STAFF: Without further ado, let’s welcome General Alexander to the stage. (Applause.)
GENERAL KEITH ALEXANDER: Well, Trey and Jeff, thanks. Thanks for that introduction.
I think what they said to start out with is the reason I’m here. This is the technical foundation for our world’s communications, you folks right here, and the issue that stands before us today is one of what do we do next, how do we start this discussion on defending our nation and protecting our civil liberties and privacy.
The reason I’m here is because you may have some ideas of how we can do it better. We need to hear those ideas.
But equally important, from my perspective, is that you get the facts. And so what I’m going to do today is try to lay out those facts.
Now as Trey or Jeff said, there are good reasons why some of this is classified and why some of it is stuff that we just don’t put out there. And the big reason, from my perspective, is because terrorists use our communications. They live among us. How do we come up with a program to stop terrorism and to protect our civil liberties and privacy? This is perhaps one of the biggest issues facing our country today.
I also want you to get a sense for the people at the National Security Agency. It has been the greatest honor and privilege of my life to lead these noble folks. They’re the ones – and you’ll get a little bit of sense of what they’ve done for our country over the past eight years while I’ve been there. And their reputation is tarnished because all the facts aren’t on the table, but you can help us articulate the facts properly.
I will answer every question to the fullest extent possible, and I promise you the truth – what we know, what we’re doing and what I cannot tell you because we don’t want to jeopardize our future defense.
What we’re going to do in this briefing is give you the facts on these programs – the business record, FISA, on FAA 702 – on what we’ve done to stop terrorist attacks, address some of the problems that we see out there with inaccurate statements and talk about where do we go from here.
That’s where you come in. We need to hear from you, because the tools and the things we use are very much the same as the tools that many of you use in securing networks.
The difference, in part, is the oversight and the compliance that we have in these programs. That part is missing in much of the discussion.
I believe it’s important for you to hear that, for you to understand what these people have to do in order to do their job to defend this nation and the oversight regime that we have with the courts, with Congress and with the administration. I think you need to understand that to get the full understanding of what we do and what we do not do.
I think it’s important to also step back. Let’s go back to the beginning. How did we get here? And normally, being a general, I would say, next slide. (Laughter.) But they gave me a device. (Laughter.) And they said, figure it out. (Laughter.)
It says “cue.” I thought that would be “clue.” OK.
So there we go. Let’s go back to 1993, the World Trade Center. It grows pretty quickly – Khobar Towers, the east African embassy bombings, the USS Cole, 9/11. Al-Qaida on the ones on the bottom there, throughout Khalid Sheikh Mohammed, helped fund the first World Trade Center and was the mastermind behind 9/11. We became a nation transformed.
The intelligence community, according to the 9/11 commission, failed to connect the dots. What do I mean by that? What do I mean by failed to connect the dots? We had intercepts of one of the 9/11 hijackers, Mihdhar, from Yemen. We didn’t know because we didn’t have the tools and the capabilities to see that he was actually in California. We couldn’t provide the right tip or information that connected that foreign dot to a domestic plot. The intelligence community failed to connect those dots. And now what we’re doing is putting into existence these programs.
But I think, in order to understand – so how do we actually use these programs? From my perspective, it’s important to first understand the people at the National Security Agency, what they do and how they do it. So from my perspective, the best first thing is to step back and say, what did they do during this time period? What are they doing?
And so our job is defending this country, saving lives, supporting our troops in combat. And when you think about our soldiers, sailors, airmen and Marine that were in Iraq and in Afghanistan, it is our responsibility, along with the rest of the intelligence community, to provide the information that they need to survive, to go after the enemy.
What you see on this slide is one of those tools that we brought to bear. This is a technical tool. What’s not shown on this slide is the thousands of NSA personnel who volunteered to go forward. Over 6,000 NSA employees have gone to Afghanistan and Iraq. Twenty of those cryptologists paid the ultimate price to ensure our troops had the intelligence they need. That’s a noble purpose. That’s what these people do.
