LAS VEGAS – The 2013 leaks by Edward Snowden highlight holes in the U.S. government around transparency and proactively dealing with insider threats, former national intelligence director James Clapper acknowledged.
The U.S. intelligence community needs to be more transparent with the public, while also providing more “legitimate conduits” for potential whistleblowers to air complaints they may have with the government in a protected, safe space – rather than the alternative of leaking sensitive information, Clapper, who served as the director of national intelligence from 2010 to 2017, said this week.
“In the case of [Edward] Snowden, the incident illustrated the need for transparency,” Clapper said at ENFUSE 2019 in Las Vegas. “There’s always been an aura of suspicion around the intelligence community and what it does. We need to look at the extent to which we could be more open and try to assure the public what we’re doing is design to keep the nation safe and secure. [That includes] the more we can explain about what we do, how we do it, that it’s all for the good [of the public].”
Clapper in 2013 found himself embroiled in controversy after classified documents, leaked by National Security Agency (NSA) contractor-turned-whistleblower Snowden, contradicted statements Clapper had made during a Congressional hearing, that the NSA does not assemble dossiers on Americans. Clapper said at the time that the agency does not do so “wittingly”, but later in a letter to the chair of the Senate Select Committee on Intelligence, Clapper admitted this statement was “erroneous.”
The incident underscored a level of mistrust around government agencies when it comes to data collection and privacy, Clapper said. That said, too much transparency around data could put citizen safety in jeopardy, Clapper said: “The problem with transparency is that as good as it is, it’s a two-way sword – the bad guys would go to school on it.”
Snowden’s leak of top-secret surveillance program information to journalists – which shed light on the government’s widespread surveillance of Americans’ phone calls and alleged data sharing between large technology companies and the government – also became known as a high-profile insider threat case for the U.S. government.
Insider threats in the intelligence community “can be hugely damaging,” and it’s important to set mousetraps and monitor the behavior of employees and prevent future data hemorrhages – however, when it comes to “monitoring electronic behavior on and off the job, I worry this will turn employees away from the intelligence community,” said Clapper.
One way to stomp out insider threat while also catering to intelligence employees’ needs is by providing a safe space in the intelligence community and government for whistleblower complaints, said Clapper: “There needs to be in the intelligence community a legitimate conduit for employees to report wrongdoings and concerns, and doing it in such a way where their identities can be protected.”
Top Cyber Concerns
When it comes to cyberthreats to look out for, Clapper said that it’s important to focus not just on the threats themselves, but the humans behind them.
“We always agonize which threat to bring up first. We must think about them all and not just be consumed with one,” said Clapper. “Cyber per se is not a threat itself, there’s always a human being on the other side who is operating, and [the threats] come from their motivations and what objectives they had.”
In terms of top cyber threats the U.S. is facing, Clapper said his top concern is disinformation campaigns on social media – particularly with the 2020 U.S. Elections looming. The issue stems from social media companies not proactively telling users if they were exposed to disinformation, blurring the line between fact and fake for social media users and creating a general environment of mistrust in news, online posts and government, he said.
“This is a huge problem for our country. Intellectual security has become a whack-a-mole game,” he said. “Disinformation is spreading. This year around 70 countries were found spreading disinformation campaigns. The core of this problem is Facebook… its tech is conducive for technology to be spread.”
Another concern is espionage, IP theft and sensitive information theft, Clapper said, referring to an incident in 2016during his time as national intelligence director where the U.S. Office of Personnel Management was breached to expose sensitive data belonging to more than 22 million people.
Finally, penetration of critical infrastructure – whether through implants embedded in supply chain technology or attacks on critical infrastructure like the electric grid – continue to be a top concern as well.
Attackers have been targeting critical infrastructure for awhile: including the 2016 Ukrainian outage and going all the way back to the 2013 Iranian DDoS attacks and the emergence of sabotage-bent malware like Stuxnet and Shamoon.
