 Good afternoon We're going to start to this afternoon with with some panels will wind up with the director of national intelligence But before we do that This is the best part of the day for me a year ago There were about 70 people got together and Started working on a project called let's define Homeland Security intelligence enterprise Well, that was whittled down the 40 people when we got into that four-letter word called work Now these 40 Americans 40 some Americans I Characterized as great patriots These are people from academia the public sector and private sector Who had day jobs, but at night and weekends and holidays met to discuss the issues To frame the issues To listen to people talk to us presenters They wrote they would take it to the they take their papers to the advisory boards the governance board and the special advisors and Get critiqued and go back and right again and right again and again To present today what you have as the paper outside on the table in In addition to this paper the intelligence protect the homeland There are three additional papers that will be posted online in the short term and a fourth later on So I think it's only appropriate now that we recognize those great patriots who in the true American spirit We're not satisfied with the with the status quo, but took on the tough challenge to define What we have no one to be but never recognized the Homeland Security Intelligence Enterprise I'd like to start off by recognizing my two co-co chairs the vice chairs Dr. Kathleen Kiernan and Dr. Laura Manning Johnson, please come out on the stage We also had a dedicated intern She doesn't expect to come out on the stage, but I want to come out here miss Amanda I'm going to recognize I want you to hold your applause. I'm gonna recognize the four There's five to co-chairs for one committee and three other chairs for the subcommittees. I mean first Subcommittee wanted definition Rob Regal and Neil Shlone, please stand up if you're here I know Rob is here earlier might have left The second subcommittee which is development integration of the Homeland Security Intelligence Enterprise and public engagement Mike Rollins The third subcommittee full integration enterprise and ecosystem Michelle far and The fourth subcommittee the privacy and civil liberties mission Dan Pareto Now with that would all stand up keep standing dent will all remain all the other members of the Homeland Security Council for Intel Homeland Security Intelligence Council, please stand up the Governance Board and special advisors and All the insa members who helped us up, please stand up and please give them around applause These are true American Patriots. I turn it over to Kathleen It's always both humbling and rewarding to follow a guy like Joe Rosick Colonel Rosick Epitomizes in my mind everything that we should we should strive to be as leaders quietly competent and sincerely a genuine American hero It was absolutely a pleasure to work with and serve Joe I have the pleasure now of introducing just a dynamite panel and let me start with Matt Olson newly Appointed director of the National Counterterrorism Center and had the opportunity as a newly appointed Director of the National Counterterrorism Center to brief the president yesterday, which was pretty exciting I understand so I'm a general counsel of the National Security Agency Farmer official at Department of Justice a graduate of Harvard Law School and a professor of law at Georgetown University Next to Matt is Chief Kathy Lanier of the Washington Metropolitan Police Department Kathy earned her bones in the street beginning in 1990 she was part of and led all aspects of the uniform patrol and tactical operations of the police department Kathy also represents the very best America has to offer in the law enforcement world She holds dual dual masters from Johns Hopkins University and the Naval Postgraduate School Next is John Pistol currently the administrator of the TSA following a tremendous career in federal law enforcement with the FBI Earning the rank and earning is is much more important than being appointed earning the rank of deputy director under his watch TSA continues to grow as a risk-based Intelligence-driven counterterrorism agency dedicated to protecting our transportation systems John also has a law degree from Indiana University School of Law Next is Suzanne Spaulding. She is recognized around the world as an authority on National and Homeland Security issues including cyber critical infrastructure CVRN weapons She served as the minority staff director of the HIPPSE and also is the general counsel for the SISI She was the assistant general counsel for the CIA prior to that and she currently works in the field as a practicing attorney This panel will be led today by Jean Mazur and when I was thinking through her career I had to draw a parallel to law enforcement Investigative journalists have a kindred spirit with law enforcement offices. They see the world through untinted glasses They speak the unfarnished truth and seek always to examine the most complex of issues Please welcome a highly acclaimed anchor and reporter and a woman used to driving world change and a modelist panel. Thank you Kathleen, thank you Thank you all so Scott McNeely of Sun of Sun Microsystems said a few years ago. You have zero privacy get over it Now I don't think even the most zealous civil liberties advocates really think we have zero privacy But certainly they have concerns that civil liberties and privacies have eroded since 9-11 with the Patriot Act and more Today, hopefully we're gonna get a fix on where we are where we might be able to improve Where things should change so first I'd like to ask each of our panelists to set the stage From where they sit Mr. Olsen, this is your first appearance of this kind since becoming head of the NCTC So let me let you do the honors here with your remarks first. All right. Thank you very much Jean and and thank you To insa for holding this panel and and it's really an honor for me to be participating in this with my friends and colleagues we represented sort of as I was thinking about we represent a Number of perspectives the federal state local law enforcement intelligence and I think it's a very fitting group along with the private sector So yeah, I've been at NCTC for all of about three weeks I walked into lunch a little bit late just in time to hear General Hayden say NCTC was an unqualified success So I almost thought I'd just get up and go home and my part was done But I can't take credit for that my glider my predecessor Admiral red before him and John Brennan Who helped start the whole thing going deserve the credit for that? But I hope to continue that that that record of success So I'll just