And you can see the impact. And for me, it was an honor and privilege to work with these folks. The time and the effort that they spent, our discussions with General Dave Petraeus, General Stan McChrystal, Ray Odierno, Lloyd Austin and Admiral Bill McRaven – our job was to provide that intelligence that they needed and the timeliness that they needed it to help them go after the adversary. And you can see the significant drop that occurred as we implemented those capabilities in Iraq and our troops went forward.
This is absolutely superb. The mindset of these people is foreign intelligence to save lives – our lives, our military, our civilian. That is a true noble effort. And those are the types of people I have the great honor and privilege to lead. But the discussion today has to take that next step, what about counterterrorism? And what do we do about the discussion that I put on the table, from the World Trade Center in 1993 to 9/11? What now?
We failed to connect the dots. And so, we had to come up with a way of helping to stop the attack. Our government – Congress, the administration and the courts – all joined together to come up with programs that would meet our Constitution and help us connect those dots.
I think it’s important to understand the strict oversight that goes into these programs because the assumption is that people are out there just wheeling and dealing, and nothing could be further from the truth. We have tremendous oversight and compliance in these programs, auditability. And for many of you with the technical background – (inaudible) – net flow and other things like that, you know that we can audit the actions of our people a hundred percent in this case. And we do that.
But this information and the way our country has put it together is something that we should also put forward as an example for the rest of the world, because what comes out is we’re collecting everything. That is not true. What we’re doing is for foreign intelligence purposes to go after counterterrorism, counterproliferation, cyberattacks. And it’s focused. And if you think about net flow and the amount of information, you couldn’t afford – we don’t want to collect everything. It makes our analysis harder. If your intent is to go after terrorists, how do we do that? And so there are two programs that we have here: a metadata program, one that helps us connect the dots in the least intrusive way that we can; and FAA 702 or Section 702 authority, which allows us to go after content. I’m going to go each of these in detail.
But I want to put out one thing that’s important. Industry just doesn’t dump stuff to us and say, hey, here’s some interesting facts. They are compelled by a court order to comply. They are compelled by a court order to comply where all three branches of our government have come together, think about a lawful intercept program that we have here. I think this is a standard for other countries because we have the court overseeing it, we have Congress overseeing it, we have the administration, and I’ll go into all the different parts of the administration that oversees it.
And I’ve heard some people say that the court is a rubber stamp. I’m on the other end of that table with federal judges. And anybody here who’s been up against a federal judge knows that these are people with tremendous legal experience that don’t take any – trying to think of a word here – (laughter) – from even a four-star general. They want to make sure that what we’re doing comports with the Constitution and the law. And they are dead serious on it. These are folks that have given their whole lives to our nation’s judiciary system. These are folks who know they’re probably not going to go to the Supreme Court, but they want to do something for our nation. These are tremendous judges. They aren’t a rubber stamp. And I’ve been in front of that court a number of times. I can tell you from the wirebrushings that I received, they are not a rubber stamp.
Let’s go into the details of these programs. Press the button.
I thought it would be important to give you a picture of what our analysts actually see. There it is, right inside. This is for counterterrorism purposes, a program designed to go after communications of foreign terrorist organizations to help us connect those dots from a foreign actor to someone who may be in the United States trying to do us harm. This program was designed specifically to help us go after that – (inaudible). I think it’s important to have some of the facts on the table here for me to give you more facts.
First, as you can see, what you have is the date and time of the call, the calling number and the call – the duration of the call. And we also put in the origin of the metadata data. And you can see it says (“business record FISA” ?) just as another case, because our analysts who work this – that’s a flag for them that says this is important (court data ?).
This does not include the content of the communications. This does not include your phone calls or mine, your emails, nor mine, your SMS messages. There is no content. There are no names in the database, no address, no credit card numbers and no locational information is used. Let me give you an example of how this was important and how the foreign intelligence agencies, like CIA and NSA worked with FBI to help stop terrorist activities.
And this actually was given out publicly – Basaaly Moalin, a terrorist who was in California. We (had an ?) intercept of the communications – (in Somalia ?) – phone number of a person (talking about ?) terrorist activities, and that phone number, based on what they were talking about, allowed us to look into the database. What does that mean? The database is like a lockbox. The controls that go on this database are greater than any data repository in the government, and the oversight is the same.
