Books

Chapter 1. Trail Runs

A quarter-moon reflected on the slowly flowing Euphrates, a river along which nations have warred for five thousand years. It was just after midnight, September 6, 2007, and a new kind of attack was about to happen along the Euphrates, one that had begun in cyberspace. On the east side of the river, seventy-five miles south into Syria from the Turkish border, up a dry wadi from the riverbank, a few low lights cast shadows on the wadi’s sandy walls. The shadows were from a large building under construction. Many North Korean workers had left the construction site six hours earlier, queuing in orderly lines to load onto buses for the drive to their nearby dormitory. For a construction site, the area was unusually dark and unprotected, almost as if the builder wanted to avoid attracting attention. Without warning, what seemed like small stars burst above the site, illuminating the area with a blue-white clarity brighter than daylight. In less than a minute, although it seemed longer to the few Syrians and Koreans still on the site, there was a blinding flash, then a concussive sound wave, and then falling pieces of debris. If their hearing had not been temporarily destroyed by the explosions, those on the ground nearby would then have heard a longer acoustic wash of military jet engines blanketing the area. Had they been able to look beyond the flames that were now sweeping the construction site, or above the illuminating flares that were still floating down on small parachutes, the Syrians and Koreans might have seen F-15 Eagles and F-16 Falcons banking north, back toward Turkey. Perhaps they would even have made out muted blue-and-white Star of David emblems on the wings of the Israeli Air Force strike formation as it headed home, unscathed, leaving years of secret work near the wadi totally destroyed.

Behind all of this mystery, however, was another intrigue. Syria had spent billions of dollars on air defense systems. That September night, Syrian military personnel were closely watching their radars. Unexpectedly, Israel had put its troops on the Golan Heights on full alert earlier in the day. From their emplacements on the occupied Syrian territory, Israel’s Golani Brigade could literally look into downtown Damascus through their long-range lenses. Syrian forces were expecting trouble. Yet nothing unusual appeared on their screens. The skies over Syria seemed safe and largely empty as midnight rolled around. In fact, however, formations of Eagles and Falcons had penetrated Syrian airspace from Turkey. Those aircraft, designed and first built in the 1970s, were far from stealthy. Their steel and titanium airframes, their sharp edges and corners, the bombs and missiles hanging on their wings, should have lit up the Syrian radars like the Christmas tree illuminating New York’s Rockefeller Plaza in December. But they didn’t.

What the Syrians slowly, reluctantly, and painfully concluded the next morning was that Israel had “owned” Damascus’s pricey air defense network the night before. What appeared on the radar screens was what the Israeli Air Force had put there, an image of nothing. The view seen by the Syrians bore no relation to the reality that their eastern skies had become an Israeli Air Force bombing range. Syrian air defense missiles could not have been fired because there had been no targets in the system for them to seek out. Syrian air defense fighters could not have scrambled, had they been fool enough to do so again against the Israelis, because their Russian-built systems required them to be vectored toward the target aircraft by ground-based controllers. The Syrian ground-based controllers had seen no targets.
By that afternoon, the phones were ringing in the Russian Defense Ministry off Red Square. How could the Russian air defense system have been blinded? Syria wanted to know.

Cyber warriors around the world, however, were not surprised. This was how war would be fought in the information age, this was Cyber War. When the term “cyber war” is used in this book, it refers to actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption. When the Israelis attacked Syria, they used light and electric pulses, not to cut like a laser or stun like a taser, but to transmit 1’s and 0’s to control what the Syrian air defense radars saw. Instead of blowing up air defense radars and giving up the element of surprise before hitting the main targets, in the age of cyber war, the Israelis ensured that the enemy could not even raise its defenses.

The Israelis had planned and executed their cyber assault flawlessly. Just how they did it is a matter of some conjecture.

Chapter 2. Cyber Warriors

In a television ad, a crew-cut young man in a jumpsuit walks around a darkened command center, chatting with subordinates who are illuminated by the greenish light from their computer screens. We hear his voice over the video: “control of power systems . . . water systems . . . that is the new battlefield . . . in the future this is going to be the premier war-fighting domain . . . this is going to be where the major battles are fought.” He then looks right at the camera and says, “I am Captain Scott Hinck, and I am an Air Force Cyber Warrior.” The screen fades to black, and then three words appear: “ Air, Space, Cyberspace.” Then, as the ad ends, we see a winged symbol and the name of the sponsor, “United States Air Force.”

So now we know what one cyber warrior looks like. At least in Scott’s case, he looks a lot like the bright, fit, earnest officers who populate the world’s most potent military. That is not quite our image of hackers, whom movies have portrayed as acned, disheveled guys with thick glasses. To attract more of those with the skills needed to understand how to fight cyber war, however, the Air Force seems to think it may have to bend the rules. “If they can’t run three miles with a pack on their back, but they can shut down a SCADA system,” mused Air Force Major General William Lord, “we need to have a culture where they can fit in.” (A SCADA system is the software that controls networks such as electric power grids.) That progressive attitude reflects the U.S. Air Force’s strong desire to play the leading role for the U.S. in cyber war. That service was the first to create an organization for the purpose of combat in the new domain: U.S. Air Force Cyber Command.

The perception that cyberspace is a “domain” where fighting takes place, a domain that the U.S. must “dominate,” pervades American military thinking on the subject of cyber war. The secret-level National Military Strategy for Cyber Operations (partially declassified as a result of a Freedom of Information Act request) reveals the military’s attitude toward cyber war, in part because it was written as a document that we, the citizens, were never supposed to see. It is how they talk about it behind the closed doors of the Pentagon. What is striking in the document is not only the acknowledgment that cyber war is real, but the almost reverential way in which it is discussed as the keystone holding up the edifice of modern war fighting capability. Because there are so few opportunities to hear from the U.S. military on cyber war strategy, it is worth reading closely the secret-level attempt at a cyber war strategy.

The document, signed out under a cover letter from the Secretary of Defense, declares that the goal is “to ensure the US military [has] strategic superiority in cyberspace.” Such superiority is needed to guarantee “freedom of action” for the American military and to “deny the same to our adversaries.” To obtain superiority, the U.S. must attack, the strategy declares. “Offensive capabilities in cyberspace [are needed] to gain and maintain the initiative.” At first read, the strategy sounds like a mission statement with a bit of zealotry thrown in. On closer examination, however, the strategy reflects an understanding of some of the key problems created by cyber war. Speaking to the geography of cyberspace, the strategy implicitly acknowledges the sovereignty issue ( “the lack of geopolitical boundaries . . . allows cyberspace operations to occur nearly anywhere”) as well as the presence of civilian targets (“cyberspace reaches across geopolitical boundaries . . . and is tightly integrated into the operations of critical infrastructure and the conduct of commerce”). It does not, however, suggest that such civilian targets should be off-limits from U.S. attacks. When it comes to defending U.S. civilian targets, the strategy passes the buck to the Department of Home-land Security.

The need to take the initiative, to go first, is dictated in part by the fact that actions taken in cyberspace move at a pace never before experienced in war (“cyberspace allows high rates of operational maneuver . . . at speeds that approach the speed of light. . . . [It] affords commanders opportunities to deliver effects at speeds that were previously incomprehensible”). Moreover, the strategy notes that if you do not act quickly, you may not be able to do so because “a previously vulnerable target may be replaced or provided with new defenses with no warning, rendering cyberspace operations less effective.” In short, if you wait for the other side to attack you in cyberspace, you may find that the opponent has, simultaneously with their attack, removed your logic bombs or disconnected the targets from the network paths you expected to use to access them. The strategy does not discuss the problems associated with going first or the pressure to do so.

The importance of cyberspace and cyber war to the U.S. military is revealed in the strategy’s declaration that “DOD will conduct kinetic missions to preserve freedom of action and strategic advantage in cyberspace.” Translated from Pentagonese, that statement means that rather than cyber attacks being just some support mechanism of a shooting war, the Defense Department envisions the need to bomb things in the physical world to defend against cyber attack, or to drive an enemy into networks that American cyber warriors control.

