effort-free. Nut the joke is on social media users and the electorate.

US Customs and Border Protection (CBP) are now seizing tens of thousands of digital platforms at the border and have been empowered to demand log-in data, such as your ID and password, so they can log in to your social media. This applies to US citizens, green card holders and foreign visitors. The “border exception” to the 4^th Amendment permits searches and seizures during routine border searches (they cannot be used, for example, as part of an ongoing investigation to deny a suspect’s 4^th Amendment rights).So far this extraordinary invasion of privacy has not been challenged in the courts, but it’s only a matter of time.

The news is constantly pulsed with hacking stories. From the White House to your house, nothing seems sacred. In 2013, 3 billion Yahoo accounts were hacked. In 2017, 143 million credit reports owned by Equifax (one of the big three credit reporting agencies and upon which the entire US economy depends). Also in 2017, 198 million voter records were accessed (all stats from, “How Privacy as We Know It Died”, NYT 6Oct17, p.A27). Ever keen to exploit an opportunity, Google announced that it would move into the credit reporting space by linking billions of credit card transactions to the online behavior of its users (Google announcement, 23May17).

With all this data available and the ready ability to sift, sort, and find patterns, incredible power is now on the hands of those who own the data and the patterns it creates. Before the 2016 election, which was a proof of concept in many ways, a group of social scientists get permission from Facebook to conduct an experiment to assess if it was possible to artificially create a mass “emotional contagion”. The experiment allowed the scientists to manipulate the news feeds of 700,000 FB users to see how they would react. The study was reported in the Proceedings of the National Academy  of Sciences (June 2014) found that:

Emotions expressed by friends, via online social networks, influence our own moods, constituting, to our knowledge, the first experimental evidence for massive-scale contagion via social networks.

The controversy surrounding this experiment, that forced FB CEO Sheryl Sandberg to apologize, was nothing compared to the manipulation that took place during the 2016 election. FB is still coming to terms with just how deeply they were played, with fake accounts, groups, chat rooms and so on. FB was not alone; troll armies had invaded a range of platforms. Senator Mark Warner (D-VA) spoke for many on the Intelligence Committee when he remonstrated representatives if ‘The Five’ over their lack of understanding and even concern at the degree to which they were unwitting vehicles of Russian ‘active-measures’. The corporations treated the hearings as spin sessions and have still yet to really get to grips with the incredible power and reach of cyber narrative ops. The less educated, more politically frustrated the general public are, the more susceptible they will be to orchestrated mass contagion mounted by our friends in Moscow, Tehran and Beijing.

The ultimate ‘off-line’ data

One database that should have never been accessed is the Office of Personnel Management’s security clearance data base for the entire federal and contractor workforce. The OPM is not a national security agency, yet it was charged with conduction all security clearance investigations for the United States, The records if those investigations, which include the SF-86, biometric data, interview records (with both the subject of the investigation and those selected by OPM to verify the professional and personal history of the subject), as well as internal OPM assessments of each security clearance candidate, were stolen by the People’s Republic of China. The human capitol blueprint of the entire national security establishment is now in Beijing.

The SF-86 contains all the data in FB and then some. Going back either 5 or 10 years applicants must provide a complete and accurate record if their residential, educational, financial, travel, social, and political history.  These records are cross checked on databases and in personal interviews. Failure to accurately record the correct information or changes to the record over time (new travel, meeting foreigners etc.) can result in criminal indictment.  This has been a factor in investigations of various Trump Administration officials who have been required to update their SF-86s as reported in the media. The central concern in granting a security clearance is that the subject cannot be blackmailed. That can happen if someone other than the USG knows all the details of someone’s life, including some specifics that might be embarrassing.  The usual position is that so long as the subject reveals all to the USG they insulate themselves from blackmail. It takes a lot of trust to give the federal government all that detail. There is an expectation that the trust will be returned in the USG protecting all that sensitive data (and analysis thereof), if not as part of a social contract with the national security employee, then for simple national self interest. This trust was broken by lax security standards at OPM and carries phenomenal national security risks.

China has a complete roster of every single American with a security clearance. That allows them to instigate social contagion within that sensitive group. It facilitates attempted blackmail to gain national secrets. It allows China to track and constantly monitor anyone of interest to the PRC, from deep under cover CIA officers to Tier I special forces, to the administrative assistant to the Director of Central Intelligence against whom HUMINT, SIGINT, CYBERINT, assets can be brought to bear. Anywhere there is a camera or mic there is a threat. By tapping a target’s cell phone, lap top, vehicle, home security system, either tapping into the cameras on these devices or audio or keyboards, the Chinese can monitor, spoof, manipulate, or ruin anyone they want. Further, anywhere else there is a camera: gas stations, Starbucks, airports, ATMs, city streets; targets can be monitored domestically or internationally. Try passing through Europe undercover when China taps into any device in your person or around you. Both targeted operations as well as wide area surveillance of key choke points (airports, embassies, hotels authorized by the Defense Travel System) will catch undercover or overt operatives, as well as run of the mill national security personnel. The OPM hack is an unmitigated disaster and it will only be diluted over time as personnel change – assuming of course that the OPM records are secured into the future.

