Overload

Information overload is an established phenomenon in the intelligence trade. You can never know too much? You can listen in on way too much, and understand far too little. Former spy chief Gen. Michael Hayden (director of both NSA and CIA) once remarked that his analysts actually managed to process something like three to five per cent of intercepted traffic, if that. This in the wake of the surveillance scandals, his point being that your eyes - or ears - are bigger than your stomach. One recent estimate is that NSA collects 1.7 billion communications a day. The volume is paralyzing. You can't get a grip on it.

I ran across a quote from a guy named Herbert Simon. "What information consumes is obvious: it consumes the attention of its recipients. ...[A] wealth of information creates a poverty of attention." Which is where metadata techniques come in, pattern recognition, indexing metrics, some kind of Dewey Decimal system. You're not even trying to catalogue content. At this juncture, the best you can hope for is an address book, a directory of unlisted numbers.

This information paralysis of course applies to the assorted dishevelments of the Trump administration. The signal-to-noise ratio is deafeningly high, which makes it hard to identify actual targets. NORAD used to have a similar problem, on the Distant Early Warning line. Are those incoming Russian bombers, crossing the Arctic circle, or a flight of geese? Their radar couldn't discriminate. It created an anxiety threshold, a constant. You had to be on the alert all the time, checking your perimeter.

We also know there are disinformation procedures, decoys and deceptions. A famous example is the phantom invasion force built up around Patton before the launch of D-Day, to mislead the Germans into thinking the attack would come at the Pas de Calais, not Normandy. Any career intelligence professional would have to wonder, how much of the chaos in the Trump world is deliberate, or diversionary?

Basically, what I'm suggesting here is a coping mechanism. If you treat the Trump experience, or episode, as an intelligence exercise, an assessment, the way old Russia hands at CIA and State used to game out the Kremlin's intentions, or Sinologists would read the runes about Mao and the Chinese - as if, in effect, it were a foreign country, an alien culture - you can attempt a penetration, a covert operation in a Denied Area. You don't try and deconstruct every utterance, you think in terms of deeper grammar. The volume of traffic is a distraction. You look for signifiers, the moss on the north side of the trees.  

Take the Stormy Daniels imbroglio. At first glance, it's a sideshow, nothing to do with the main event. But then it develops that Cohen banked Vekselberg's front money in the same account he used to pay Daniels? OK, time out. Cohen's a moron. He's as likely a consigliere as I'm likely to ghost a series of Stormy-branded thrillers, Money Shots.

In other news, with everybody focused on the Russians, we have the embargoed Chinese telecom ZTE back in the US market, hand in glove with an announced 500-million-dollar Chinese government loan to jumpstart construction on an Indonesian theme park that includes - wait for it - a Trump golf course and hotels. Soybean futures are safe again?

Lest we forget, there's Erik Prince, late of Blackwater, whose mission appears to be clandestine comms and advance man. He's also floated the notion that the combat presence in Afghanistan and Iraq could be taken private. We're now hearing about a meeting between Prince, George Nader, and a guy whose name is new to me, Joel Zamel, pitching a social media manipulation campaign to Donald Trump Jr., that would be bankrolled by the Saudis and the Emirates. Wait, what?

Not least, the Aztec Two-Step that seems to characterize Trump himself, an inconsistent struggle with cognitive dissonance. It's still not entirely clear whether Trump is playing with a full deck.

Enough already. We have a surfeit of detail. How do you give it any coherence? I'm suggesting you could diagram it out. In the intelligence world, this is known as an Order of Battle. Suppose, for the sake of argument, we were talking about the Warsaw Pact and its offensive capacity in an attack on NATO and Western Europe. At one time, this was a very real intelligence target, and we devoted a lot of resources to it. You begin by developing a baseline, infantry, aircraft, and armor, re-supply and support units, communications, chain of command. Then you monitor their activity. What compromises routine? This gives you background, so you can identify a break in routine, a heightened alert status or ready condition, any significant change in the threat posture.