To get a number approved, there are only 22 people in NSA that can approve that number. They had to prove that meets the standard set by the court, that this has that counterterrorism nexus with al-Qaida-related groups. Then and only then is that number added to a list that can be queried. Only those numbers on that list can be queried into that database. If you mistype a number, the database will reject it, because it has to be on that list. Only 35 analysts at (NSA ?) are authorized to run queries. They have to go through three separate different training regimen and pass a test to do – to actually do queries into that database
In 2012, there were less than 300 numbers that were approved – bless you – approved for queries – less than 300 numbers. Those queries resulted in (12 ?) reports to the FBI. Those reports contained less than 500 numbers. Not millions, not hundreds of thousands, not tens of thousands – less than 500
The intent of this program was to find a terrorist actor and identify that to the FBI. If you think about it, the FBI is a great agency. Director Bob Mueller is one of the greatest people I’ve ever met. His agency does tremendous work for this country. Our job is not to complicate his life by giving him as many numbers as we can. Our job is to help them focus on the right numbers
And the number that we gave him in California – they had actually had – we gave that to them in 2007. In 2004, they had ordered an investigation on that individual, but did not have enough information to open the full field investigation, so they closed that investigation down. In 2007, with the number we gave them, they had enough information. They take that number , and now their portion of this is they can take a national security (clip ?), find out who that number belongs to, and they found out it was Basaaly Moalin. They can then, with probable cause, get a warrant. NSA only has the fact of a number. FBI could take that, see where it connects to, use a national security letter and the legal authorities given to them to take the next step. That resulted in the capture of Basaaly Moalin from a (terrorist ?) support for terrorism and several co-conspirators.
The other program that I would like to talk to is the one we refer to sometimes as PRISM. But PRISM is part of it. It’s the FAA 702 authority. This is for foreign intelligence purposes. This is content. This is not targeting U.S. persons. This is targeting threats overseas. This is our lawful intercept program, which is analogous to many other countries around the world. They compel service providers to provide information just as we do. But I mentioned earlier, we have, I believe, a great standard, what we look at, the court, Congress and the administration all looking at – (inaudible).
I should mention on the previous slide, a hundred percent auditability. Let me just go back to that. I didn’t give you that part, and I promised I would, so I don’t want you to think I left that out. A hundred percent auditability. Oh, that was quick. (Pause.) So maybe there is a no going back.
So on this program, a hundred percent auditability on every query that we make. And that is overseen by our inspector general, our general counsel. In 2009, in our discussions with the president when he first came on board, we talked to him about these programs. And the issue was, how do we know the compliance is there, and what more can we do?
We stood up, working with the committees in Congress, a directorate of compliance. This directorate of compliance was headed by legal professionals and information specialists that can look at everything that we do in these programs and ensure they comport with the court orders, but we also have oversight from the director of national intelligence, general counsel and IG of the Defense Department, from the Department of Justice, from the White House, from Congress, the intel committees and from the courts. Our people have to take courses and pass exams to use this data.
So the same level of control is given to the FAA 702. In fact, this is the one that at times people say, they are listening to all our communications. That is not authorized under this. But the issue would be, for me standing me up here, many are going to say, well, I hear what you’re saying, but I don’t trust them. Congress did a review of this program over a four-year period, the Senate Select Committee on Intelligence. And over that four-year period, they found no willful or knowledgeable violations of the law or the intent of the law in this program.
More specifically, they found no one at NSA had ever gone outside the boundaries of what we’ve been given. That’s the fact. What you’re hearing, what you’re seeing, what people are saying is, well, they could. The fact is they don’t. And if they did, our auditing tools would detect them, and they would be held accountable. And they know that from the courses that they take and the pledge that they make to this nation. And they take that very seriously.
Remember, their intent is not to go after our communications. Their intent is to find the terrorist that walks among us. How can we do that? Well, we have two programs that help us do that. One is on metadata, the least intrusive – (inaudible) – that we can figure out. And that’s something that we should discuss that allows us to home in and give the FBI greater insights into these actors. And we have this content program – again, audited. Again, our people that go through this have to go through these courses and pass those tests.