The strategic concept of deterrence is discussed in the strategy only insofar as it envisions a desired end state where “adversaries are deterred from establishing or employing offensive capabilities against US interests in cyberspace.” Since twenty or thirty nations have already established offensive cyber units, we apparently did not deter them from “establishing.” The way to stop those nations from using that capability against us, however, is discussed as “inducing adversary restraint based on demonstrated capabilities.” However, the secrecy surrounding U.S. offensive cyber war weapons means that we have no demonstrated capabilities. By the logic of the U.S. military’s strategy, we therefore cannot induce adversary restraint. The strategy does not suggest a way around this conundrum, let alone recognize it. Thus, what is called a military strategy for cyber operations raises some of the key issues that would need to be addressed in a strategy, but it does not provide answers. It is not really a strategy, but more of an appreciation. To the extent that it provides guidance, it seems to argue for initiating combat in cyberspace before the other side does, and for doing all that may be needed to dominate in cyberspace, because to do otherwise would put other kinds of American dominance at risk.

Buried in the document is, however, a realistic assessment of the problems facing the U.S. in cyber war: “threat actors can take advantage of [our] dependence” on cyberspace; and, “absent significant effort, the US will not continue to possess an advantage in cyberspace” and the U.S. will “risk parity with adversaries.” Put another way, the strategy does note the fact that other nations may be able to inflict cyber war damage on us equal to our ability to inflict it on them. It may actually be worse, because we have a greater dependence on cyberspace, which can play to the advantage of an attacker.

If the U.S. is so vulnerable, to whom is it vulnerable? Who are the other cyber warriors?

Chapter 3. The Battlespace

Cyberspace. It sounds like another dimension, perhaps with green lighting and columns of numbers and symbols flashing in midair, as in the movie The Matrix. Cyberspace is actually much more mundane. It’s the laptop you or your kid carries to school, the desktop computer at work. It’s a drab windowless building downtown and a pipe under the street. It’s everywhere, everywhere there’s a computer, or a processor, or a cable connecting to one.

And now it’s a war zone, where many of the decisive battles in the twenty-first century will play out. To understand why, we need to answer some prior questions, like: What is cyberspace? How does it work? How can militaries fight in it?

Cyberspace is all of the computer networks in the world and everything they connect and control. It’s not just the Internet. Let’s be clear about the difference. The Internet is an open network of networks. From any network on the Internet, you should be able to communicate with any computer connected to any of the Internet’s networks. Cyberspace includes the Internet plus lots of other networks of computers that are not supposed to be accessible from the Internet. Some of those private networks look just like the Internet, but they are, theoretically at least, separate. Other parts of cyberspace are transactional networks that do things like send data about money flows, stock market trades, and credit card transactions. Some networks are control systems that just allow machines to speak to other machines, like control panels talking to pumps, elevators, and generators.

What makes these networks a place where militaries can fight? In the broadest terms, cyber warriors can get into these networks and control or crash them. If they take over a network, cyber warriors could steal all of its information or send out instructions that move money, spill oil, vent gas, blow up generators, derail trains, crash airplanes, send a platoon into an ambush, or cause a missile to detonate in the wrong place. If cyber warriors crash networks, wipe out data, and turn computers into doorstops, then a financial system could collapse, a supply chain could halt, a satellite could spin out of orbit into space, an airline could be grounded. These are not hypotheticals. Things like this have already happened, sometimes experimentally, sometimes by mistake, and sometimes as a result of cyber crime or cyber war. As Admiral Mike McConnell has noted, “information managed by computer networks—which run our utilities, our transportation, our banking and communications—can be exploited or attacked in seconds from a remote location overseas. No flotilla of ships or intercontinental missiles or standing armies can defend against such remote attacks located not only well beyond our borders, but beyond physical space, in the digital ether of cyberspace.”

Why, then, do we run sophisticated computer networks that allow unauthorized access or unauthorized commands? Aren’t there security measures? The design of computer networks, the software and hardware that make them work, and the way in which they were architected, create thousands of ways that cyber warriors can get around security defenses. People write software and people make mistakes, or get sloppy, and that creates opportunities. Networks that aren’t supposed to be connected to the public Internet very often actually are, sometimes without their owners even knowing. Let’s look at some things in your daily life as a way of explaining how cyber war can happen. Do you think your condominium association knows that the elevator in your building is, like ET in the movie of the same name, “phoning home”? Your elevator is talking over the Internet to the people who made it. Did you know that the photocopier in your office is probably doing the same thing? Julia Roberts’s character in the recent movie Duplicity knew that many copying machines are connected to the Internet and can be hacked, but most people don’t know that their copier could even be online. Even fewer think about the latest trick, shredders that image. Just before all those sensitive documents pass through the knives that cut them into little pieces, they go by a camera that photographs them. Later, the cleaning crew guy will take his new collection of pictures away to whoever hired him.

Your elevator and copier “phoning home” is supposed to be happening, the software is working properly. But what if your competitor has a computer programmer who wrote a few lines of code and slipped them into the processor that runs your photocopier? Let’s say those few lines of computer code instruct the copier to store an image of everything it copies and put them into a compressed data (or zip) file. Then, once a day, the copier accesses the Internet and—ping!—it shoots that zip file across the country to your competitor. Even worse, on the day before your company has to submit a competitive bid for a big contract—ping!—the photocopier catches fire, causing the sprinklers to turn on, the office to get soaked, and your company to be unable to get its bid done in time. The competitor wins, you lose.

Chapter 4. The Defense Fails

Even though historians and national security officials know that there are numerous precedents for institutions thinking their communications are secure when they are not, there is still resistance to believing that it may be happening now, and to us. American military leaders today cannot conceive of the possibility that their Secret (SIPRNET) or Top Secret intranet (JWICS) is compromised, but several experts I spoke to are convinced that it is. Many corporate leaders also believe that the millions of dollars they have spent on computer security systems means they have successfully protected their company’s secrets. After all, if anybody had gotten inside their secret files, the intrusion detection system software would have sounded an alarm. Right?

No, not necessarily. And even if the alarm did go off, in many cases that would not have caused anyone to do anything very quickly in response. There are ways of penetrating networks and assuming the role of the network administrator or other authorized user without ever doing anything that would cause an alarm. Moreover, if an alarm does go off, it is often such a routine occurrence on a large network that nothing will happen in response. Perhaps the next day someone will check the logs and notice that a couple of terabytes of information were downloaded and transmitted outside of the network to some compromised server, the first stop on a multistage trip intended to obscure the final destination. Or, perhaps, no one will notice that anything ever happened. The priceless art is still on the museum walls. And if that is the case, why should the government or the bottom-line-conscious executive do anything?

I mentioned in chapter 2 the 2003 phenomenon code-named Titan Rain. Alan Paller, a friend who runs the SANS Institute, a cyber security education and advocacy group, described what happened on one afternoon in that case, November 1, 2003.
At 10:23 p.m. the Titan Rain hackers exploited vulnerabilities at the U.S. Army Information Systems Engineering Command at Fort Huachuca, Arizona.
At 1:19 a.m. they exploited the same hole in computers at the Defense Information Systems Agency in Arlington, Virginia.
At 3:25 a.m. they hit the Naval Ocean Systems Center, a Defense Department installation in San Diego, California.
At 4:46 a.m. they struck the U.S. Army Space and Strategic Defense installation in Huntsville, Alabama.

There were lots of days like that. Not only were Defense facilities hit, but terabytes of sensitive information left NASA labs, as well as the computers of corporations such as Lockheed Martin and Northrop Grumman, which have been given contracts worth billions of dollars to manage security for DoD networks. Cyber security staffs tried to figure out the techniques being used to penetrate the networks. And their blocking efforts seemed to work. One participant in these defensive efforts told us that “Everyone was all self-congratulatory.” He shook his head, pulled a grimace, and added softly, “. . . till they realized that the attacker had just gone all stealthy, but was probably still stealing us blind. We just couldn’t see it anymore.” The case names Moonlight Maze and Titan Rain are now best thought of as fleeting glimpses of a much broader campaign, most of which went unseen. It may seem somewhat incredible that terabytes of information can be removed from a company’s network without that company being able to stop it all from going out the door. In the major cases we know about, the companies or federal organizations usually did not even detect that an exfiltration of data had occurred until well after it had taken place. All of these victims had intrusion-detection systems that are supposed to alarm when an unauthorized intruder attempts to get on a network. Some sites even had the more advanced intrusion-prevention systems, which not only alarm but also automatically take steps to block an intruder. The alarms remained silent. If you have a mental image of every interesting lab, company, and research facility in the U.S. being systematically vacuum cleaned by some foreign entity, you’ve got it right. That is what has been going on. Much of our intellectual property as a nation has been copied and sent overseas. Our best hope is that whoever is doing this does not have enough analysts to go through it all and find the gems, but that is a faint hope, particularly if the country behind the hacks has, say, a billion people in it.