Applying this to the Trump world, there's an immediate benefit. You distance yourself. You don't let it suck all the air out of the room. You don't take it personally. Establish a baseline, cultivate context. Don't miss the forest for the trees. For all its ambiguities and improbabilities, its fabrications and false flags, it's not that impossible a tangle. Messy, yes. Impenetrable, no.

Spycraft is mental discipline. It's not proof against hysteria, and it can't remedy willful ignorance, but it's a compass heading, possibly even an exit strategy.  

JUSTIFY: the Old Spook and the Flowerspy at a rainy Pimlico, Preakness 2018

Gen. Hayden Comes Out

A lot of stuff happened on Michael Hayden's watch - or watches. 40-year career military, he retired with four stars. He served as Director of the National Security Agency (DIRNSA) from 1999 to 2005, Deputy Director of National Intelligence (DDNI), 2005 to 2006, and Director of Central Intelligence (DCI), 2006 to 2009.

The last ten years of Hayden's career are, um, interesting, a period that was a particular challenge for the American intelligence community - and for Hayden personally, a time when he became a senior placeholder and the brand label for an emerging subset of spycraft, the Information Domain.

Hayden commanded the Air Intelligence Agency before moving up to NSA. This is one of the three military cryptologic units (each of the major branches have one), and in fact it's my old outfit, the USAF Security Service, dressed up in new clothes and renamed. the basic mission is much the same, but as the electronic battlefield has gotten more sophisticated and elusive, the targeting and analysis strategies have kept pace. Hayden's assignment to AIA was a bellwether of his later tenure as DIRNSA. Although he seems to have miraculously few serious enemies in and around the Beltway, he's known to take no prisoners.

Air Intelligence apparently became something of a test case, both for Hayden and the secret world at large. It's a commonplace that generals fight the last war, and it's just as true of the secret intelligence community. Hayden brought a different mindset to AIA. The enemy was no longer state-sponsored. The environment was target-rich, but suddenly diffuse, amorphous and unfocused. Hayden didn't invent the concept of metadata, but he understood how it could be a useful tool. The problem wasn't too little intercept, it was too much. You needed a way to shape the raw material, to give it context and collateral, and put the dirty bits in boldface.

Otherwise, your 'product,' in the jargon, turned lumpy and indigestible, like a cake that's fallen in the oven, and your consumers would spit it out. You're only as good as your box office. Hayden understood the relationship was market-driven.

Let's cut to the chase. There's a cloud over Hayden's job performance as DIRNSA, and then as DCI. The complaint is that he was, in effect, a Good German - that he turned a blind eye to excesses. Now that Hayden's published a  memoir, PLAYING TO THE EDGE: American Intelligence in the Age of Terror, he gets to tell his side of the story, or at least blow some smoke our way.

Let me 'splain something here, Lucy. Spook memoirs are a mixed bag, a specialized genre like the campaign biography, with peculiar ground rules. There are the outright fabrications, like Kim Philby's MY SILENT WAR, which was ghostwritten by his KGB handlers. On the other hand, some are entirely reticent. Dick Helms' A LOOK OVER MY SHOULDER is so dry you wonder if the guy even has a pulse, until he gets to Nixon and Watergate, and his fury boils over. They usually split the difference, between a poison-pen letter and a sanitized employment application. It helps if you're familiar with the background landscape, and the supporting cast, which of the stories have been told before, from which perspective, and who's gone into Witness Protection. Valerie Plame Wilson and Scooter Libby are going to have two very different recollections of similar events, let's face it, and the possibility of active disinformation is never far from mind. You have to sort it out, and separate the self-serving from the malicious, or purely deceptive.

'Frank' isn't a word that trips immediately off the tongue when you consider Michael Hayden, but the book is revealing in ways he maybe isn't aware of. It surely displays the quality of his mind, and it also betrays an impatience with fools, which is no bad thing. I was put off, though, by a certain rigidity of temperament, or even spirit. Hayden doesn't seem to entertain much self-doubt. He's not a second-guesser. He weighs the arguments, he calls heads or tails, and then the tablets are written in stone.