say a couple words about NCTC what our mission is and then a couple of quick thoughts about The security the privacy and civil liberties issues That we face You know first of all as most of you know NCTC was created Post 9-11 it was a creature That of of that tragic day it grew out of the the work of the 9-11 Commission and then Congress in 2004 created NCTC we Really helped lead the government's efforts to combat international terrorism we combine People from around the intelligence community and outside the intelligence community in a really healthy and diverse mix of professionals Who bring a varied? set of Perspectives and backgrounds to look at all the information that we can bring together and we are singularly focused on that one mission Which is counter-terrorism So very briefly just a couple of our mission sets one is intelligence and that analyst analysis By law NCTC serves as the primary organization in the US government for Analyzing integrating all intelligence about terrorism and counter-terrorism We have a unique responsibility to examine International terrorism issues that span geographic boundaries. We analyze intelligence regardless of where it is collected Whether that's inside or outside the United States and we have access to essentially the entire catalog of counter-terrorism information that the government possesses Our second Primary mission area is watch listing. We serve as the central and shared Knowledge bank unknown insuspected terrorists and we support terrorist watch listing we maintain the Terrorist identities data mart environment or tide that many of you have heard about third a third mission area or responsibility. I'd like to highlight is And I think it's particularly relevant to this panel is sharing information with state and local law enforcement We have a group called the interagency threat assessment and coordination group But in a nutshell, it's a it's a small group of professional first responders from around the country who come and serve at NCTC led by DHS and FBI and their responsibility is to look at all the intelligence that we are producing and seeing and To take that information and turn it into products for first responders. So we have a product called roll call unclassified Piece of analysis That is designed specifically for a first responder audience And that goes to the issue again the general Hayden talked about of not just vertical intelligence, but horizontal I'm sorry vertical sharing of Of intelligence Down to the state and local our state and local partners the fourth area of responsibility I wanted to highlight is our strategic operational planning and this is a little bit different than the others and that it's not part of the Intelligence community per se but in this response in this role. We are charged with conducting strategic planning for counterterrorism activities We work closely with the national security staff at the White House to support a wide range of Plans both strategic plans and implementation plans So very briefly two quick points. I wanted to make when I thought about this panel with respect to privacy and civil liberties the first is that These two goals national security and and and privacy are not in conflict in the way that people I think often think they are From the perspective of NCTC from my time at NSA We have to we must do both of those things and we can do both of those things We can achieve greater security without any sacrifice of privacy through policies and technology and and and practices and then just finally I would want to share that I do and been very impressed I am an attorney by background. I've been very impressed so far with NCTC's record of privacy protection in my first few weeks Okay, Suzanne. Why don't you take it next just quick thoughts on this issue of privacy and security Yeah, well, I want to pick up on Matt's last point which is this notion that I think well, you'll hear I suspect from everybody up here, which is Reflected in insis report on civil liberties that we need to stop thinking of these as mutually exclusive Values, and I think one of the ways to do that is to watch pay attention to the way we talk about it I one of the things that that that has kept us from really Understanding the relationship between these two is our traditional way of talking about balancing national security and civil liberties As if they were mutually exclusive objectives on opposite sides of the scale And if you just took away from one you'd add to the other and vice versa When in fact they are mutually reinforcing We all understand that that security is an essential framework within within which to protect our civil liberties But it is equally true that civil liberties really are a great source of our national security Obviously a source of our strength, but important for national security, and we've heard some specifics about that today The secretary this morning talked about 80 percent of the homegrown or or plots inside the United States We're thwarted by local officials and and citizens that Flow of information up to the feds is based on a sense of trust That the information will be handled appropriately that individuals will be dealt with fairly that System to preserve civil liberties is an essential part of that national security structure the relationship with communities that are going to detect Problems can only be maintained if we preserve civil liberties And and I know that this is what the framers had in mind because this was a group who put together this system to preserve Civil liberties and a system of checks and balances not a fuzzy headed liberals But a very hard-nosed pragmatic individuals who had just fought a war who knew the perilous times were ahead Who were choosing a system they thought would be best guaranteed to preserve this very fragile nation? Chief linear it seems like a perfect place for you to jump in well, you know, it's a lot of questions have come up about local law enforcement's integration into this information sharing environment and how They will factor in the civil liberties civil rights and privacy issues But the reality is is that that's integrated into our everyday operations. We deal with The most critical balances of civil liberties and privacy and civil rights every day think about my average day pre-911 we deal with gang violence identifying gang members validating gang members striking that balance between intelligence gathering criminal predicate to Store information and use information in a criminal prosecution everything from you know dealing with large protests that come to this city and Doing threat assessments that may be posed because of those large protests all those things are deeply rooted in making sure we have good privacy policies