One bright spot in this overall picture of data going out the door unhindered is what happened at Johns Hopkins University’s Advanced Physics Laboratory (APL), outside Baltimore. APL does hundreds of millions of dollars of research every year for the U.S. government, from outer-space technology to biomedicine to secret “national security” projects. APL did discover in 2009 that it had huge amounts of data being secretly exfiltrated off its network and they stopped it. What is very telling is the way in which they stopped it. APL is one of the places that is really expert in cyber security and has contracts with the National Security Agency. So one might think that they were able to get their intrusion systems to block the data theft. No. The only way in which these cyber experts were able to prevent their network from being pillaged was to disconnect the organization from the Internet. APL pulled the plug and isolated its entire network, making it an island in cyberspace. For weeks, APL’s experts went throughout the network, machine by machine, attempting to discover trapdoors and other malware. So the state of the art in really insuring that your data does not get copied right off your network appears to be to make sure that you are in no way connected to anybody. Even that turns out to be harder than it may seem. In large organizations, people innocently make connections to their home computers, to laptops with wi-fi connections, to devices like photocopiers that have their own connectivity through the Internet. If you are connected to the Internet in any way, it seems, your data is already gone.

The really good cyber hackers, including the best government teams from countries such as the U.S. and Russia, are seldom stumped when trying to penetrate a network, even if its operators think the network is not connected in any way to the public Internet. Furthermore, the varsity teams do something that causes network defenders to sound like paranoids. They never leave any marks that they were there, except when they want you to know. Think of Kevin Spacey’s character’s line in the movie The Usual Suspects: “The greatest trick the devil ever pulled was convincing the world he didn’t exist.”

Chapter 5. Toward a Defensive Strategy

Military theorists and statesmen, from Sun Tzu to von Clausewitz to Herman Kahn, have for centuries defined and redefined military strategy in varying ways, but they tend to agree that it involves an articulation of goals, means (broadly defined), limits (perhaps), and possibly sequencing. In short, military strategy is an integrated theory about what we want do and how, in general, we plan to do it. In part because Congress has required it, successive U.S. administrations have periodically published a National Security Strategy and a National Military Strategy for all the world to read. Within the military, the U.S. has many substrategies, such as a naval strategy, a counterinsurgency strategy, and a strategic nuclear strategy. The U.S. government has also publicly published strategies for dealing with issues wherein the military plays only a limited role, such as controlling illegal narcotics trafficking, countering terrorism, and stopping the proliferation of weapons of mass destruction. Oh yes, there is also that National Strategy to Secure Cyberspace dating back to 2003; but there is no publicly available cyber war strategy.

In the absence of a strategy for cyber war, we do not have an integrated theory about how to address key issues. To prove that, let’s play Twenty Questions and see if there are agreed-upon answers to some pretty obvious questions about how to conduct cyber war:

• What do we do if we wake up one day and find the western half of the U.S. without electrical power as the result of a cyber attack?
• Is the advent of cyber war a good thing, or does it place us at a disadvantage?
• Do we envision the use of cyber war weapons only in response to the use of cyber war weapons against us?
• Are cyber weapons something that we will employ routinely in both small and large conflicts? Will we use them early in a conflict because they give us a unique advantage in seeking our goals, such as maybe effecting a rapid end to the conflict?
• Do we think we want to have plans and capabilities to conduct “stand-alone” cyber war against another nation? And will we fight in cyberspace even when we’re not shooting at the other side in physical space?
• Do we see cyberspace as another domain (like the sea, airspace, or outer space) in which we must be militarily dominant and in which we will engage an opponent while simultaneously conducting operations in other domains?
• How surely do we have to identify who attacked us in cyberspace before we respond? What standards will we use for these identifications?
• Will we ever hide the fact that it was us who attacked with cyber weapons?
• Should we be hacking into other nations’ networks in peace-time? If so, should there be any constraints on what we would do in peacetime?
• What do we do if we find that other nations have hacked into our networks in peacetime? What if they left behind logic bombs in our infrastructure networks?
• Do we intend to use cyber weapons primarily or initially against military targets only? How do we define military targets?
• Or do we see the utility of cyber weapons being their ability to inflict disruption on the economic infrastructure or the society at large?
• What is the importance of avoiding collateral damage with our cyber weapons? How might avoiding it limit our use of the weapons?
• If we are attacked with cyber weapons, under what circumstances would, or should, we respond with kinetic weapons? How much of the answer to this question should be publicly known in advance?
• What kind of goals specific to the employment of cyber weapons would we want to achieve if we conducted cyber war, either in conjunction with kinetic war or as a stand-alone activity?
• Should the line between peace and cyber war be brightly delineated, or is there an advantage to us in blurring that distinction?
• Would we fight cyber war in a coalition with other nations, helping to defend their cyberspace and sharing our cyber weapons, tactics, and targets?
• What level of command authority should authorize the use of cyber weapons, select the weapons, and approve the targets?
• Are there types of targets that we believe should not be attacked using cyber weapons? Do we attack them anyway if similar U.S. facilities are hit first by cyber or other weapons?
• How do we signal our intentions with regard to cyber weapons in peacetime and in crisis? Are there ways that we can use our possession of cyber weapons to deter an opponent?
• If an opponent is successful in launching a widespread, disabling attack on our military or on our economic infrastructure, how does that affect our other military and political strategies?

Didn’t do too well finding the answers anywhere in U.S. government documents, congressional hearings, or officials’ speeches? I didn’t, either. To be fair, these are not easy questions to answer, which is, no doubt, part of the reason they have not yet been knitted together into a strategy. As with much else, how one answers these and other questions will depend upon one’s experience and responsibilities, as well as the perspective that both create. Any general would like to be able to flip a switch and turn off the opposing force, especially if the same cannot be done to his forces in return. Modern generals know, however, that militaries are one of many instruments of the state, and the ultimate success of a military is now judged not just by what it does to the opponent, but by how well it protects and supports the rest of the state, including its underpinning economy. Military leaders and diplomats have also learned from past experiences that there is a fine line between prudent preparation to defend oneself and provocative activities that may actually increase the probability of conflict. Thus, crafting a cyber war strategy is not as obvious as simply embracing our newly discovered weapons, as the U.S. military did with nuclear weapons following Hiroshima.

Chapter 6. How Offensive?

In the seminal 1983 movie about computers and war, War Games, starring a young Matthew Broderick, the tinny computer voice asked haltingly, “Do you want to play a game of thermonuclear war?” Why don’t we play a game of cyber war in order to elucidate some of the policy choices that shape a strategy. DoD runs such exercises, called Cyber Storm, annually. The CIA’s annual cyber war exercise, Silent Horizon, has been happening since 2007. For the purposes of this analysis, I’ll make the same request of you that I made of students at Harvard’s Kennedy School and national security bureaucrats sitting around the White House Situation Room conference table: “Don’t fight the scenario.” By that I mean, do not spend a lot of time rejecting the premise that circumstances could happen someday that would result in the U.S. being on the edge of conflict with Russia or China.

When U.S. cyber warriors talk about the “big one,” they usually have in mind a conflict in cyberspace with Russia or China, the two nations with the most sophisticated offensive capability other than the U.S. No one wants hostilities with those countries to happen. Thinking about it, for the purposes of understanding what cyber war would look like, does not make it more likely. In fact, by understanding the risks of our current cyber war posture, we might reduce the chances of a real cyber war. And if, despite our intentions, a cyber war does happen, it would be best to have thought in advance about how it could unravel.

Certainly, I did not want to see the attack of 9/11 happen, but I had chaired countless “tabletop exercises,” or war game scenarios, to get myself and the bureaucracy ready in case something like it did happen. When it came, we had already thought through how to respond on the day of an attack and the few days thereafter. We spent enormous effort to try to prevent attacks, but we also devoted some time to thinking about what we would do if one succeeded. Had we not done so, that awful day would have been even worse. So, in that spirit of learning by visualizing, let’s think about a period of rising tensions between the U.S. and China.

Let’s call it Exercise South China Sea and set it a few years in the future. Not much has changed, except China has increased its dependence on the Net somewhat. For its part, the U.S. has not done much to improve its cyber defenses. We will have three teams, U.S. Cyber Command, the Chinese People’s Liberation Army (PLA) Cyber Division, and the Controllers, who play the part of everyone else. The Controllers also decide what happens as a result of the other two teams’ moves. Let’s say for the sake of the exercise that China has been aggressively pressing Vietnam and other ASEAN (Association of Southeast Asian Nations) countries to cede their rights to a vast and rich undersea area of gas and oil fields. (China has, in fact, claimed waters that run hundreds of miles to its south, along the coasts of Vietnam and the Philippines.) We will stipulate that there have been small clashes between their navies. In an irony of history, we will say that the government of Vietnam has asked the U.S. for military support, as have other nations in the region with claims on the contested waters. In response, the President has authorized a joint U.S.-ASEAN naval exercise and has dispatched two U.S. carrier battle groups, about twenty ships, including about 150 aircraft and several submarines. China and the U.S. have exchanged diplomatic notes and public pronouncements, with both countries essentially saying that the other one should stay out of the issue. American cable news networks have at this point started showing dramatic slides with the words “South China Sea Crisis.”