A case in point is PRISM, the eavesdropping program I've described previously. Hayden refers to it as STELLARWIND, which is how the product was labeled, and although he admits there were some privacy concerns, it was simple necessity to use it. Okay, take his word for it. Then let's talk about Enhanced Interrogation. Opinions vary, but a lot of professional interrogators say torture doesn't get the needed results. Hayden says different. Again, is this philosophical, or metaphysical? Depends whose ox is being gored. If you're the guy on the operating table with water running out your nose, you're in no position to argue. We could also get into the nuts and bolts of the drone program and how targets for elimination are selected.

The larger question here, aside from specific issues, is transparency. Hayden's read on this is spectacularly tone deaf. When he took the helm at NSA, he made an effort to drag them kicking and screaming into the daylight. This was simply good public relations, to position the agency as a visible presence, and sitting with the grown-ups. He'd also inherited a recalcitrant and ungainly command and reporting structure, so Hayden's reorganization went some way toward establishing his own independent power base. What didn't happen, though, was any change in his baseline metabolism. The habit of security, circling the wagons, is ingrained, it becomes second nature.

Hayden falls back on the Honorable Men defense. This is the title of William Colby's memoir of his years as DCI - and comes, in fact, from his testimony in front of the Senate Select Committee. We work in secret, Colby's train of thought goes, and the American public has to trust us to be honorable men, that we know right from wrong. Or, as Mike Hayden puts it, quoting an unexpected source, "To live outside the law, you must be honest."

Stop me if you've heard this. It sounds much the same, set to new music, and sung in the key of Tuned Out.

Sauce for the Goose

Meanwhile, back on the spook front, a couple or three developments. Maybe not all of a piece. They just bunched up on the radar around the same time.

To begin with, NSA has announced the establishment of a new Directorate of Operations, to oversee two previously separate missions - known as Signals Intelligence and Information Assurance - the first their offensive eavesdropping capacity, and the second their security firewalls. This is kind of a big deal, although it might not seem like it to an outside. The intelligence agencies prefer not to cross-pollinate.

Although inter-agency and intra-agency transparency looks good on paper, there are inherent risks, and they don't necessarily have a lot to do with jurisdiction or budget fights. Yes, you always have to live with dedicated turf warriors, but this is actually about keeping your assets secure and compartmentalized. For many years, CIA has maintained an institutional divide between Intelligence and Operations, and resisted calls to integrate. You could argue one mission is passive and the other active, but more to the point, a compromise on one side of the shop doesn't jeopardize the other. You limit your exposure. You're not giving up a roadmap to sources and methods.

So it's a trade-off. NSA may well enhance its analytical skills, of intercepted traffic and in defense against cyber attack. They may also be opening the watertight doors.

The next thing that caught my attention probably falls under the heading of Old Wine, New Bottles. Some while ago, DARPA came up with a program, or a menu of programs, called Total Information Awareness. This was shelved, for a time, and then implemented by fits and starts, not as a fully coherent approach. Then come the Snowden leaks, and data-mining is on everybody's lips. Nancy Pelosi and the House Intelligence Committee are shocked, shocked, but eventually the smoke blows away. Now a new tool has surfaced, called Information Volume and Velocity. (Don't you love these names?) This is designed to model trends on social media, among other platforms.

The most obvious application is counterterrorism. ISIS, for one, and the insurgents in the North Caucasus, for another, are more than familiar with Twitter and Facebook. They use them for recruitment, and public relations, and for command-and-control in the field - although lately the more popular vehicle has been on-line simulator games. You can see the appeal of a first-person shooter.

The problem, from NSA's point of view (or CIA, or the FBI, or Homeland Security), isn't data collection. The issue is how to process the material, and spin gold out of straw. The volume, not to mention the velocity, is impossible to keep up with. What they've got is an embarrassment of riches. The information environment is overwhelming. They need a filtering mechanism, to define the threat posture.