Cyber Warfare and Big Data

Big data provides a link across mixed database platforms to scan, sort, associate and see patterns that would otherwise be invisible. It can take a CCTV feed from the streets of London and cross reference it to FB, Twitter, and OPM records, to provide near real time feedback if a person or a device associated with them walks within surveillance range, for example. It knows where you are and what your typical spending patterns look like, so when your credit card is used to buy an air ticket, the credit card company is notified along with the TSA and other agencies, to question who is really travelling. The examples of the application of big data are only limited by your imagination. There is a full-blown Tom Clancy novel just waiting to happen where the guys in charge in the narrative are not in Washington, but Tehran or Beirut or Addis Ababa.

People, places, things, and actions, are now essentially totally transparent. Placing Social media records, against consumer data, against offline data, and cross checked against OPM data, virtually removes the shadows in which America’s leading covert and clandestine operators dwell. The same applies to senior leadership of national security agencies, government scientists, your mom and your kids’ little league team. This is particularly dangerous for USG employees, but it is equally as potentially threatening to the average citizen.

Mass manipulation, social contagion, is possible if it appears credible. Big data gives users the ability to create highly credible narratives that can be used to sell you something or to create a political effect. It can be a mass effect or targeted to an individual. Mixing narrative cyber ops with physical cyber ops in the context of big data changes everything. The scope, depth, and speed of these drivers of change are unrelenting and expanding/accelerating. Consider the impact of future technologies that are already emerging.

Future Tech and National Security

IFlyTek, a Chinese artificial technology company, has been busy creating a biometric image and voice recognition database, most likely drawing from 800 million subscribers to China Mobile, its parent company. This technology allows it to pick a target in a crowd either by recognizing their face or voice and “record everything that person says” (“Pushing AI Boundaries in China”, NYT, 4Dec17, p.B1). it already has President Trump’s voice in its database. On his recent visit to Beijing he spoke via teleconference to a technology conference and switched from English to Mandarin. Except Trump can’t speak Chinese; it’s the technology that made it appear as though he could. Linking voice, and face ‘finger prints’ across big data platforms is impressive. Taking that data and applying CGI, 3D imaging, and other audio-visual artificial ‘creative technologies’ to it, opens a pathway to the creation of completely artificial ‘videos’ of people saying and doing anything.

This will make today’s ‘fake news’ a charming historical artifact soon enough. If we already struggle with defining what is real based on manipulation of text, which can be back-checked easily enough, the creation of ‘artificial reality’ videos will up-end all social relations, form the political and national security to the personal. Empowering narrative cyber-ops with these new technologies will be a game-changer.

Right now, the combination of biometric data (finger prints, facial recognition, voice recognition, and even gait recognition) with geo-location, autonomous armed drones, all linked across big data, makes for some interesting scenarios involving the uses od such technologies. MI can see a bright sunny spring day in Washington, the President walking along the colonnade from the West Wing back to the Residence and a distant hum that sounds like a lawnmower trimming the ellipse, yet that humming is getting louder and louder…

Conclusion

For all the billions  invested in cyber security, the millions of top security professionals inside government and contracted to it, the cyber national security establishment has singularly failed to protect the government, national institutions, American economic icons, and the public from surveillance, threats, and outright attacks emerging from the cyber domain.

MI has an abiding concern that the Executive branch of government has got far too big, lumbering, unimaginative, and bureaucratic, for it to meet its primary mission of protecting the American people. The structure of government, and in particular the power of the purse in Congress, creates a mindset in government that innovation is easily obtained by throwing more money at a problem or worse, creating yet another bloated bureaucracy to address some emerging suite of threats. MI thinks the opposite is true. The Executive needs to radically slim down and to reassess how it can go about achieving its ends by thinking smart, not spending large. The 16 intelligence agencies never fail to collect the dots; they failed to connect the dots. Insiders know that all that exhaustive collection is done because it can be done. It is not used to anticipate and deter or defeat threats. It is used to assess what happened in the aftermath. America is great at disaster recovery but not prevention. This generalization does not hold across all areas of national security. Where creativity is allowed to flourish free from nagging budgetary considerations, with the right people, with the right education and corporate mindset, by which MI means an architecture of ‘open’ thinking, not the ‘closed’ thinking that is typical of government and the all too real caricature that most citizens have of government, America can do almost anything. We see the right corporate culture in Silicon Valley – not everywhere or evenly. But if it can still be said to exist anywhere in America, that’s the place. Great studies do not need to be done, May have already been done. The key distinguishing characteristic if innovation is open versus closed thinking, trial and error, willingness to take risks in an environment free from petty accusation. MI acknowledges this is a pretty tall order. But the fact is, not everyone can be a US Navy SEAL, and not every SEAL can be in SEAL TEAM VI. Likewise, not everyone can earn a PhD and not every PhD is from Harvard. America needs to see competence for what it is and stop this cultural revolution of anti-elitism. High end national security requires the very best people and the creation and nurturing of the very best open cultures. MI’s team has been lucky enough to see places where this happens in the top security teams – like the NSA’a TAO. Organizations like that make working in government so incredibly rewarding, so long as they were well led and everyone is able to put differences aside and focus on the mission. At a time when America is ceding its advantages in a highly competitive world, where China’s  President exclaims that China will move to center stage and the very smart President of France is caught off-mic  saying ‘China is now the leader’, America needs to look beyond its endless psy-ops in itself and focus in maintaining what we are good at and improving on where we have been slipping. Given the trend lines of both the technologies considered here and the threat streams that we face, we will suffer minor and major loss after loss on the battlefield if we don’t change. The battlefield is now in your phone and in your mind.