We have good management of those policies and that there's oversight for those things The critical thing here is that the stakes are much higher. I mean, that's the difference Well, I think we have a real good understanding of making sure we have that transparency the community outreach Having the connection to our community and that they trust the that law enforcement is a legitimate Partner in this in this fight. So What's most important for us now going forward into this information sharing environment post 911 is that we don't lose that legitimacy We have to remain transparent. We have to be part of this fight I think even more so in the past few years as the internal threat inside of the United States has grown So we take that very seriously and I think as partners in this Integration going forward with the information sharing environment We have to really make that our priority because when we lose that legitimacy I mean think about it after all our source of information Our best defense is the community if we alienate those sources We lose the ability to detect deter and prevent so we deal with that every day. That's how we close homicides That's how we stop gang violence So we value that relationship and we just have to make sure that that stays a priority going forward Administrator pistol if anybody's been on the hot seat on this whole issue of privacy and civil liberties. It's you So we've enjoyed watching It's so So give us your Obviously being the head of TSA gives a person the opportunity to hear a lot of different opinions on the proper balance between Security and privacy and obviously with the creation of TSA November of 01 two months after 9-eleven The focus has been and will continue to be on the best possible most effective security Provided in the most efficient way Recognizing that we have to and strive to every time that we encounter a passenger 1.8 million plus times a day that we respect the privacy and civil liberties of each of those passengers now the the challenge is that each Person in this room and watching has perhaps a slightly different definition of what that proper balance is So for you something may be completely appropriate and and necessary For security and for somebody traveling with you. They may say that's way too far I don't want to go through one of those machines I don't want to be patted down and so how do we give the highest level of confidence to the traveling public on? every air flight every flight 70,000 17,000 plus flights a day in the US over 50 million people a month You know just big big numbers you think of a business that encounters that many people and customer satisfaction surveys to be in the high 90% is Significant so based on things that we deal with we try to ensure that we are doing everything we can There's two things I would highlight That we are doing have done or will be doing that highlight the privacy civil liberties aspects one is our conversion of the advanced imaging technology machines to the automatic target recognition which just gives a generic outline of a person and The passengers able to see that right there some of you have been through that and see that Identifies an anomaly for resolution I'm pleased to announce today the our acquisition of 300 more of those machines And so those will be deployed Airports that you travel through in the in the next several months and so that will increase the number of those machines to give us that best possible security against the Nonmetallic type device the bomb that we saw on Christmas Day o9 with the highest level privacy possible That's one the other issue that we're dealing with is part of our risk-based security initiative where we're trying to get away from the one-size-fits-all construct and Recognizing that as we can get information from people on a voluntary basis That we can then perhaps provide a different level of physical screening because we know more from the intelligence perspective So intelligence is driving what we're doing on the front end so we can do the physical screening perhaps in an expedited way Again, that's all voluntary if people want to share information with us at this at this first iteration It will be through frequent flyer elite programs in certain airports We'll be rolling that out next month in four airports. And so we had the opportunity to do some things that recognize we can provide the Best possible security in the most efficient way recognizing the prives and civil liberties of all passengers Let me follow up on the imaging machines, which have been so controversial. I thought you might yes, well I was hoping you would we've been through this Okay, just show of hands. Have you been through an advanced engine technology machine? Okay, okay? I want to see this show if you've refused to go through a body imaging machine Am I alone two of us? My question Has to do with the fact that you've changed the machines now you've changed this software So you're not showing the anatomical detail. Is that an admission the TSA got it wrong? I think it's a recognition that we could do better So the first the technology No, just being very very frank that that the technology that was in place Had all the privacy protections for that type of technology that could be in place So a separate separate room with an image operator seeing the image never saw the passenger The security officer saw the passenger never saw the image So and the machines had did not have the capability to to store or transmit the images So as as good a privacy protections could be built in for that technology were in place This is the next generation if you will that gets away from that Outline of a specific person to that simply of a generic outline of person Which again in complete transparency the passenger can see right there and they can say oh Yeah, I forgot I left a card in in my pocket or whatever it may be I'll let you off the hook for now, Suzanne I wanted to follow up on something you said about this isn't a zero-sum game That you can have both privacy and security at the same time But in the last couple of days a couple of developments an appeals court ruled against the Justice Department when it came to tracking individuals with cell phones and also you had an AP poll that came out showing that a majority of Americans if they had to choose between security and civil liberties a Small majority would choose not to give up their civil liberties What I'm wondering is if ten years after 9-eleven We're seeing something of a backlash something of a Rethinking of this issue and does that pose security challenges it challenges or is that something we can and should embrace? Well, it's interesting. I think it is. I think it does reflect that the ground is starting to shift