Last but not least, we have the recent Apple dust-up. This isn't a theoretical, or preventative policing. It's a question that came up after the San Bernadino shootings last December. Farook, one of the shooters, had an iPhone. FBI investigators would like to unlock it, and Apple says they won't provide a way to defeat the encryption. What we got here is real quicksand.

These issues are nowhere near clear-cut, although Apple CEO Tim Cook seems determined to frame it in apocalyptic terms and FBI Director James Comey is taking a predictably hard line. The law-and-order argument is uncomplicated. Comey says, we need to pursue every lead, in case other people are involved. We have a duly-issued search warrant for the digital contents of the phone, and the manufacturer has a legal and moral obligation to comply. Apple has in fact given the FBI everything it could download from the Cloud, but it refuses to write code that would reverse-engineer the encrypted data that's on the phone itself. Apple maintains that this would of necessity amount to a master key, that would unlock any iPhone. In other words, they could no longer market a secure product. They may cloak it in civil liberties, but it's a business decision.

The disingenuousness, or hypocrisy, on both sides, doesn't take away from either position. Comey's point is perfectly well taken, and so is Cook's. And for once, although I'm sure there are people who probably think I never met a surveillance program I didn't like, I'm with Apple on this one. Whether you trust U.S. federal agencies to take the high road is irrelevant. There are other countries in the world. There are more than a few that bully their own citizens, and whose management of information technology is anything but benign. We'd be handing them a loaded gun.

Is there a common thread? I dunno. There's no hard and fast. Maybe it signifies, maybe not. Stuff drifts past in my peripheral vision, and sometimes it catches the light.

Scattered Castles

There's been a lot of smoke and mirrors lately about the Chinese hacking into computer networks all over the place, and of course it isn't just the Chinese. Cyberattacks have become a lot more common. Anybody remember STUXNET, the virus that targeted the Iranian nuke R&D? Nobody's copped to it, but we can imagine it was probably a joint effort by the U.S. and the Israelis.
My own website was hacked by some Russian trolls. I don't know what the object was. Bank fraud, or Meet Hot Slavs?  It wouldn't be to use any of the actual information from my site, but to compromise the server pathways. FatCow, the server, hosts a buttload of websites, and once in the back door, you could cherry-pick all the caramels, and leave the liquid centers behind.

The point of the Chinese hacks is that they're not amateur or random, by and large, but directed by the Ministry of Defense, against specific hard targets. The big one, most recently (or at least most recently discovered), is the security breach of the Office of Personnel Management. I know this doesn't sound all that glamorous or hot-ticket - OPM is basically the U.S. government's Human Resources department, the central clearinghouse - but in fact it's a big deal. Best guess to date is that 18 million files have been penetrated, and that's a lowball figure. 

Here's what makes it important. OPM is responsible for security clearances, access to classified material. Back in the day, this was the FBI's job, but it's presently estimated that 5 million people, including both government employees and contractors, hold clearances, and the FBI's current staffing is 35,000. You do the math. The numbers are overwhelming. OPM, in turn, farms this out to FIS, the Federal Investigative Services, and the private sector.

But wait, there's more. The intelligence agencies, CIA, NSA, the National Reconnaissance Office (the spy satellite guys), have their own firewalled system, know as Scattered Castles. For whatever reason, budgetary constraints, too much backlog, or pressure from the Director of National Intelligence, the spook shops were instructed to merge their data with OPM's. So was the Defense Department. A certain amount of foot-dragging ensued, not just territory, either, but concerns about OPM's safeguards. In the end, they caved. Not to oversimplify, because the databases are in theory separate, but it created an information chain.

