Dark Territory (31 page)

That same day, as if to seal the case, the Obama administration published a twenty-three-page “white paper,” outlining the legal rationale for the bulk collection of metadata from Americans' telephone calls, and the NSA issued its own seven-page memorandum, explaining the program's purpose and constraints.

Already, by this time, Obama, White House chief of staff Denis McDonough, and Susan Rice, his first-term U.N. ambassador who'd recently replaced Tom Donilon as national security adviser, had mulled over possible candidates for the outside group of experts. A few days before the press conference, they chose five, asked them to serve, and, upon getting their consent, ordered the FBI to expedite security-clearance reviews for each.

It wasn't entirely an outside, or independent, group. All five were old friends or former aides of President Obama. Still, it was a more disparate and intriguing bunch than his press conference led many skeptics to expect.

Michael Morell was the establishment pick, a thirty-three-year veteran of the CIA, who had just retired two months earlier as the agency's deputy director and who'd been the main point of
contact between Langley and the White House during the secret raid on Osama bin Laden's lair in Pakistan. Morell's presence on the panel would go some distance toward placating the intelligence community.

Two of the choices were colleagues of Obama from his days, in the 1990s, teaching at the University of Chicago Law School. One of them, Cass Sunstein, had also worked on his presidential campaign, served for three years as the chief administrator of his regulatory office, and was married to Samantha Power, his long-standing foreign policy aide, who had recently replaced Susan Rice as U.N. ambassador. An unconventional thinker on issues ranging from the First Amendment to animal rights,
Sunstein had written an academic paper in 2008, proposing that government agencies infiltrate the social networks of extremist groups and post messages to undermine their conspiracy theories; some critics of Obama's panel took this paper as a sign that Sunstein was well disposed to NSA domestic surveillance.

The other Chicagoan, Geoffrey Stone, had been dean of the law school when Obama taught there. A prominent member of the ACLU's national advisory council and the author of highly lauded books on the First Amendment in wartime and on excessive secrecy in the national security establishment, Stone seemed a likely critic of NSA abuses.

Peter Swire, a professor of law at the Georgia Institute of Technology, was a longtime proponent of privacy on the Internet and author of a landmark essay on surveillance law. As the White House counsel on privacy during Bill Clinton's presidency, Swire played a key role in the debate over the Clipper Chip, arguing against the NSA's attempt—which he, correctly, saw as futile—to put a clamp on commercial encryption. A couple years later, also on privacy grounds, he argued against Richard Clarke's ill-fated plan to put critical-infrastructure industries on a separate Internet and to wire
them so that, in the event of a security breach, the FBI would be directly alerted.

For that reason, Swire was nervous to learn that the fifth member of the Review Group would be Richard Clarke himself. The former White House official who'd immersed himself in NSA practices, written presidential directives on cyber security, and built a reputation as relentless in promoting his own views and in quashing those of others, Clarke was seen as a wild card generally.

Still the consummate operator, Clarke had made a huge splash since quitting the Bush White House on the eve of the Iraq War. One year after the invasion, he gained unlikely fame as an American folk hero at the 9/11 Commission's nationally televised hearings, prefacing his testimony with an apology.
“To the loved ones of the victims of 9/11, to them who are here in this room, to those who are watching on television,” he began, “your government failed you. Those entrusted with protecting you failed you. And I failed you. We tried hard, but that doesn't matter because we failed. And for that failure, I would ask, once all the facts are out, for your understanding and for your forgiveness.”

It seemed to be a genuine plea of contrition—enhanced by the fact that no other Bush official, past or present, had apologized for anything—and the hearing room erupted with applause. After his testimony, family members of victims lined up to thank him, shake his hand, and hug him.