There are allegations out there that they listen to all our emails, they do all these things. That’s wrong. We don’t. And if we did, we would be held accountable – a hundred percent auditability on what we do. At times I look at that and say, this is too much. Our people say it’s the right thing to do. The nation needs to know we’re going to do the right thing. We comply with the court orders and do this exactly right, and if we make a mistake, we hold ourselves accountable and report it to everyone.
I want to give you an example of what this means to us, what this means to our nation. I’m going to talk about the Zazi case, or the New York City subway bomb, because I think it’s important for you to understand how these programs come together. Our NSA, our CIA, our foreign intelligence agencies, our allies have good ways to go after terrorists.
One of those was an al-Qaida operative operating out of Pakistan, and we had insight as to some of his communications and what he was doing. We took his name (into ?) the 702 court, compelled one of the service providers to give us the content of his communications, his email. In those emails, we saw him working with an individual unknown to us, discussing an imminent terrorist attack. All we knew is they were looking for the recipes for bombs. We got an email address. In the email was a phone number. We didn’t know if the phone number was U.S. or overseas.
We gave the email address to the FBI. Again, the FBI has legal authorities then to take that email address and find out whose address is this. And this was Najibullah Zazi, a terrorist in Colorado. And they told us that the phone number that was in that email wasn’t his. We used that phone number to go into the business records, FISA data, because he had nexus to an al-Qaida-related operation. We found the first connection from that phone number in Colorado to an unknown phone number to the FBI in New York City.
But the important thing was that phone number in New York City also was talking to another terrorist-related actor in another layer to how to get another terrorist. That helped us tell the FBI that number in New York City is really important. That number was Adis Medunjajin
Time was of the essence in this case. You may recall that Zazi was driving across the country to conduct the attack; we intercepted this around the sixth of September and the attack was supposed to occur by 14 September. The FBI has to put these pieces together based on our input, what they get from customs and border patrol, what they get from other intelligence agencies and law enforcement and figure out what’s going down. They are superb; they stopped this attack. This would have been the biggest attack in the United States since 9/11. It came to – the initial tip came from the PRISM FAA 702 data. Business Record FISA is a tool that also adds value, but it can only add value in the United States.
So what does that mean? What have these capabilities done? We have talked about 54 different terrorist-related activities; I’ve put them up here so that you can see what we’ve been able to do. These are facts. This is a partnership between our foreign intelligence agencies and the FBI, between our country and our allies. We stopped 13 related terrorist activities in the United States and 25 more in Europe.
There are a number of things that come out of this (slide ?). First, the Business Record FISA can only help if there was a (link ?) in the United States. It had a role in 12 of those 13. In four, it came up with no results that was operation – (inaudible) – value to the FBI. In the other eight, it provided leads for the FBI to go after.
FAA 702 provides value across 53 of these and in roughly half of them, it was the initial tip. Our mission – stopping terrorism, is one of the most important things.
Q: Freedom!
GEN. ALEXANDER: Exactly. (Chuckles.) And with that, when you think about it, how could we do that? Because we stand for freedom.
Q: Bullshit! (Laughter.)
GEN. ALEXANDER: Not bad – (applause) – but I think what you’re saying is that in these cases, what’s the decision? Where’s the discussion? And what other tools should we have to stop those?
Q: (Off mic) – prosecute.
Q: But why would Congress – why would we believe that you’re not lying to us right now?
GEN. ALEXANDER: I haven’t lied to the Congress.
Q: What about – (inaudible) – congressional testimony?
STAFF: Wait for the question session.
GEN. ALEXANDER: Thank you for that. But I do think this is important for us to have this discussion, because in my opinion, what you quickly believe is that which is written in the press without looking at the facts. This is the greatest technical center for – (inaudible) – in the world. I ask that you all look at those facts, check that out. Read the congressional testimony. Look at what we are talking about here, because this is our nation’s future. This is what we’ve done with these programs – (inaudible). Those are facts.