Suppose, and it's a big suppose, that Scattered Castles is accessible through the OPM gatekeeper. Nobody in the intelligence community, or OPM, or the FBI (which is the lead investigator of the OPM break), will go on the record one way or the other. Understandably, because they'd be giving whoever hacked OPM a further opportunity to exploit, if they haven't already. This is a case of locking the barn door after the horse is gone. The worst-case scenario is that active-duty covert agents could be exposed. And bear in mind, that when you're investigated for a security clearance, you give up a lot of sensitive personal data - divorce, bankruptcy, past drug use, your sexual preference - the list goes on. Which opens you up to blackmail, or pressure on your family. This is an enormous can of worms, the consequences yet to be addressed.

OPM uses a Web-based platform called eQip to submit background information. You might in all seriousness ask whether it's any more secure than Facebook. The issue here, long-run, isn't simply the hack, but the collective reactive posture. These guys are playing defense, not offense. The way to address this is to uncover your weaknesses before the other guy does, and identify the threat, not wait for it to happen. Take the fight to them. Otherwise we're sitting ducks.  

It's amazing to me that these people left us open to this, quite honestly. They don't go to the movies, their kids don't play video games, they're totally out to lunch? It ain't science fiction. It's the real world. Cyber warfare is in the here and now.

Heads are gonna roll, no question. OPM's director is for the high jump, and her senior management is probably going to walk the plank, too. This doesn't fix it. What needs fixing is the mindset. We're looking at inertia, plain and simple, a body at rest. We need to own some momentum. 

http://www.DavidEdgerleyGates.com/

The Kaspersky Code

Three weeks ago, Kaspersky Lab, the Russian security software maker exposed a cyber-espionage operation that many believe originated within the NSA. The devilishly clever bit of code hides in the firmware of disc drives and has the ability to continuously infect a machine. If you use a Windows computer, there’s a good chance it’s not only infected but was built that way likely without the manufacturers' knowledge.
Kaspersky researcher Costin Raiu says the NSA couldn’t have done it without the source code.

What?!!

The contention that the NSA definitely had access to the source code is not only patent nonsense, it ignores that fact that Kaspersky themselves supposedly didn’t have the code. Having the source code is the easy way, perhaps the preferred way, but it’s hardly the only way.

A Reuters article speculates how the NSA might have obtained the source code and indeed, one of those is a likely scenario. But it’s also feasible to do the job without the source and I’ll show you what I mean, a technique I used to unravel computer fraud programs. Fasten your seat belt because this is going to get technical.

World’s Greatest Puzzle

Those around in my Criminal Brief days know that I love puzzles. For me, the ultimate puzzle has been systems software programming, making the machine do what I want. But sometimes I’ve come up against puzzles, some benign, some not, where I didn’t have the source code.

Let’s try an example. What if we found mysterious code in our computer that looked something like this:

Mysterious Snippet of Computer Code

If you can’t make sense out of this, you’re not alone. 98% of computer programmers wouldn’t know what to make of it either. But if you look closely, the data populating the upper block looks different from that in the lower block. This is a clue.

Unlike commercial and scientific programs, systems software deals with the operation of the computer itself– utilities, communications, and especially the operating system. The realm of a computer’s internals are abstract, far more so than the Tron movies. Key aspects seldom relate to real-world equivalents. Sure, we say that RAM is a little like notes spread out on your work table and that disc storage is kinda sorta like a file cabinet… but not really. Even the term RAM– random access memory– is misleading; there’s nothing random about it.

Back in the real world, let’s say you want to write a simple program that adds the number of apples and oranges. In most programming languages, this code would look like this:

total = apples + oranges

Internally, a program loads apples and oranges into registers (kind of like keying them into a calculator), adds them, and stores them in a variable called total. If we were to write this in the argot of the computer, we’d use assembly language mnemonics, an abstraction of the computer’s machine language. Deep, deep down in a program, we’d see nothing but numbers where we count…

0, 1, 2, 3, 5, 6, 7, 8, 9, A, B, C, D, E, F

Yes, A-F are digits in this context. Within the computer, our little program above might resemble…

total = apples + oranges

What isn’t obvious to many programmers is that computer instructions are data. Indeed, some black-hat crackers (the bad guys) have used this property to sneak malware onto unsuspecting computers.