As our hypothetical exercise opens at Fort Meade, the team playing Cyber Command has been ordered by the Pentagon to prepare a series of steps it could take as the political situation escalates. The order from the Secretary of Defense is to develop options to:

First, dissuade the Chinese government from acting militarily over the contested waters. Second, failing that, to reduce to the maximum extent possible the ability of the Chinese military to pose a risk to U.S. and allied forces in the area. Third, in the event of increased tensions or the outbreak of hostilities, to be able to disrupt the Chinese military more broadly to reduce its ability to project force. Fourth, to occupy the Chinese leadership with disruption of their domestic infrastructure to the extent that it may cause popular and Party questioning of the Chinese government’s aggressive behavior abroad. Fifth, throughout this period Cyber Command is to work with appropriate U.S. government agencies to prevent Chinese-government or Chinese-inspired cyber attacks on the U.S. military or significant U.S. infrastructure.

Chapter 7. Cyber Peace

The United States, almost single-handedly, is blocking arms control in cyberspace. Russia, somewhat ironically, is the leading advocate. Given the potential destabilizing nature and disadvantages of cyber war to the U.S., as discussed in the earlier chapters, one might think that by now the United States would have begun negotiating international arms control agreements that could limit the risks. In fact, since the Clinton Administration first rejected a Russian proposal, the U.S. has been a consistent opponent of cyber arms control.

Or, to be completely frank, perhaps I should admit that I rejected the Russian proposal. There were many who joined me; few U.S. government decisions are ever the responsibility of a single person. However, one of my jobs in the Clinton White House was to coordinate cyber security policy, including international agreements, across the government. Despite some interest in the State Department in pursuing cyber arms control, and although the U.S. had to stand almost alone in the U.N. in rejecting cyber talks, we said no. I viewed the Russian proposal as largely a propaganda tool, as so many of their multilateral arms control initiatives had been for decades. Verification of any cyber agreement seemed impossible. Moreover, the U.S. had not yet explored what it wanted to do in the area of cyber war. It was not obvious then whether or not cyber war added to or subtracted from U.S. national security. So we said no, and we have kept saying no for over a decade now.

Now that over twenty nations’ militaries and intelligence services have created offensive cyber war units and we have gained a better understanding of what cyber war could look like, it may be time for the United States to review its position on cyber arms control and ask whether there is anything beneficial that could be achieved through an international agreement.

Often arms control negotiations have found difficulty in achieving agreement on something as basic as a definition of what it is that they were seeking to limit. I sat around the table for months with Soviet counterparts trying to define something as simple as “military personnel.” For the purposes of discussion in this book, we won’t have that kind of delay. Let’s take the definition we used in chapter 1 and make it sound more like treaty language:

Cyber warfare is the unauthorized penetration by, on behalf of, or in support of, a government into another nation’s computer or network, or any other activity affecting a computer system, in which the purpose is to add, alter, or falsify data, or cause the disruption of or damage to a computer, or network device, or the objects a computer system controls.

With that definition and the U.S. asymmetrical vulnerabilities in mind, are there successes in other forms of arms control that could be ported into cyberspace, or new ideas unique to the characteristics of cyber war that could form the basis of beneficial arms control? What are the pitfalls of bad arms control to which we should give special attention and caution when thinking about limits on cyber war? How could an international agreement limiting some aspects of cyber war be beneficial to the United States, as well as operationally feasible and adequately verifiable?

Chapter 8. The Agenda

“It’s POTUS”

Those were the words our hypothetical White House official heard in chapter 2. Most of the time, those are words you never want to hear, at least when somebody is shoving a phone in your direction in a crisis. The sixth element of our agenda is, however, Presidential involvement. I know that everyone working on a policy issue thinks the President should spend a day a week on his or her pet rock. I don’t.

The President should, however, be required to approve personally the emplacement of logic bombs in other nations’ networks, as well as approve the creation of trapdoors on a class of politically sensitive targets. Because logic bombs are a demonstration of hostile intent, the President alone should be the one who decides that he or she wants to run the destabilizing risks associated with their placement. The President should be the one to judge the likelihood of the U.S. being in armed conflict with another nation in the foreseeable future, and only if that possibility is high should he or she authorize logic bombs. Key congressional leaders should be informed of such presidential decisions, just as they are for other covert-actions. Then, on an annual basis, the President should review the status of all major cyber espionage, cyber war preparation of the battlefield, and cyber defense programs. An annual cyber defense report to the President should spell out the progress made on defending the backbone, securing the DoD networks, and (let me hear you say it) protecting the electric power grid.

In this annual checkup, the President should review what Cyber Command has done: what networks they have penetrated, what options would be available to him in a crisis, and whether there are any modifications needed to his earlier guidance. This review would be similar to the annual covertaction review and the periodic dusting off of the nuclear war plan with the President. Knowing that there is an annual checkup keeps everybody honest. While he is reviewing the cyber war strategy implementation, the President could annually get a report from our proposed Cyber Defense Administration on its progress in securing government agencies, the Tier 1 ISPs, and (all together now) the power grid.

Finally, the President should put reducing Chinese cyber espionage at the top of the diplomatic agenda, and make clear that such behavior amounts to a form of economic warfare.

As I suggested earlier, the President should use the occasion of his annual commencement address at a military service academy, looking out over the cadets or midshipmen and their proud families, to promulgate the Obama Doctrine of Cyber Equivalence, whereby a cyber attack on us will be treated the same as if it were a kinetic attack and that we will respond in the manner we think best, based upon the nature and extent of the provocation. I suggested that he add a proposal for a global system of National Cyber Accountability that would impose on nations the responsibility to deal with cyber criminals and allegedly spontaneous civilian hack-tivists, and an Obligation to Assist in stopping and investigating cyber attacks. It would be a sharp contrast to the Bush Doctrine, announced at West Point, that expressed the sentiment that we should feel free to bomb or invade any nation that scares us, even before it does anything to us.

To follow up such a spring speech at an academy, the President should then in September give his annual address at the opening of the United Nations General Assembly session. Looking out from that green granite podium at the leaders or representatives of nine-score countries, he should say that

It could be a beautiful speech, and it could make us safer.

Chapter 1: 9-11 Changed Everything?

When I said "Your government failed you" to the families of the victims of 9-11, it seemed to me that I was merely stating the obvious: the government had failed the American people. And I had.

Three thousand people had been murdered in a morning, not on a battlefield, not in their battleships as had happened in Pearl Harbor, but in their offices. They had been killed by a terrorist group that had promised to attack us, and which we had been unable to stop.

"9-11 changed everything." That was the remark that we heard over and over again in the years that followed. It was only partially true. 9-11 did not change the Constitution, although some have acted as if it did. Nor did the government's response to the attack make us more secure.

By the second anniversary of the 9-11 attack on America, the United States had invaded and occupied two Islamic nations, created an Orwellian-sounding new bureaucracy, launched a spending spree of unprecedented proportions, and was systematically shredding the Constitution. Despite our frenzy, or in many cases because of it, the problem we sought to address, violent Islamist extremism, was getting worse. Much of what our government did after 9-11, at home and abroad, departed from our values and identity as a nation. It was also massively counter-productive. Our government failed us before and after 9-11, and it continues to do so today.

Chapter 2: NO MORE VIETNAMS

For no institution is the pain of failure more personal than for our military. When the military fails, their friends die and leave widows. Many of the living lose limbs or acquire post-traumatic stress disorder. And no institution has tried as hard as the U.S. military to understand why failure occurs or has worked as diligently to correct mistakes so that they do not recur. The formal Lessons Learned process is ingrained in the U.S. military's way of doing business. And yet there is Iraq.