Clarke's critics, whose numbers were legion, scoffed that he was just drumming up publicity. His new book,
Against All Enemies: Inside America's War on Terror
, had hit the bins the previous Friday, trumpeted by
a segment on CBS TV's
60 Minutes
the Sunday night between the release date and the hearing. When it soared to the top of the best-seller charts, critics challenged his claims that, in the months leading up to 9/11, Bush's top officials ignored warnings (including Clarke's) of an impending al Qaeda
attack and that, the day after the Twin Towers fell, Bush himself pressed Clarke to find evidence pinning the blame on Saddam Hussein to justify the coming war on Iraq. But Clarke, always a scrappy bureaucratic fighter, would never have opened himself to such easy pummeling; he knew the documents would back him up, and, as they trickled to the light of day, they did.

All along, though, Clarke retained his passion for cyber issues, and six years later, he wrote a book called
Cyber War: The Next Threat to National Security and What to Do About It
.
Published in April 2010, it was derided by many as overwrought—legitimately in some particulars (he imputed cyber attacks as the possible cause of a few major power outages that had been convincingly diagnosed as freak accidents or maintenance mishaps), but unfairly in the broad scheme of things. Some critics, especially those who knew the author, viewed the book as simply self-aggrandizing: Clarke was now chairman of a cyber-risk-management firm called Good Harbor; thus, they saw
Cyber War
as a propaganda pamphlet to drum up business.

But the main reason for the dismissive response was that the book's scenarios and warnings seemed so unlikely, so sci-fi. The opening of a (generally favorable) review in
The Washington Post
caricatured the skepticism:
“Cyber-war, cyber-this, cyber-that: What is it about the word that makes the eyes roll? . . . How authentic can a war be when things don't blow up?”

It had been more than forty years since Willis Ware's paper on the vulnerability of computer networks, nearly thirty years since Ronald Reagan's NSDD-145, and more than a decade since Eligible Receiver, the Marsh Report, Solar Sunrise, and Moonlight Maze—touchstone events in the lives of those immersed in cyberspace, but forgotten, if ever known, to almost everyone else. Even the Aurora Generator Test, just six years earlier, and the offensive cyber operations in Syria, Estonia, South Ossetia, and Iraq—which had taken place more recently still—made little dent on the public consciousness.

Not until a few years
after
Clarke's book—with the revelations about Stuxnet, the Mandiant report on China's Unit 61398, and finally Edward Snowden's massive leak of NSA documents—did cyber espionage and cyber war become the stuff of headline news and everyday conversation. Cyber was suddenly riding high, and when Obama responded to the ruckus by forming a presidential commission, it was only natural that Clarke, the avatar of cyber fright, would be among its appointees.

On August 27, the five panelists—christened, that same day, as the President's Review Group on Intelligence and Communications Technologies—met in the White House Situation Room with the president, Susan Rice, and the heads of the intelligence agencies. The session was brief. Obama gave the group's members the deadline for their report—December 15—and assured them that they'd have access to everything they wanted. Three of the panelists were lawyers, so he made it clear that he did not want a legal analysis. Assume that we
can
do this sort of surveillance on legal grounds, he said; your job is to tell me if we
should
be doing it as policy and, if we shouldn't, to come up with something better.

Obama added that he was inclined to follow whatever suggestions they offered, with one caveat: he would not accept any proposal that might impede his ability to stop a terrorist attack.

Through the next four months, the group would meet at least two days a week, sometimes as many as four, often for twelve hours a day or longer, interviewing officials, attending briefings, examining documents, and discussing the implications.

On the first day, shortly before their session with the president, the five met one another, some of them for the first time, in a suite of offices that had been leased for their use. The initial plan had been for them to work inside the national intelligence director's
headquarters in Tysons Corner, Virginia, just off the Beltway, ten miles from downtown Washington. But Clarke suggested that they use a more nearby SCIF—a “sensitive compartmented information facility,” professionally guarded and structurally shielded to block intruders, electronic and otherwise, from stealing documents or eavesdropping on conversations. Clarke pointed, in particular, to a SCIF on K Street: it would keep the panelists just a few blocks from the White House, and it would preserve their independence, physically and otherwise, from the intelligence community. But Clarke's real motive, which his colleagues realized later, was that this SCIF was located across the street from his consulting firm's office; he preferred not to drive out to the suburbs every day amid the thick rush-hour traffic.