If you look again at the original sneak peek of data, you’ll start to see patterns and may even pick out the machine instructions from our code example above.

Less Mysterious Code Snippet

This puzzle solving is called reverse engineering. It’s possible to write a program called a disassembler (I have) or a de-compiler (I haven’t) to decode the machine language into something more intelligible. The program has to be smart enough to not only separate actual data from instructions, but distinguish the type of data.

As you see, compiling source into binary executable code isn’t a one-way street. With dedication and know-how, reversing the process is well within reach.

How safe do you feel now?

Through a Glass, Darkly

by David Edgerley Gates

The exposure of PRISM, the clandestine NSA data-mining operation, has raised a lot of hackles, both inside and outside the national security structure, and on both sides of the privacy debate. I'd like to assess three of the issues I think are involved. This is of course by no means exhaustive. I'm just putting my oar in the water.

First of all, what is it? The system, or systems, is based on pattern-recognition technology. A crude analogy might be a chessboard. Bobby Fischer was a genius at chess because he could read the entire game, not just six or eight or a dozen moves ahead, but every possible outcome of every available move. Consider the sixty-four squares and the fact that each piece, rook, knight, bishop, pawn, or queen, has a specific capacity, for attack or defense, all of them in relation to the others. 'Position' is the sum of these parts. Imagine, then, if you stacked eight chessboards on top of one another, a cube, sixty-four squares to the eighth power, making it a three-dimensional game. Not even a Bobby Fischer could calculate all the possible coordinates and relationships. Multiply this model by a few billion, and you'd have some idea of PRISM's brute strength.

Metadata, so-called, isn't about content. PRISM doesn't filter for keywords, or labels, or names. It looks for contours, and reconstructs their shape. A recent piece by Jane Mayer in The New Yorker explains this in some detail,

 Nor is this is a new development. DARPA, the Pentagon research facility also known as the Skunk Works, began work ten years ago or more on a set of programs they called Total Information Awareness. The first practical application was CARNIVORE, which analyzed electronic communications, encrypted and cleartext, but CARNIVORE was never fully deployed because of---wait for it---privacy concerns. PRISM has a narrower search parameter. Think of it this way. It's an axiom in the spy trade that a given message, by itself, is meaningless without context. What's important is who sent it, and who it was addressed to. In other words, the link is incriminating, and what might actually have been said in the message is secondary. PRISM ignores the message, and concentrates on the messenger. How is this effective? Your circle of contacts, immediate or one step removed, defines your profile, but 'profile,' in this sense, having nothing to do with your Facebook page. Everybody leaves a footprint, a migratory pattern, a set of lazy habits. I can stalk you through your friends.

The second point I'd like to take up is the role of private contractors in the defense and intelligence communities. GI's, for example, don't pull KP anymore. Food service is jobbed out. More at issue, hired guns like Blackwater have taken over physical security for diplomatic personnel in high-risk areas, and their lack of accountability got them thrown out of Iraq. Two of the guys killed in Benghazi, on the security detail, weren't CIA, but outside hires. This isn't just anecdotal. DoD employs 700,000 contractors, 22% of its workforce. 70% of the intelligence budget, by some estimates, goes to outsourcing, but this is difficult to pin down, because the specifics of the intelligence budget are of course classified. In the case of NSA, nobody knows exactly---nobody knows anything about NSA, exactly, since its culture of secrecy gives it the nickname No Such Agency---but an educated guess is that they have half a million private contract employees on their payroll, with high-end security clearances. These aren't insignificant numbers, and it's worth noting that they don't represent any kind of savings, either. Edward Snowden was knocking down 200K, twice what a GS-15 would make, or any military enlisted or officer rank. Booz Allen, Snowden's employer, had 5.9 billion dollars in revenue last year, almost all of it from U.S. government contracts.