The U.S. military is so richly deserving of our thanks and respect that few civilians have been willing to suggest that the Iraq disaster is at all the military's fault. Clearly the elected civilian commander-in-chief, his seasoned Vice President, the two-time Secretary of Defense, Congress, and others should bear most of the blame. But the military, more precisely the officer corps, and specifically many general officers over the course of thirty years, deserve some culpability. I say that not to add to the chorus of scapegoating and finger-­pointing, but so that we as a nation can follow in the military's tradition of lessons learned, so that we can avoid Santayana's condemnation. And I believe the trail leads back to the military's own reactions to the national failure that was the Vietnam War. To understand Iraq, we need to remember Vietnam and what happened in the U.S. military after that war....

....Despite Shali's greater willingness to use force, a risk aversion deriving from the Weinberger-­Powell Doctrine continued. That attitude was taken to its illogical extreme in dealing with terrorism. Before 9/11, as the President's head of counterterrorism, I came to the reluctant but inescapable conclusion that the U.S. military leadership did not want to be part of offensive operations against terrorists. On several occasions the National Security Advisor and his cabinet colleagues in the NSC Principals Committee asked the Chairman of the Joint Chiefs to plan operations to go after terrorists. Sometimes the targets involved were just one man—a lone al Qaeda operative in a hotel room in Khartoum in 1998 or in 1995 a single terrorist working in the Water Department in Qatar. Every time the military came back, recommending against the operations and presenting plans intentionally oversized, involving enormously outsized forces that would have blown any chance of surprise and would have looked as if we were invading. The man working in the Qatar Water Department was reported to be the uncle of 1993 World Trade Center bomber Ramzi Yousef, whom we had hunted down in Pakistan in 1995.

The man in Qatar had been secretly indicted in New York, and evidence suggested that he had had a hand in other operations and would probably plan more. We wanted him badly, but we knew that if we approached the Qatari government to arrest him and hand him over, someone would probably tip him off and he would escape. The CIA correctly said it had no capability to stage covert snatches in Qatar, nor did the FBI. So, remembering that there were small Special Operations Command units trained to do just such things, I urged that the military be ordered to go in with a small team. The Chairman came back not with a small covert unit of Special Operations forces but with an enormous force package and a recommendation against using it. The principals decided not to overrule the military and instructed us to ask the Qataris to arrest the terrorist. We did, but then the Qatari police went to do so, our terrorist had, predictably, just fled the country. The man in the Qatar Water Department did, as we suspected, go on to plan other terrorist strikes. His name was Khalid Sheik Mohammed. He went on to mastermind the 9/11 attacks on the United States.

Chapter 3: NO MORE IRAQs

The third failure happened when it became clear that the President and his advisors were intent on invading Iraq, and those generals empowered to give professional military advice to the civilian commander in chief (and the Congress) failed to point out that the U.S. military was not prepared for what was a foreseeable—indeed, I would argue a likely—scenario: insurgency.

CIA analyses at the time made clear that insurgency was a possible postinvasion outcome. In January 2003, two intelligence assessments, “Principal Challenges in Post-­Saddam Iraq” and “Regional Consequences of Regime Change in Iraq,” predicted that internal violence and a surge in Islamist extremist violence might follow an overthrow of Saddam Hussein and an occupation.

It is one thing not to prepare for counterinsurgency in the hope that America will never have to fight one. It is quite another thing not to tell the President that you have little or no counterinsurgency capability when he directs you to conduct a war where an insurgency is likely. The point of not having a counterinsurgency capability was, presumably, so we would never have to fight one again. However, the strategy works only if you tell the Secretary of Defense or the President or the Congress the dirty little secret that you are not prepared for such a war. Then, if you are lucky, they will decide not to run the risk of going into a war that could result in a counterinsurgency. That strategy does not work if you remain silent. I am reminded of the scene in the 1960s movie Dr. Strangelove, in which the Soviet Ambassador reveals that any U.S. nuclear attack on the USSR will automatically trigger a world-­ending response. Incensed, Dr. Strangelove yells at him, “the . . . whole point of the doomsday machine . . . is lost . . . if you keep it a secret! Why ­didn’t you tell the world, eh?”

And later in the chapter

A fifth failure of some generals crossed a line that had long been defended by the leadership of the U.S. military. For generations, the U.S. military’s leaders had held fast to observing international law with regard to prisoners. They believed that only if we upheld international standards did we have any chance of convincing others to do so. In short, if we tortured and abused prisoners, it increased the chances that our own troops would be abused when they were captured. Yet the record seems clear that generals, perhaps including the top U.S. commander in Iraq, Rick Sanchez, knew about, condoned, and authorized the kind of despicable treatment that the world saw in the pictures from Abu Ghraib. There may even have been daily reports to Secretary of Defense Donald Rumsfeld on the progress of abusive interrogations and torture. Beyond the effect on what others might do to future U.S. prisoners, the Abu Ghraib phenomenon had an immediate effect on Arabs’ and Muslims’ perceptions of the United States of America. It was like rocket fuel for the al Qaeda movement worldwide. While generals failed in their legal, moral, and strategic mission by permitting such activity, at least one general did his duty. Major General Antonio Taguba was asked to investigate what had happened and write a report. He was encouraged to sweep as much as possible under the rug, make it look as if a “few bad apples,” low-­ranking personnel, had run amok. Instead, Taguba told the truth.

For doing so, he was asked to retire early. He knew that he was sacrificing his two-­decade-­long career, but he also knew he had to do the honorable thing. After retiring, he told the reporter Seymour Hersh, “We inculcate duty, honor, integrity . . . and yet when we get to senior officer level we forget those values. I know the Army will be mad at me . . . but the fact is that we violated the laws of land warfare, . . . our own principles, . . . and the core of our military values. . . . Those civilian and military leaders responsible should be held accountable.” In any hall of American military heroes, there should be a special place for Antonio Taguba, for he demonstrated a form of courage rarer than battlefield valor, and he gave real meaning to the word honor.

Chapter 4: Can we reduce intelligence failures?

….There are similar problems with the other class of technical collection, Signals Intelligence (SIGINT). The problem is not usually a matter of our ability to collect electrons; it is sometimes a question of recognizing the importance of what has been collected. In 1988 a young State Department INR analyst reported to me that he had found, in the many reports sent to him, a one-­line item about a signal normally associated with Chinese long-­range nuclear missiles. The problem was that the analyst covered Saudi Arabia, not China, and the report was about Saudi Arabia.

No one else seemed to have noticed the routine report, nor did anyone seem to care when he raised a question about the aberrant signal. The report of that electronic bleep made no sense to me at first. Saudi Arabia was a close U.S. ally and got its weapons from us and from the Europeans. Neither we nor the Europeans would ever have sold it long-­range nuclear-­capable missiles. But wait, that was the point. Of course, we would not have sold it such a missile. Maybe the Saudis, therefore, had not asked us. Maybe they were crazy enough to have wanted such a weapon and bought them from the Chinese. Surely, however, we would have detected the negotiation of such a deal, or at least the delivery of such a big weapons system. As I said those words to the analyst, I realized that they were probably not accurate. I had already learned never to assume that U.S. intelligence had detected something, no matter how big and obvious. We asked for satellite photography and promptly found an extremely large base in the Saudi desert, complete with Chinese troops and long-­range nuclear-­capable missiles. The base was almost completed and the missiles were not yet operational.

Conveniently, the Chinese foreign minister was a floor above me at the time, meeting with Secretary of State George Shultz. Shultz was less than delighted with the prospect of having to confront his guest and the Saudis about their secret activities. However, he quickly understood that the Saudis appeared to be pulling their own version of the Cuban Missile Crisis. It looked as if the Saudis were trying to sneak nuclear missiles into their country and have them operational before anyone knew about them. China, which in the 1980s was not rich and had little respect for the Nuclear Non-­Proliferation Treaty, had readily agreed to sell the old missiles for a small fortune. Had it also agreed to sell the nuclear warheads without which the inaccurate missiles were worthless? Shultz did not ask that question of his guest. Instead, he asked the Saudi king to agree that no nuclear warheads would be introduced into Saudi Arabia and that the Chinese base would be open for inspection. The Saudis agreed. Had they not, it is likely they would soon have seen heavily laden fighter-­bombers marked with the Star of David streaking overhead well before their missile base was completed….

   Before leaving this period, I want to make a slight diversion to go into detail on one of the more incredible parts of the 9/11 tragedy, the fact that the CIA did not tell the FBI, Immigration, the State Department, or the National Coordinator for Security and Counterterrorism (me) that two known al Qaeda terrorists had made it to America and were running around somewhere in this country. A year and a half later those two terrorists participated in the 9/11 attacks.