Inside the SCIF that first day, they also met the nine intelligence officers, on loan from various agencies, who would serve as the group's staff. The staffers, one of them explained, would do the administrative work, set the group's appointments, organize its notes, and, at the end, under the group's direction of course, write the report.

The Review Group members looked at one another and smiled; a few laughed. Four of them—Clarke, Stone, Sunstein, and Swire—had written, among them, nearly sixty books, and they had every intention of writing this one, too. This was not going to be the usual presidential commission.

The next morning, they were driven to Fort Meade. Only Clarke and Morell had ever before been inside the place. Clarke's view of the agency was more skeptical than some assumed.
In
Cyber War
, he'd criticized the fusion of NSA and Cyber Command under a single four-star general, fearing that the move placed too much power in one person's hands and too much emphasis on cyber offensive operations, at the expense of cyber security for critical infrastructure.

Swire, the Internet privacy scholar, had dealt with NSA officers
during the Clipper Chip debate, and he remembered them as smart and professional, but that was fifteen years ago; he didn't know what to expect now. From his study of the FISA Court, he knew about the rulings that let the NSA invoke its foreign intelligence authorities to monitor domestic phone calls; but Edward Snowden's documents, suggesting that the agency was using its powers as an excuse to collect
all
calls, startled him. If this was true, it was way out of line. He was curious to hear the NSA's response.

Stone, the constitutional lawyer and the one member of the group who'd never had contact with the intelligence world, expected to find an agency gone rogue.
Stone was no admirer of Snowden: he valued certain whistleblowers who selectively leaked secret information in the interest of the public good; but Snowden's wholesale pilfering of so many documents, of such a highly classified nature, struck him as untenable. Maybe Snowden was right and the government was wrong—he didn't know—but he thought no national security apparatus could function if some junior employee decided which secrets to preserve and which to let fly. Still, the secrets that had come out so far, revealing the vast extent of domestic surveillance, appalled him. Stone had written a prize-winning book about the U.S. government's tendency, throughout history, to overreact in the face of national security threats—from the Sedition Act to the McCarthy era to the surveillance of activists against the Vietnam War—and some of Snowden's documents suggested that the reaction to 9/11 might be another case in point. Stone was already mulling ways to tighten checks and balances.

Upon arrival at Fort Meade, they were taken to a conference room and greeted by a half dozen top NSA officials, including General Alexander and his deputy, John C. “Chris” Inglis. A former Air Force pilot with graduate degrees in computer science, Inglis had spent his entire adult life in the agency, both in its defensive annex and in SIGINT operations; and he'd been among the few dozen
bright young men that Ken Minihan and Mike Hayden promoted ahead of schedule as part of the agency's post–Cold War reforms.

After some opening remarks, Alexander made his exit, returning periodically through the day, leaving Inglis in charge. Over the next five hours, Inglis and the other officials gave rotating briefings on the controversial surveillance programs, delving deeply into the details.

The most controversial program was the bulk collection of telephone metadata, as authorized by Section 215 of the Patriot Act. According to the Snowden documents, this allowed the NSA to collect and store the records of
all
phone calls inside the United States—not the contents of those calls, but the phone numbers of those talking, as well as the dates, times, and durations of the conversations, which could reveal quite a lot of information on their own.

Inglis told the group that, in fact, this was not how the program really operated. In the FISA Court's ruling on Section 215, the NSA could delve into this metadata, looking for connections among various phone numbers,
only
for the purpose of finding associates of three specific foreign terrorist organizations, including al Qaeda.

Clarke interrupted him. You've gone to all the trouble of setting up this program, he said, and you're looking for connections to
just three organizations
?