The question being raised now, though, is whether private security contractors are stakeholders in national security. This isn't to tar them all with Snowden's brush, or to suggest dereliction of duty, but career military or civil service people tend to serve a purpose larger than themselves. Working for Booz Allen is a job, like any other. If you get a better offer, you move on. Oversized cubicle farms don't inspire brand loyalty. You're not in the Marines. It may be unfair to make these assertions, and the last thing we need is a witch-hunt, which would do nothing to undo the damage already done, and the lack of confidence the leaks have created, but it's long past time to re-examine the hermetic culture of the intelligence community. A good starting point might be the influence of corporate, marketplace economics.

Which brings us to the third and last question.  Who are these guys? Whistleblowers. Leakers. The terminology is suspect. It implies high moral standards, or at least moral relativism. Bradley Manning was obviously a square peg in a round hole. He may have been bullied, because he was gay, or just an odd duck. Almost certainly, he was isolated and unhappy, and his supervisors in the chain of command should have picked up on it. He was an accident waiting to happen. The court-martial proceedings against him have the flavor of retribution, not so much for his actions, but for the inaction of his immediate superiors. They should have suspended his clearance and sent him to a psychiatrist. Instead, they left him to sink or swim. The fact that Manning was treated with such indifference might go some way toward explaining him. He was at the bottom of the food chain. Perhaps, as a reflex, or in an effort to regain his self-respect, he came to feel he was better than they were, a sort of prince in exile, a secret agent, and in the end, he cast off his disguise. Sadly, no prince was revealed.

Snowden is a different case. He had a successful career, and the material trappings to show for it. He was, by his own account, quite the ladies' man. He was outgoing and personable. He had a social life. The other side of the coin from Manning. Snowden was dealt better cards. He turned for unaccountable reasons. He claims the high moral ground, but there's an odor of sanctity I mistrust. I'd give him more credit if he'd stuck around to face the music, but the prospect of doing thirty to life in a federal supermax would give anybody pause. What bothers me is the itinerary he's chosen. He's now left Hong Kong for Moscow, with the stated intention of flying to Cuba, en route to seeking asylum in Ecuador. The net effect of his stay in China has been to give support to Beijing's control and censorship of the Internet, e.g., they can claim that U.S. accusations of Chinese hacking are the pot calling the kettle black. Not to put too fine a point on it, Snowden is giving aid and comfort to the enemy. These are not the actions of an honorable man impelled by outrage. These are the acts of a defector.

Herbert O. Yardley: The American Black Chamber

by David Edgerley Gates

Herbert Yardley was never a household name, but among his peers, he was almost godlike.  He was, in effect, the father of American codebreaking.  (He was also, it happens, one hell of a poker player. You do the math.)

Yardley started out as a code clerk at the State Dept., in 1912.  His first significant coup de theatre came when he intercepted a coded message to President Wilson from Wilson's close personal aide, Colonel House.  This was before America entered the European warm and House had been sent to meet the Kaiser: here was his confidential report.  On a dare, we might say, Yardley broke the encrypted traffic in two hours, and realizing just how vulnerable American diplomatic cipher systems were, he took the results to his boss.  The fuse was lit. In 1917, with America now in the war, Yardley got a commission and went to work for the War Dept., heading up MI-8, codes and ciphers, and eventually turned it into the first real U.S. cryptographic intelligence operation.  1918 found him at Versailles for the peace conference, and his shop encoded American traffic, while secretly decoding those of their Allies.  Of course, the French and the British were doing the same thing, and Yardley by this time was no innocent in duplicity.