And what we see coming at our country is more of the same. So the question that we have with all of us, so what do we do? Let’s begin that discussion. Without the facts – (inaudible) – have that discussion, so that people who are revealing information that can hurt the future of this country and our citizens, I believe that it’s irresponsible, it will have significant damage to our country. How do we defend this country? That’s the question. What you’re asking us to do is to defend the country. And you take an oath to that Constitution, and we take that very seriously. It’s not either/or. It’s both. And so here, if you want to be constructive, if you want to help get this right, be part of that discussion. Put the facts on the table. That’s what we need. You need to understand what we’re trying to do to defend the country and protect civil liberties – (inaudible).
On the business record FISA, 15 judges – (inaudible) – 34 times. Congress – (inaudible) – the administration – (inaudible). This morning, the director of national intelligence – (inaudible) – declassified some of those. Review that, see what we do in going after – (inaudible). So with that, I’d like to open it up for questions.
Q: So obviously we have – (off mic) – capabilities, but why do so many countries in the world want to attack us – (off mic)?
STAFF: (Inaudible) – generally speaking, you provide – (inaudible) – in terms if he wants to accept questions from the audience or to receive them in an organized manner. We reached out to the community to try to gather those – (inaudible). The general doesn’t know what we’re throwing at him, but I want to make sure that we’re asking – (inaudible) – questions for you. He’s got a very limited amount of time – (inaudible). Please.
GEN. ALEXANDER: I have no problem – (inaudible). I think that’s a great question.
(Cross talk.)
GEN. ALEXANDER: So the question that was asked was, so why do countries want to attack us? Why does al-Qaida want to attack us? Why do we stand in the way of them reaching their objective? And I think you should look at what they’re trying to create: a caliphate. They believe that the Middle East should be run under the Islamic law, sharia form of law, and that everybody should comply with their form of law, and that we in the United States, working in the Middle East, have stood in their way. They want to attack us.
Q: They want to attack us because we’re bombing them! (Laughter, applause.)
GEN. ALEXANDER: So it is – it is interesting that when you look at it, go back to the facts of ’93, World Trade Center, the Cole, look at the East African embassy bombings. Look at 9/11. So that’s what we face – (inaudible).
STAFF: General, do you have time to read a question – (off mic) – do you think that our national security intelligence and monitoring initiatives negatively impact our innovative domestic capabilities ability, companies’ ability to adequately grow in foreign markets over fears of back doors or covert access? More directly, is the NSA making U.S. companies less competitive?
GEN. ALEXANDER: That’s a great question. So the – from my perspective, I think it’s important that we put the facts on the table of what a lawful intercept is and what these companies are compelled to comply with. And every country has lawful intercept – or almost every country has lawful intercept programs that compel companies to provide information. The difference, from my perspective, is the oversight by the courts, Congress and administration in ensuring that we do this right.
STAFF: There was a great question published yesterday. I would like to echo that. There is a clear difference between the NSA cannot and the NSA will not. Is it discretionary or is it a preventative control?
GEN. ALEXANDER: So there are both. I think there are technical things that we can do to limit our collection. And we can do that. In the United States, if you think about – (inaudible) – and what do you, perhaps, in securing a network, how do you look at different parts? You can shield off certain parts from collecting net filter data. We do the same thing to ensure we comply with the law.
So the domestic communications we can technically take on, but there has to be another set of standards because the reality is communication is often times prevention. What happens if we run into a U.S. person’s communications? So part of what it has been – (inaudible) – talks about the minimization procedures, the training that everyone at NSA has to go through if we run across those communications. And we hold our people accountable to doing that exactly right.
STAFF: One question that came up a lot – (inaudible) – was once a classified document is publicly leaked, as in the case of the PRISM documents, why does the classification remain the same? Why can’t government employees look at the Internet? (Laughter.)
GEN. ALEXANDER: Well, there’s two reasons on that one. I think the issue is on this, how do we protect our nation? How do we defend it? And our public – this is classified. It’s not classified to keep it from you, a good person. It’s classified because sitting among you are people who wish us harm. If we tell everybody exactly what we’re doing then the adversaries will know how to get through our defenses.