   As jaded and cynical as I am about government failures, I still find this one mind-boggling and inexplicable. The 9/11 Commission Report does not tell us very much about how or why it happened, and their explanations, while they could be correct, strain credulity and leave many questions unanswered. Here are the facts as we now know them:

   In 1998 the United States discovered that al Qaeda was using a telephone number in Yemen. Monitoring the Yemen number, NSA and CIA obtained names of al Qaeda operatives, including Khalid al-Midhar. Link analysis connected him to others to the U.S. embassy bombings.

   In late 1999 al Qaeda planners used this telephone to place calls discussing a meeting to be held in Kuala Lumpur, Malaysia, for just after the mullennium rollover at the beginning of 2000. (Al Qaeda anticipated that several attacks would take place in Jordan, Yemen, and the United States around New Year's Day, but the plots were foiled or failed.) Khalid al-Midhar was among those traveling to Malaysia. Alerted to his travel and his planned change of planes in Dubai, the CIA arranged to obtain and photograph his passport. In that passport, CIA discovered a visa for entry into the United States. It had been issued by the U.S. Consulate in Jeddah, Saudi Arabia, several months before.

   The CIA and NSA had note placed his name on the "don't give this guy a visa" list before his July 1999 application, even though they had known he was an al Qaeda operative from the Yemen intercepts (mistake number 1). Moreover, the Saudis had reportedly told the CIA that al-Midhar and al-Hamzi were al Qaeda members. Yet no one told that to the visa section at the U.S. Embassy in Riyadh (mistake number 2). When the CIA learned in Dubai that al-Midhar had a valid U.S. visa (by looking at it), they did not ask the State Department to revoke the visa, nor did they place his name on Immigration's "do not enter the United States" list (mistake number 3), even though there was a CIA program to do that kind of notification and CIA had done so hundreds of times before with other terrorist names.

   Al-Midhar and al-Hamzi met in Kuala Lumpur with known al Qaeda operative at a swank golf club condo. The CIA requested the local security service to photograph people entering the meeting, which it did. A few days later al-Midhar and al-Hamzi traveled to Thailand. No one followed them, but the CIA assumed for some reason that they would remain in Thailand for a while. Instead, the two men got on a United Airlines flight (not for the last time) and flew to Los Angeles, where they waltzed through Immigration. Two months later, the Thai intelligence service got around to telling the CIA that the two had gone to the United States.

   To ensure that the CIA and FBI exchanged needed information and stopped keeping secrets from each other, we had created a system of exchange officers. There were several CIA officers at the FBI terrorism office and a umber of FBI agents at the CIA's Counterterrorism Center. Some exchange officers even supervised the other agency's personnel. After Midhar and Hamzi showed up in Los Angeles, an FB agent at CIA headquarters asked permission to tell FBI headquarters that terrorists were at large in California. The exchange program was working. The FBI agent had seen something that he needed to tell his parent agency, something that had not yet been shared with the Bureau for some inexplicable reason. His request was denied by his CIA supervisor (mistake number 4). At that point, the failure to tell the FBI went from being a sloppy oversight to being a conscious decision.

   Meanwhile, the two terrorists were trying to figure out how to cope in L.A., when one day they met a nice man in a restaurant. Omar al-Bayoumi was also from Saudi Arabia and, according to him, he just happened to hear some Saudi accents and befriended his fellow countrymen. Shortly thereafter, al-Bayoumi arranged for the two terrorists to move across the street from him in San Diego and then began receiving monthly stipends from his employer to take care of the boys. His employer was a Saudi company that had contracts with the Saudi government. Oman, however, did not actually work at the company. He spent his time roaming around among Saudis in Southern California. Many people, including the local FBI office at the time, assumed he was a Saudi intelligence officer.

   The two terrorists signed up for flight school, did badly, and dropped out. Bored, al-Midhar went back to Yemen and may have been involved in the October 2000 attack o the U.S.S. Cole. The FBI investigators in Yemen working on the Cole case then found evidence of the earlier Malaysia meeting, where it seems the attack on the Cole had been on the agenda. The FBI provided the CIA with pictures of people who they believed had gone to the meeting and telephone numbers associated with them, asking for anything the CIA knew about them. Even though they knew about Midhar, the CIA said nothing (mistake number 5). Al-Midhar, meanwhile, went underground for a while, showuping up again in Saudi Arabia in June 2001 to get yet another U.S. entry visa from the State Department (mistake number 6). He landed at John F. Kennedy International Airport on July 4, 2001, and again cleared Immigration (mistake number 7).

   A little earlier, CIA officers had also flown to New York to meet with the FBI there. The New York FBI office had the lead in the Bureau's investigating of Al Qaeda and by then had indicted bin Laden and others. The visiting CIA officers showed pictures of al-Midhar and al-Hamzi and asked what the FBI knew about them. They seemed to be fishing. They offered the FBI no information. Sometime later in July, a CIA officer assigned to FBI headquarters sent a message back to the CIA expressing his concerns about the terrorists. He seems to have learned at CIA that al-Midhar and al-Hamzi were in the United Staets, but apparently had been instructed not to tell any of his FBI analysts or superiors (mistake number 8). He got no answer frm CIA headquarters. Then an FBI agent in New York stumbled upon the factthat the CIA knew the two ere in the United States, but was told by a CIA officer to "stand down: and do nothing about it (mistake number 9).

   Finally, on August 23, 2001, the CIA alerted the FBI and Immigration that the two were in the United States. It did so in a way that attracted little attention. It did not mention it in the Interagency Threat Committee, chaired twice a week by Roger Cressey of the NSC. It did not mention it in the Counterterrorism Security Group I chaired at lat weekly. It did not call Dale Watson, the FBI's top counterterrorism official. In fact, it was so low-key that the FBI did not immediately grasp how important the information was, and, therefore, did none of the obvious steps that would have located the two (such as checking if they had credit cards in their real names—they did—and where they had recently used them).

   The names resurfaced on the day of the attack, 9/11. The CIA Director recalled the fact that the two al Qaeda terrorists were in the United States as soon as he heard about the attacks. Dale Watson, then the number two person in the FBI, was told by his staff that two if the names on the passenger manifests of the hijacked aircraft were those of known al Qaeda terrorists. That's how Dale found out that the U.S. government had already known about the two terrorists prior to the hijackings. Watson placed a call to me at the Situation Room, pulling me out of the crisis group to tell me. That's how and when I found out about al-Hamzi and al-Midhar.

   The human brain is designed to take disparate data and order them, make sense of them, place them into a context we can understand from past experience. Sometimes it mistakenly forces data into a pattern, trying to cause things to make sense when they are purely random. This human tendency leads to conspiracy theories, which are attempts to order data that otherwise seems chaotic and improbable. Working in national security, intelligence, and terrorism, I have had to deal with a lot of conspiracy theories, such as: the queen of England is a narcotics trafficker, the U.S. Navy shot down TWA flight 800, the feds blew up the Alfred P. Murrah Federal Building in Oklahoma City, Y2K was a conspiracy by the software industry to make money, Israel blew up the World Trade Center on 9/11, there was no airplane that his the Pentagon, Iraq had a role in 9/11. As an investigator you suspend disbelief. You check the theories out. You run them to ground. Ninety percent of the time or more, you debunk them. Once in a while, you keep the jury out.

…I know that highly trained, independent investigators with the 9/11 Commission and with the Justice Department's inspector general examined the record of this amazing series of breakdowns surrounding Midhar and Hamzi. The CIA inspector general, John Helgerson, also did an extensive investigation into this and other alleged lapses of the ­CIA's performance related to al Qaeda. The Helgerson Report notes that not one or two, but sixty (60) CIA personnel knew about the presence in the United States of al-Hamzi and al-Midhar and did nothing to tell the FBI. Maybe they thought it was someone ­else's job among the group of five dozen, but if they thought someone else had told FBI, did none of them ever think to ask what the FBI had done with the information, not once during a year and a half?

The Senate and House Intelligence Committees investigated 9/11-­related intelligence in a rare joint committee. Senate Intelligence Committee Chairman Bob Graham came to the conclusion that Omar al-Bayoumi, the nice man in the L.A. restaurant, was a Saudi intelligence agent.

The reason that there may be doubts about all of this is that there is an ordering explanation, a way of making these seemingly unbelievable facts fit a pattern. The 9/11 Commission's own staff report and the Helgerson Report both unintentionally provide a beginning. What if, they ask, the U.S. government had not been a bumbling giant unaware of what it already knew? Well, then, the reports posit, we would have had the option of intentionally letting Hamzi and Midhar into the United States and trying to flip them to become our first real sources inside al Qaeda, or we might just have followed them around to see where they went, who they talked to. But, the Commission staff reports note, that was probably not something the pre-­9/11 FBI was up to. Quite right. Had the FBI known about the location in the United States of two known al Qaeda terrorists, it would have arrested them before the coffee cooled. Unlike some other police intelligence agencies around the world, the FBI does not usually believe in giving people a chance to slip surveillance when they know that the people being surveilled are likely to go out and kill.

