Former NSA Head Michael Hayden: The Agency “Cannot Survive Without Being More Transparent”

Image

Former National Security Agency and CIA Director Michael Hayden earlier this year | Reuters/Larry Downing

Do Americans have a right to privacy? At what point does national security take precedence over that right? Intelligence expert Amy Zegart discussed those issues and more with Michael Hayden, the former head of the National Security Agency. Hayden served as NSA director from 1999 to 2005, and was also CIA director for three years. Zegart is codirector of Stanford’s Center for International Security and Cooperation, a senior fellow at the Hoover Institution, and professor of political economy at Stanford Graduate School of Business (by courtesy), where she coteaches a course on political risk management with former U.S. Secretary of State Condoleezza Rice. The following are edited excerpts from their conversation:

I want to start by setting some facts on the ground. There has been a lot of confusion about the different surveillance programs that Ed Snowden has revealed in the past year — in particular, the distinction between the Telephone Metadata Program, which policy wonks know under Section 215, and the Internet Communications Program under Section 702. Can you lay out for us, in layman’s terms, what these programs do?

The 215 program has to do with telephone metadata. So it’s not email traffic; it’s voice. And it’s not content, it’s fact of. What the agency gathers is who called whom, when, for how long. It’s also within the technical definition of metadata to include locational data. But this program doesn’t. It’s consciously excluded. What you’ve got is a record of all phone calls made within the United States or between the United States and overseas that’s given to the National Security Agency on a daily basis by the telecom providers.

It’s not technically electronic surveillance. These are actually business records kept by the phone company in order to charge you for your phone usage. That data is then bent toward the National Security Agency, where it’s stored.

A key point about this is that it is unarguably domestic. It’s your stuff. It’s my stuff. And it’s put into this large database. Now, that in itself causes a lot of people concern because even with good intent, there’s some nervousness about the government having that kind of information.

The NSA view is that, although that is kind of theoretically frightening, as a practical matter, one has to look at what happens to that data in order to make a coherent judgment about it.

That data is locked and inaccessible at NSA except under a very narrow set of circumstances. Number one, the number of people who are allowed to access that data is about two dozen. Actually, the right number is 22. And the way you access the data is through a number, almost always foreign, about which you have a reasonable, articulable suspicion that the foreign number is affiliated with terrorist groups.

A specific example — so you raid a safe house in Yemen. And you go in with your Yemeni allies and you grab some people. And you grab what’s called pocket litter, which is identifiable stuff inside their pockets.

It confirms that, yeah, these guys are who we thought they were. They’re affiliated with AQAP — Al-Qaida in the Arabian Peninsula — or some other group. And you discover a cellphone that you’ve never seen before. Now you have a reasonable, articulable suspicion that that cellphone is, in fact, affiliated with a terrorist.

What you then get to do — and I’m going to be a little cartoonish, here, but it’s kind of how it works. What you then get to do is walk up to that database, kind of yell through the transom, and say, “Hey, anybody in here talk to this phone?” And then if a number in the Bronx raises its hand and says, “Yeah, I do every Thursday,” NSA gets to say to the number in the Bronx, “Well, then who do you talk to?”

That’s the program. There’s no mining of the data, and there’s no pattern development, no pattern recognition. It is: Did any of those phone events that were captured there relate to a phone that we have reason to believe is affiliated with al-Qaida?

The last year I’ve seen statistics is 2012. And that “Hey, anybody in here talk to this phone?” happened 228 times. Fundamentally, it’s designed to see if there are any terrorists inside the walls — terrorists inside the gate.

Section 702 is different; 702 is about content, and it’s about emails. And it’s about emails that are residing in the United States that are on servers inside the United States. But this is foreign intelligence.

And so, we’re aware of a certain terrorist. We know that this terrorist uses two or three Gmail or Hotmail or Yahoo or AOL accounts. Under broad court guidance, NSA gets to go to the Internet service providers and say, “I want everything in this account that meets the standard the judge has given me that is outside the United States. And it is someone affiliated with terrorism, proliferation, or cyberattack.”

The only thing American about that Gmail correspondence is it’s sitting on a server here in the United States. Section 702, then, allows the agency, under those circumstances, to go get that information.

Let’s talk a little more about 215, the Telephone Metadata Program. Members of the intelligence community have been talking a lot in public about the fact that this program does not include the content of your phone calls. And the American people overwhelmingly do not believe you. Why not?

Have any of you ever made your phone bill talk? This is not electronic collection. These are billing records from the company. To listen to the content of those calls would not just violate the laws of the United States, that would violate the laws of physics.

There is no content. It isn’t electronic surveillance. Now, look, at the end of all this, you may go, “I got it, Hayden. Nice try. I still don’t want the government to have that kind of data.” That’s a fair position. That’s something we can have an honest discussion about.

Is there a constitutional right to privacy? And if there is, how do you define it?