That’s why I believe that what has happened, the damage to our country is significant and irreversible. What we’re talking about is future terrorist attacks. And when you look on this slide here, will we have the success over the next 10 years that we’ve had over the last? And I think it is worth considering what would have happened in the world if those attacks – 42 of those 54 were terrorist plots. If they were successfully executed, what would that mean to our civil liberties and privacy? So those are issues. Now, why do we classify – (inaudible)? (Applause).
STAFF: General, I know the NSA doesn’t shop where we do. Our attendees here at Black Hat have a certain project tools in our arsenal for defense. Our adversaries are well-read – (inaudible) – have access to our tools and means. We appreciate – (inaudible) – what the NSA is doing. And I know you can’t share more. But I would like to speak to your decision on whether or not these mini leaks have affected the NSA.
GEN. ALEXANDER: Well, it has. You know, and I think you can hear it from some of the comments that we’ve gotten here. (Inaudible) – see, think about people who are willing to go forward to Iraq and Afghanistan to help insure our soldiers, sailors, airmen and Marines, so they can get the intelligence that they need. I believe these are the most noble people that we have this country. They are willing to put their lives on the line for their fellow – their fellow soldiers and fellow Americans, and other countries.
And 20 of them lost their lives. And when you think about that, the issue is these same people who take that same oath to uphold and defend the Constitution (are ?) the ones that run these programs. And we get all these allegations of what they could be doing. But when people check, like the intelligence committee, they found zero times that’s happened. That’s no bullshit. Those are facts. (Applause.)
Please don’t put that – (inaudible). (Laughter.) Just that one word. I have 15 grandchildren. (Laughter.)
STAFF: Right. One more question before we break, General. In a moment, I’ve got to talk to my mom and dad. And I just wanted to know, your people can’t listen to me call my mom, right?
GEN. ALEXANDER: That’s right.
STAFF: OK.
GEN. ALEXANDER: And now there’s two parts to that. (Laughter.) (Inaudible) – I think – (inaudible) – the issue – (inaudible) – if you put that – (inaudible) – we have technical control – (inaudible). And then we have policy. So the technical is they can’t. You know, I asked the same thing about my daughters. I have four daughters. Can I go and intercept their emails? No. (Laughter.) It’s – (inaudible). But the technical limitations (are in there ?). Now, people who try to circumvent that, there is also a hundred percent audit. So when you – (inaudible) – my daughter at x.com, and an auditor that looks and say, what’s the foreign intelligence purpose of this query, and the analyst – (inaudible) – has to state that and show that what they’re doing meets that standard.
MS.: (Inaudible.) (Scattered laughter.)
GEN. ALEXANDER: Trey’s (sp) a good person. (Inaudible.)
MR.: Are you sure? (Laughter.)
GEN. ALEXANDER: (I’m a ?) terrorist associate. So the issue only becomes the issue that I would ask you to look at. And all of those that find what we’re doing that should be limited more, my comment is help us defend the country and come up with a better solution. You’re the greatest gathering of technical talent anywhere in the world. If we can make this better, the whole reason I came here was to ask you to help us make it better. And if you disagree with what we’re doing, then you should help twice as much.
MR.: Read the Constitution.
GEN. ALEXANDER: I have. You should too. (Laughter, cheers, applause.)
STAFF: (Inaudible) – wanted you to not come – (inaudible) – one loving crowd that loves – you know, gets them in a different way. (Laughter.) But thank you so much for coming out.
GEN. ALEXANDER: Thank you. (Applause.)
STAFF: (Inaudible.)
All right, guys. A couple of housekeeping items, and we’ll get started.
First, (art school ?) and the sponsored workshops have been moved from the hallway down to milano (ph) downstairs. You should check those out. Sponsored workshops only run today. (Art school ?) has its own dedicated (turbo tracks ?), so you should check that out.
Number two, white papers and presentations are online at blackhat.com. You can pull those down – (inaudible) – course you’re in.
Three, code of conduct. It’s important we have one. (Inaudible) – it’s at the bottom of blackhat.com if you need to check on it. If something comes up, let us know.
We value your feedback. The NSA is not helping with the towers at the back of the room. Use your little badge to scan that. You’ll get an email over a couple minutes. It’s five questions. We value your feedback. Your speakers wants the feedback. (End of audio.)
(END)