How synced can (and should) NSA and CIA be on cyber?

NSA and the CIA have revamped themselves in the past year. FCW asked officials how well Fort Meade and Langley are collaborating in cyberspace in pursuit of their separate missions.

world map

In the past year, the United States' two best-known intelligence agencies have undertaken ambitious reorganizations to better adapt to a hyper-digitized world.

The National Security Agency further integrated its Signals Intelligence and Information Assurance directorates while also establishing several new directorates covering research and acquisition, among other activities. The CIA created the Directorate for Digital Innovation (DDI) -- its first new directorate in over half a century -- to handle cyber operations and the agency's IT enterprise, among other tasks.

With those reorganizations still taking effect, FCW asked former CIA and NSA officials how the agencies should collaborate in cyberspace in pursuit of their missions.

David Shedd, a former CIA official who also served as acting director of the Defense Intelligence Agency, said he would like to see the CIA, NSA and other intelligence agencies more closely coordinate their work in cyberspace.

For Shedd, that means integrating NSA's Threat Operations Center, which detects and helps mitigate cyberthreats, with CIA cyber operations, which are now handled by DDI.

"I just see the problem being so enormously big for our nation, that the more collaboration, the more integration that you can get," the better, he told FCW, while stressing that specific mission requirements should not get lost in that consolidation.

However, retired Gen. Michael Hayden, former director of the CIA and NSA, said it is better to keep the two agencies' main cyber organizations at arm's length from each other. Drawing an analogy with traditional airspace, Hayden said NSA was the equivalent of the Air Force and the CIA's Information Operations Center (the cyber center that preceded DDI) was akin to Marine Corps aviation. In other words, they have distinct roles that should not be blended too much.

CIA Director John Brennan said recently that in establishing DDI, the CIA was not trying to replicate what NSA does.

"We do a lot of partnering with NSA, and we have benchmarked against them and FBI and others," Brennan said July 13 at the Brookings Institution. "And there are a fair amount of groups that are multi-agency in terms of their efforts. So as we grow, we need to take a fresh look at how the government cyber and digital-related entities are interoperating with one other."

Cultural differences pose challenges

President George W. Bush established the National Counterterrorism Center in 2004 to knock down the walls to intelligence sharing that the 2001 terrorist attacks made evident. In a similar vein, President Barack Obama ordered the creation of the Cyber Threat Intelligence Integration Center in February 2015 to connect the dots on cyberthreat intelligence.

CTIIC comprises specialists from NSA, the CIA, the FBI and other intelligence agencies. The center has a limit of 50 employees (NCTC is many times larger), and Director Tonya Ugoretz said in a recent interview that there are no plans to expand.

Shedd said he would like to see a much larger multi-agency cyber center that is commensurate with the threat. "I would argue that you would be better off before a big [cyber]attack comes to plan around an NCTC model," he said.

Absent an expansion of CTIIC, there are other avenues for the CIA and NSA to collaborate in cyberspace.

Chris Inglis, a former deputy director at NSA, said the CIA is now sending more of its employees to NSA to better understand how it approaches cyberspace. "That's a good thing," he said. "That creates familiarity; that creates an interaction and a mutual dependence that is needed."

"I think between [NSA Director Adm. Michael] Rogers and Brennan, there's a much stronger agreement to collaborate," Inglis added.

But cultural differences between the agencies might limit how much they can collaborate on some operations, he said. NSA officials often think about the trade-offs of deploying, say, a software exploit, while CIA officials' overriding concern might be the physical safety of operatives in the field.

"So that drives a different response in terms of the degree of the willingness to share," Inglis said. "I think culturally it's difficult to get over…. You'll never have them completely simpatico."

Although NSA's cyber capabilities get more attention, both Inglis and Hayden said the CIA has plenty of expertise, too, and the agency is more than capable of contributing to joint missions.

"I don't think they are that dramatic," Hayden said of the differences in the skills of the two agencies' cyber specialists. "What's dramatically different is the scale of resources that NSA puts into this kind of effort as opposed to what CIA puts into it."

Given the shifting digital landscape in which the two spy agencies operate, the CIA's and NSA's reorganizations could be anything but final. The transience of software and other IT building blocks suggests updates will be constantly needed.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.