Absolutely. I’ve had this discussion before. I was up in British Columbia about two years ago in a pretty sporting debate. And I said, “Privacy is the line we continuously negotiate for ourselves as unique creatures of God and as social animals.”

There are some things that the community has a right to know, and there are other things that the community does not have a right to know. And the whole debate about privacy is where is that line between the duality of my nature — my uniqueness as a creature, and some things are mine and only mine, and other things that I owe to the collective because I have to live with other people.

That’s what this is. Where that line is, is subject to great debate. Where that line is, is not a theoretical construct and abstractly arrived at. Where that line is actually depends upon the totality of circumstances in which we find ourselves.

Right after 9/11, I did some things at NSA that were fully within my authorities. And I told both congressional committees, and we told the White House. But I did them. I wasn’t saying, “May I do this?” I did it because my belief was that the correct judgment with regard to the totality of circumstances we found ourselves in — well, that was different on the afternoon of September 11th than it was on the evening of September 10th.

Since the Snowden revelations, the U.S. intelligence community has talked about these programs being necessary for counterterrorism. And yet, the president’s own review board and then the civilian oversight board did detailed examinations of the Telephone Metadata Program and decided that the country would not suffer terribly if that program were ended. Did the NSA misjudge the value of its own program?

I don’t think so. But, remember the totality of circumstances? And circumstances change. I’m going to reason by analogy here. When I became director of the CIA, I had my own issues over there with detentions and interrogations.

We decided to take the techniques we had used, which have been called enhanced interrogation techniques, and reduce them from 13 to six. Now, is that a judgment by me on [former CIA director] George Tenet? Is that my saying, “George, you got that wrong. You overreacted. You shouldn’t have used those other seven techniques”?

No. I was in different circumstances than George Tenet was in. I had more human penetrations of al-Qaida. I knew more about their plans. I knew more about their capabilities. And therefore, back to the totality of circumstances — what’s reasonable and unreasonable, what’s proportional to the threat? I felt, operationally, I no longer had the compellence that George had immediately after 9/11.

Where are you going to draw the line? It’s based upon the totality of circumstances.

When the president makes his speech in January, after Snowden comes out, he tells us it’s a really dangerous world, and we really need intelligence. And it is a stunning endorsement of the American intelligence community.

Then he says, “Because you’re uncomfortable, this stuff here that is legal and is kind of working, and I thought was essential, we’re going to change some of that stuff now.”

He did not claim that these were ineffective. He did not say they were unlawful. He just said, “You’re uncomfortable, so we’re going to make some changes.” And that’s really the fundamental issue here. I’m good with that, trust me.

We just need to go out for the coin toss. And this box that I was operating in, you’re saying, “I’m uncomfortable. I want the box to be about that size.” As long as you understand that that smaller box, in my professional judgment, would make NSA’s job harder and therefore probably make you less safe — as long as you understand that, we got it. That’s what we’ll go do.

How bad is the damage from Snowden’s revelations?

It’s the greatest hemorrhaging of legitimate American secrets in the history of the Republic, and was tremendously damaging on multiple levels. First of all, most of the stuff he revealed had nothing to do with your privacy or mine. The overwhelming majority of the information that he revealed was how your government collects foreign intelligence to keep you safe.

A couple specific examples — so he’s in Hong Kong, trying to get out of the city. And he tells the South China Morning Post that the National Security Agency is breaking into computers in the People’s Republic of China.

And then while he’s still in Hong Kong, trying to get out of there, Glenn Greenwald, who has been given these documents by Snowden, publishes a story in the London Guardian that the station at Menwith Hill, up north of London, had used its antennas there to collect the satellite phone of Dmitry Medvedev during a G-20 meeting in Great Britain.

That has nothing to do with civil liberties. The vast majority of what he released is about legitimate foreign intelligence collection. And that makes your security services jobs more difficult.

Second damage was in American foreign relations. The issue with foreign nations is simply this: Why would we work with you people? You can’t keep anything secret.

The third impact has been on American industry, which has been punished for doing things exactly like what British Telecom or Deutsche Telekom does for their government.

There are two issues that have, perhaps, most angered executives. One is the damage to their business overseas, because they’re perceived as an arm of the U.S. government when they’re not. But the second is revelations that the agency had been going through the back door to collect data from data centers of these different companies when they could have gone through the front door. What can the U.S. government do today to begin to repair that breach of distrust? They are not over it.

No. And they shouldn’t be over it, because it’s done great harm. And I get it. We talked a little bit before we came in here about what Google and Apple were doing with regard to unbreakable encryption, right? The FBI is not going to be able to read Tony Soprano’s cellphone unless they go to Tony and ask him for the key. And that’s essentially what they’re going to do.

Do I object to that as an intelligence professional? Yes. Do I understand that based upon Google and Apple’s business model? Absolutely. So, let’s unpack some of the things you brought up, about you guys are just like the Chinese. Actually, we’re not. We’re actually much better than they are.