The war over, Yardley headed home, assuming he was out of a job.  But meanwhile, Military Intelligence and the State Dept. had decided to pool their resources, and establish a full-time clandestine eavesdropping organization, with a black budget, hidden from the Comptroller General.  Yardley was given the mandate.  They were up and running by May of 1919, and in December, Yardley hit the jackpot, when he cracked the Japanese encipherment protocols, and opened up their coded military and diplomatic cables.  This was a big deal, and it gave the American negotiators at the 1921 disarmament conference an enormous advantage.  The object of the conference, between the five major naval powers, the U.S., Britain, France, Italy, and Japan, was to stabilize the ratio of seapower tonnage.  Basically, each navy would agree to a limit on warships, relative to the navies of the other countries.  Japan was aggressively pursuing a higher limit for the Imperial Navy, and even at this stage, U.S. and British military strategists were disturbed by Japanese ambitions in the Pacific.  But what Japan's admirals said publicly at the negotiating table was undercut by their secret instructions from Tokyo, which conceded political realities.  Yardley, knowing his way around a game of stud poker, compared this to knowing your opponent's hole card, and in the end, the Japanese caved.  It was high-water mark for American intelligence capacities, and for Yardley, personally, who never minded the attention.

There were, however, clouds on the horizon. Wartime cable censorship was over.  Communications were supposed to be private.  Yardley, or high-ranking military surrogates, approached the major telegraph companies, and strong-armed them into continuing to supply their cable traffic.  This was, of course, completely illegal, unless you got a search warrant, and Yardley couldn't blow his cover by doing any such thing.  His operation flew under the radar.  He turned to the Signal Corps, but State spiked the idea of setting up Army listening posts. Yardley had started his operation with fifty people, and expanded with the heavy demand.  By 1929, with the Depression, his staff was down to seven, and badly demoralized, their astonishing successes forgotten.  Times had changed.  Hoover was president, now.  Yardley gambled it all on one last throw of the dice.  He went to the Secretary of War, the newly-appointed Henry Stimson, and put his chips on the table.  Here, for example, are the recent Japanese decrypts, he told Stimson.  And perhaps as a joke, or just to show off, Yardley said he could read the Vatican's private communications.  Exaggeration for effect?  We don't know.  The joke apparently fell flat.  Yardley had bet into a stronger hand.

We imagine a moment of stony silence.

Stimson then comes up with a next to legendary line, in the clandestine world.  He looks at Yardley, and says---wait for it---"Gentlemen don't read other gentlemen's mail."  And with this, Yardley is put out to pasture, his operation dismantled, and their efforts ignored, if not disgraced.

Yardley, in his uppers, writes a book, THE AMERICAN BLACK CHAMBER.  Published in 1931, it's a sensation.  Washington hunkers down.  William Friedman, another big-time cryptologist, now chief of Codes and Ciphers, is in a fury, because Yardley's book gives up sources and methods.  He has a point, since the Japanese immediately change their encipherment programs.  Friedman won't break the Purple Code until late in WWII.  But the government can't embargo Yardley's book.  He's not in violation of any existing security laws.  And it's something Yardley's thought about.  He himself wonders if he's letting the genie out of the bottle.  But, he decides, men like Stimson have their heads in the sand.  He goes ahead with publication, in spite of his own doubts, and the ship pushes slowly back against the iceberg. Inertia bows to necessity. 

Yardley works for the Canadian government, and later the Nationalist Chinese.  He writes another book.  Suppressed, for whatever reason, by the U.S. government, but afterwards declassified.  Not exactly a victim, like Alan Turing, but sort of forgotten.  Yardley was a tireless self-promoter, a guy who never shunned the limelight, and maybe took credit for other people's labors, but for all that, he's still the man behind the curtain. 

NSA is the largest of the American intelligence agencies, dwarfing CIA.  National Reconnaissance had the bigger budget, because they put satellites in orbit, but Ft. Meade has the personnel, and the brute mainframes, and the black budget.  They can suck the air out of a room.  This is perhaps Herbert Yardley's legacy.  Not that he thought of it that way.  I doubt if he imagined a world where they can read all our mail.

He would have preferred to read all the cards.

[Many of the specifics here are taken from David Kahn's book THE CODEBREAKERS, and James Bamford's THE PUZZLE PALACE, two excellent resources.]