The CIA would not try such a dangerous ploy as trying to flip al Qaeda terrorists in the United States into becoming CIA sources because that would violate laws prohibiting CIA operations inside the United States. The CIA would not ask Saudi intelligence to approach al-Midhar and al-Hamzi in Los Angeles, because foreign intelligence agencies are legally barred from running intelligence missions in the United States. Right?

…The human mind rejects the randomness and chaos represented by the theory that the repeated mistakes made about al-Midhar and al-Hamzi were just routine, compounded incompetence. But incompetence happens. Often it is other people who pay for it.

So we prefer to think that repeated incompetence is what happened because we disdain conspiracy theories and would rather not confront the alternative….

Chapter 6: Homeland

…It is scenarios like that, perhaps, that cause some people to think that we need wiretaps without warrants and other infringements of traditional American civil liberties. The possibility that we have homegrown terrorists causes some to think we need to deal with the current terrorist threat differently than we have other security and law enforcement challenges we have faced. It is the fear of another 9/11 that justifies, in some minds, torturing suspected terrorists in camps in legal no-man’s-­lands like U.S. military enclaves in Cuba, Afghanistan, and Iraq.

I deeply disagree. Torture and warrantless wiretaps are unnecessary. They also erode the support we need abroad and the unity we need at home to overcome the threat from violent Islamist extremists. Most important, they are steps in the wrong direction, steps a little closer to the horrors that humans can engage in when rights are eroded. Experts have known for decades that torture draws unreliable information from its victims and that other methods have good track rec­ords in producing cooperation and information from suspects and prisoners. We know of specific examples where tortured prisoners have provided false information, such as the erroneous report that Iraq trained al Qaeda terrorists in the use of weapons of mass destruction.

The belief that Americans have used torture in Abu Ghraib and other U.S. military camps in Iraq, Afghanistan, and Cuba has convinced many in the Islamic world that we do disrespect Muslims. It has helped some to justify terrorist tactics and support for al Qaeda and similar groups. It has convinced many that we are hypocrites when we talk about human rights and democracy. I have long believed that the U.S. Bill of Rights and the U.N. Universal Declaration of Human Rights are among the few membranes, the thin tissues, that separate humanity from another descent into the kind of world that only a few decades ago saw many millions of people degraded and industrially disposed of in the horror camps of Nazi Germany and the Communist Soviet Union. It is in humanity’s genes and makeup that people can engage in such atrocities. And many people have done so.

We need to hold the line well this side of the police state, far from the torture chamber. Yet the U.S. Justice Department originated a ruling that the only torture that was out of bounds was that which caused pain equivalent to organ failure. Anything else done by Americans was permissible, as long as it was not done in the United States. The Vice President of the United States drove to the Congress to lobby members to permit what he euphemistically called “alternative interrogation techniques.” It is hard to believe. You want to think ­it’s all a bad dream, but ­it’s not. You thought America was a force in the world against this sort of thing, not a nation that would actually engage in it. Thankfully, for a while we had John McCain as our conscience. McCain, who was repeatedly tortured, was there to remind us of what it means to be Americans, what it is that we stand for in this world, and who we are not. Unfortunately, he later voted against a legislated ban on waterboarding by the CIA…

People throughout the world knew at one point that the United States stood for something. Even if they disagreed with us on some things, they respected us for our principles. When we criticized others for violating the Universal Declaration of Human Rights, people knew that we had worked hard to overcome our flaws with regard to slavery and racial discrimination. The world knew that it was the government in Washington that fought against those in our country who still tried to violate human rights on the basis of race. It gave us a strength in the world beyond our military might and economic prowess. What we did in violating human rights in the fight against terrorists showed us to the world as hypocrites, and we lost that strength. After 9/11, the United States also abandoned the oldest protection in the Anglo-­American legal system, the concept of habeas corpus. This abandonment of legal tradition allows prisoners to be held by U.S. officials indefinitely, without charges, and without any really impartial review of evidence against them.

Congress has been a party to these erosions of our legal system and civil liberties. When finally it forced the administration to amend the relevant laws instead of just ignoring them, it gave the Attorney General decision-­making authority in place of judges’ control over wiretaps. Congress further agreed to abandon habeas corpus when it came to some detained terrorist suspects, including those in the United States. The disregard of civil liberties, human rights, international law, privacy rights, and due process clearly and repeatedly demonstrated by the U.S. government after 9/11 has made it almost impossible for the American people to join in a consensus with their Congress and government to do some of the sensible things that should be done to enhance security and fight crime…

Chapter 7: Energy

…Prior to 9/11, I was incredibly frustrated because I could see a “clear and present danger” to the United States but, despite my warnings and those of others, the U.S. government remained complacent until it was too late. The result was the death of three thousand innocent people in one day of attacks on two iconic American symbols. As horrendous as that was, it may someday seem less significant than the deaths from floods, the forced migration of millions, the spread of diseases, the dust bowls that were once fertile lands, all of which may be the result of the climate change that we are causing. And, as with 9/11, we were warned, told for years that climate change was happening. Those like Al Gore who told us what was coming were not merely ignored, they were mocked. Imagine their frustration. During critical years when something might have been done to stop climate change, we not only failed to act, we made it worse. When most of the world united to address the problem, the United States rejected the approach and failed to offer an effective alternative.

The “know-­nothings” of climate change have contended for years that the science of climate change was uncertain or that global warming may actually be a good thing on balance. They were right about one thing, that there is uncertainty: we are uncertain about whether we have already passed the point of no return, whether cataclysmic climate change is now inevitable. On the chance that it is not too late to mitigate the damage, to make it less bad than it might otherwise be, we should embark on a national emergency program to reduce carbon emissions. Instead, today, our government continues to fail on the conjoined issues of energy policy and climate change. We are misdiagnosing the national security issues associated with oil, and we are far from a national emergency effort on climate change. We have a muddled, leaderless effort that will not significantly reduce carbon emissions in the foreseeable future. Future generations will likely regard the last ­decade’s activity, or lack of it, on climate change as the most important failure of government in human history. And the failure continues…

Because we do not have that precise knowledge, we seem to think it is acceptable to do little or nothing. If, however, we were told that a terrorist group was going to attack New York City or Florida sometime in the next few decades with a weapon that would flood the areas and make them uninhabitable, we would not hesitate to begin acting now. Yet climate change may have a greater effect in this century than any combination of major terrorist attacks or wars, causing population centers to disappear, millions of people to move, and the global balance of power to shift away from the United States…

I have never really understood why some national security experts willingly accept the need to act on the basis of unquantifiable and remote threats from terrorists or the ballistic missiles of countries that do not yet have long-­range systems, but at the same time ridicule the need to act against a threat that almost all reputable scientists say is real. In his book The One Percent Doctrine, Ron Suskind tells the tale of Vice President ­Cheney’s being willing to wage a fierce (and counterproductive, the way he waged it) war against Iraq and terrorism if there were just a 1 percent possibility of a terrorist nuclear weapon going off in the United States, perhaps destroying New York, on some unknown day in the future. “The United States must act now as if it were a certainty.” Well, there is a far greater risk than 1 percent of destruction occurring in all of our coastal cities over the lifetime of children alive today, not because of an enemy, but because of our own and other nations ignoring climate change.

Chapter 8: Into Cyberspace

…Cyberwarfare has thus far apparently been limited to simple hacking. When China and Taiwan have a spat, there is often a fair amount of defacing of web sites (replacing what should be on the web page with something less flattering) and denial-­of-­service attacks (the floods of messages that overwhelm servers and knock sites offline). In 2007 the problems of tiny Estonia seemed to be a possible case of low-­level cyberwar. The Estonians had had the temerity to move a giant statue put up during the Cold War by the Soviet Red Army to honor itself. Known in Tallinn as “the only Russian solider who did not rape in 1945,” it was seen by Estonians, not as a symbol of their 1945 liberation, but as a testament to their 1945–1990 oppression and occupation. When it was moved, ­Estonia’s networks and web sites were assaulted with defacements and denial-­of-­service attacks that went on for weeks. The attacks were easily traceable to Russia, where the government said it must be private citizens doing it and added that it was incapable of doing anything to stop them. (Oh, so limited are the enforcement capabilities of the ­KGB’s successors under Putin.)