We self-limit. I freely admit NSA steals stuff. And we’re really good at it. And we’re better than the Chinese. But we steal stuff to keep you free and keep you safe. We do not steal stuff to make you rich. And there are four other countries I know of in the world who could say those last two sentences and have them be true.

NSA used to stand for No Such Agency. It was so secret that its existence wasn’t even acknowledged. Yet, now, we all know we live in a digital environment where it’s very hard for our private lives to stay private. Can the NSA operate in this kind of environment without being more proactive about educating the American people and justifying its mission?

No, it cannot survive without being more transparent. We have to give the American people enough information to be at least tolerant, if not supportive, of what the government does to keep them safe.

Now, the trick is, how do you do that? I was up in Aspen for a security conference, and we were talking about the need for transparency, which is kind of the buzzword here. And Mike Leiter, who used to head up the National Counterterrorism Center, said, “Mike, not transparency. We need to be translucent.”

And that actually is really good. Translucent, you can see through the thick glass. You get the broad outline of the shapes. You get the broad patterns of movements. But you don’t get the fine print. And it’s the fine print, when it goes public, that kills us.

Help us understand where you were on 9/11, what it was like to be in your position on 9/11, and how those events have shaped your decisions and your life.

At 7 a.m. on the 11th, I had a haircut. At 7:30, I walked past the National Security Operations Center. It’s my command post. Got my morning briefing. Not a word about a threat to the country.

Went to my office. At 8:15, I had a meeting with my new chief of EEO — Equal Employment Opportunity. About 9, my new IG [Inspector General] came in. A few minutes into that meeting, my executive assistant, Cindy Farkus, came in and said, “A plane hit the World Trade Center.”

I wondered what kind of plane, how big a plane. Probably a sport plane. You’ve seen those helicopters over Manhattan. And then she came in about 10 minutes later and said, “A plane hit the other tower.” And I just turned to her and said, “Get the chief of security up here right now.”

Dismissed the IG. A few minutes pass. The chief of security was coming in one door of my office. Cindy came in the other and said, “There are reports of explosions on the Mall.” That’s the Mall in D.C. That’s a garble of the plane hitting the Pentagon.

My poor security chief, Kemp Ensor, didn’t have a chance to say anything. I said, “Kemp, all nonessential personnel out of here now.” So we’ve got something called Giant Voice — big announcement. All nonessential personnel leave.

If you’ve seen those scary pictures in the Will Smith movie Enemy of the State about the NSA, we’ve got two high-rise buildings. That’s where I was. For reasons that should be clear, I said, “Everybody who can get out of the high rises, get out of the high rises.”

And there’s a three-story ops building, which is the original building, which is where my command post is. And so we decamped down there and moved as many people as we could to the NSOC, where I got all the comms in the world.

George called me about 11, 11:30 — George Tenet, the director of Central Intelligence, and said, “What do you got?” I said, “Al-Qaida.” We could already hear celebratory gunfire in their communications. They were congratulating one another.

Early September gets dark about 7:30, a quarter of 8 in eastern Maryland. Someone recommended I go talk to our counterterrorism folks. NSA at Fort Meade is not just the agency’s headquarters; it’s the agency’s biggest field station. It does mission there. And so the counterterrorism shop, there are people in front of a workstation with headsets on.

So I went up, and they were in the high rises. But we couldn’t move them. You move them, you interrupt mission. And the nation’s under attack, for God’s sake. And so I walked in, and the first thing I saw, because the sky is darkening, is people from our logistics force tacking up blackout curtains on their windows, because we can’t move them.

And I had the thought, “That’s really something. We are tacking up blackout curtains in eastern Maryland in the 21st century. Things are going to be different.” And I walked around and talked to the folks — most of them Arabs, most of them Arab Americans, [who could speak] languages for counterterrorism.

And so they were, I think, bearing a whole bunch of burdens, not just the ones you and I had. But they had a mission burden, and maybe even a bit of identity questions going on. So I didn’t say anything, didn’t interrupt. Hand on shoulder. Keep it up. Thank you for your work. Thank you for being here. And I went.

About a year after 9/11, something called the Joint Inquiry commission — it was a combined House and Senate intelligence committee — had these open hearings — and closed — on looking at the causes of the 9/11 attack. The subtext was, how did you guys let this happen?

The conclusions of that commission were that NSA prior to 9/11 was far too timid and far too cautious with the one kind of terrorist communications that was most essential to defending the United States — terrorist communications, one end of which was in America.

What we were told was to open our aperture, open our operational art to be more capable of getting that kind of communication. And the terrorist surveillance program, Stellar Wind, as we called it, the 215 program — those were all the products of that requirement. And that was the lightest touch we could devise on American privacy in order to give us a reasonable chance of detecting that kind of communication.