Cyberwarfare, however, may be grander stuff than what we saw going on in Estonia and Taiwan. A possible window into the potential of cyberwarfare may have been opened when Israel flew F-16s and F-15s into Syria in 2007. News reports indicate that ­Syria’s expensive Russian radar and apparently never saw the attack. Aviation Week magazine suggested that a cyberwarfare capability similar to a U.S. program known as Suter could have allowed the attackers to take over the ­defense’s radar screens and eliminate any indications of the attacking aircraft. It could be similar to the scene in the movie Ocean’s 11 where the hacker replaces a video feed of a vault looking nice and safe while the vault is actually in the hands of the gang.

Around the same time as the Israeli attack on Syria, USA Today and CNN reported that U.S. government researchers had experimented with a way of damaging electric power generators by hacking from the internet into the internal network running the Supervisory Control and Data Acquisition (SCADA) software that controls the generator. Spin a big electric power generator at the wrong speed, and it can go crashing off its moorings and break apart.39 Theoretically, one could also try the Ocean’s 11 technique on a section of a power grid. If you could get into the ­grid’s SCADA system, you could perhaps send instructions to transformers and switches that would trigger a blackout, while all the while the control ­room’s dials would show that things were normal. But how could you get into such a network? I am tempted to say let me count the ways, but I will merely note that some power grids actually send SCADA commands via radio. Almost no utility companies use encryption or authentication on their networks, so that if you can get in, you can issue instructions. Guides to the software used on SCADA systems are not hard to get. A handful of SCADA software systems are used around the world.

In January 2008 we saw the first hints that this threat had gone from theory to reality. A CIA spokesman told an audience at a summit on SCADA security that a series of attacks had occurred against foreign utilities involving intrusions through the internet, followed by extortion demands. The CIA spokesperson said that “in at least one case, the disruption caused a power outage affecting multiple cities. We do not know who executed these attacks or why, but all involved intrusions through the internet.”

….Although the extent of the problem of reliance upon insecure computer systems is beginning to be understood broadly, government has yet to act decisively to address it. The National Strategy to Secure Cyberspace, signed by the President in 2003, sat gathering dust, unimplemented for four years. The public-­private partnership that created the strategy withered, largely because the private sector lost faith in its partner because of the government’s inaction.

Then as 2007 wore on, stories leaked that an intrusion into the network in Secretary of Defense Robert ­Gates’s own office had been traced back to China. German Chancellor Angela ­Merkel’s office reported her system had also been hacked by a Chinese entity. British authorities were also tracking Chinese hacking, prompting MI5 (the British Security Service) to send an advisory to the top three hundred British corporations telling them that in all probability their networks were already penetrated by China. The warning did not suggest that it was Chinese individuals, but rather the Chinese government, saying it was an “electronic attack sponsored by Chinese state organizations . . .  designed to defeat best-­practice IT security systems.”

Private-­sector IT security experts were finding evidence of Chinese hacks everywhere, including an ingenious Trojan-­horse program embedded in digital picture frames sold at electronics stores across America, such as BestBuy. When you connected the digital picture frame to your computer to download your photos, the picture frame uploaded a program into your computer that disabled anti­virus programs, found all of your passwords, and sent them to China. The picture frame was, of course, made in China. The results of the investigation of the hacking into the Pentagon reportedly led Admiral Mike McConnell, the second person in the job of Director of National Intelligence, to hit the alarm bell. Rumors spread that China was well inside sensitive and classified U.S. networks, casting doubt on the Pentagon’s current and future plans based on “net centric warfare.” According to one U.S. Air Force officer, the new “Byzantine series (of attacks) tracks back to China.”

Chapter 9: Getting it Right

It’s a neighborhood with Tiffany, Hermès, and Gucci boutiques among hundreds of other stores in several sprawling shopping malls. It is also a neighborhood filled with the offices of firms with large contracts with the national security agencies and departments. Tysons Corner was the ­nation’s first “edge city,” according to Joel Garreau’s seminal work on self-­sufficient minicities in suburbia. It is a place where one can live in a high-­rise condo or town house, shop or dine in one of hundreds of choices, exercise in a variety of gyms and health clubs, watch a newly released movie in a multiplex, and work in a high-­rise for any one of scores of outsourcing firms. If you live there, you never have to leave. It is, of course, slightly unreal, detached from the nearby ­nation’s capital, indeed from the lives of most Americans. After 9/11, a huge new office building started to go up on one of the few underdeveloped streets in the edge city. Oddly, there was no sign saying what company the new complex would house.

When the outer structure of the building was complete, designers from the Walt Disney Company arrived. Disney has a large store less than a mile away (I know because I have stood in line there buying presents for a three-­year-­old). But these designers were not there to create a place for Princess Bride birthday parties; they had come to help build a counterterrorism command center. Jumbotrons now hang above a broad expanse with scores of workstations. It has a Hollywood feel, looking like the set for the command center in movies like Dr. Strangelove and War Games. It is also reminiscent of the network operations center for a major telephone company I visited in New Jersey. There a corporate Vice President had been candid enough to admit to me, “We spent a boatload making this place look like ­NASA’s Mission Control, but ­it’s just to wow the customers. It could all be done from a normal office with cubicles.” Counterterrorism could all be done from a normal office, too, but the Disney-­designed command room is meant to impress members of Congress and the media that the new National Counterterrorism Center (NCTC) is cutting edge. It is also extremely popular with NCTC staff and their guests when they use the Jumbotrons to watch the Super Bowl. In case the command center did not impart its mission statement sufficiently, NCTC renamed the street outside Liberty Crossing.

The hundreds of people working for NCTC come in two flavors: first, government employees, mainly on loan from the CIA and FBI, and second, the equally numerous private contractors. “The only way you can tell the difference is the color of their badge,” one person who frequented Liberty Crossing explained. (Every person in the center is required to have a plastic identification tag hanging around his or her neck or pinned onto his or her lapel.) Much of what the NCTC staff does all day is to talk with people at other terrorism centers around Washington, the largest of which is the ­CIA’s Counterterrorism Center (CTC) about a mile away at CIA headquarters. Probably next in size is the ­FBI’s counterterrorism center in the J. Edgar Hoover Building near the White House. These are not to be confused with the Terrorist Screening Center, for which the FBI is the executive agent, which is housed in a nondescript office tower near National Airport. Nor should one overlook the Foreign Terrorist Asset Tracking Center, which is run by the Treasury Department, or the new Intelligence Fusion Centers for counterterrorism in every state capitol, or the Joint Terrorism Task Forces now in one hundred cities, or…

Next to the large NCTC complex, another huge edifice is rising at Liberty Crossing. This one is to house the staff of the burgeoning Office of the Director of National Intelligence and the many contract employees supporting it. Reflecting the suburban sprawl that has defaced northern Virginia outside Washington, the FBI is moving some things a little farther out, to Prince William County, where a building, “nicknamed ‘the Taj Mahal’ by some FBI officials, will feature highly finished terrazzo floors at the entrance, a soaring atrium and a giant fingerprint etched into the elevator doors. The Bureau plans to bring new counter terrorism squads to the new Prince William office and to open a language translation unit there, to help with the chronic problem of attracting Arabic speakers.” No doubt the terrazzo floors and the access to more distant shopping malls will help the FBI overcome its chronic inability to recruit or maintain employees with the needed linguistic capabilities.

Nearby is the first of several buildings in another CIA campus, curiously, called the Discovery Center. The building serves as an “intake center” for polygraphing, interviewing, and assigning the many new CIA employees needed to obtain the goal of doubling the staff of the Agency. Prospective employees sit awaiting their turn to have their bodies strapped to a machine whose results are not admissable in any federal court. If they were applying for a private sector job, the law in most states would prohibit an employer from screening prospective employees with a polygraph, but this is the CIA, which believes in the disproven flutter box. So they sit, perhaps in the nice new Starbucks in the center or in the lounge where all of the new flat-­screen televisions are set to FOX News.

I know that good work is done at the National Counterterrorism Center, but I also know how to run counterterrorism operations and they do not require Jumbotrons or the very nice color calendar one can download from ­NCTC’s web page, which notes for each day of the year what famous terrorist-­related events took place on that day in history. “The NCTC for Kids” web page has a nice Disney quality, with a cartoon eagle and a cartoon Lady Liberty, but the command center, calendar, and cartoon characters all bespeak a larger issue: bloat.