beneath our feet And I will say that it worries me as somebody who's spent many years in the intelligence community Both at CIA and then in the oversight and on various commissions For my colleagues in the national security world who are out there running full steam ahead under us under a certain understanding about what America is asking of them And I've seen this happen before and they don't quite realize that the ground is starting to shift And and when something goes wrong What the reaction will be back back home where the level of fear has been reduced Where we are we are hoping to move to a place where we can put terrorism in a in a different kind of perspective So I think the court's decision On geo location, which was a saying you know a long term watching every single place Someone goes is different than simply either following them or putting a tracking device on for a day It's a difference between a day in the life and the daily life of a person And I think it has implications for the way the government currently accesses third-party records And and the understandings there about With regard to privacy interests where I think a difference in quantity is becoming a difference in kind Maddelson, let me ask you Stewart Baker former official of the Department of Homeland Security argues that privacy campaigners have actually undercut security do you agree with that Well, I know Stewart Stewart preceded me at some point as a general counsel at NSA No, I I think that along with what Suzanne said that We need to see that that that privacy interests are and and I think this is the same thing that you said chief you know the being transparent and and adhering Strictly to the letter in spirit of the Constitution and the laws that governor activities actually builds confidence in what we're doing It allows the people who provide us information whether that's people on the street other agencies to Be confident that that information is going to be handled appropriately. So I actually think that that's a that that commitment Is a strength and actually it has the potential and does in fact Bolster national security. I think that this the trick and the challenge at times is to Again, I think this is along with what you're saying Suzanne is to know where the lines are and the challenge in the intelligence community is to Those line lines are sometimes blurry and the laws change and view shift and what I see is what Suzanne identified That's very important for operators to have clear rules and when we have clear rules We follow those rules, but you're operating in a clandestine environment So how do you reassure the American public that those rules are in place and those rules are being observed? It's a great question. You know, it's a much of what we do is secret by design and needs to be secret and so there we we have institutions and processes in place to ensure that That those rules are being followed in to give the American people the confidence and trust they they must have in their Intelligence community and that's typically and primarily Congress and the congressional oversight committees. They do that job And they do that job quite well But in addition to that there is you know within the executive branch I can speak to the role that the Department of Justice plays in providing that kind of oversight of the intelligence community So I think there's actually strong and vigorous oversight Although not the same because again as another context because of the secret nature of much of what happens in the intelligence community you know general Hayden set the table for this discussion beautifully and talked a little bit about the domestic threat requiring this integration of information from the federal down to the local level and he said that that there Boundaries that are part of our DNA Chief linear I'm wondering if you could talk a little bit about that about whether it is in fact harder perhaps to integrate all this Information and intelligence from the federal to the local and back up again because of those boundaries What kind of impediments are there to true information sharing? Well first there's there's two different I was listening to Matt talk and there's there's two different types of Privacy and civil rights issues that we have to deal with now Post 9-11 and to a certain extent before 9-11 the first is the physical security That's the you know setting up the machine that's going to make everybody go nuts trying to screen people going through the airport You can do some things to to lessen that by doing outreach and bringing in a small group of civil libertarians Have them you demonstrate the machine up front get their feedback up front before you launch it And so you can get input on physical security after the WTO riots in 1999 we had our first big World Bank conference here We went from security fencing that was bike rack to concrete Jersey barriers, and you know, but we had to go in And do outreach to the community and we met with you know parking lot Attendance and owners and we got them to agree to security measures So it went smoothly and we did checkpoints and searches and all that That normally would not go over very well But because we had time to bring the community in and get their input it worked well with intelligence It's very different. It's so much harder to go out and get that buy-in It's impossible to go out and get that buy-in from the community But now my job in the local level is to get that buy-in from the community because I have see something say something I've got I'm launching a major I watch program today when I leave here so I have to have some way to bring the community in to get that information and Assure them that what is pushed up into the federal Shared space of the intelligence community is something that doesn't infringe upon the right so in other words I'm not an agent for the CIA Well, let's talk about the New York police department, which I figured you would As you may know the Associated Press has recently reported that there was a very close relationship between the CIA and the NYPD and that The CIA is training some NYPD personnel that there is CIA personnel at NYPD headquarters And it's raised a lot of questions about the balance between spying and policing Is this problematic for someone like yourself you say you want to build a close relationship with a community but if a police organization has a component that is going into a community and Operating covertly going even into Moss according to this AP report. Does that exactly undermine what you're trying to do? Well, I'm gonna stay away from commenting specifically on NYPD because that's just a smart thing to do but I Will say that you know, we've always operated on a principle that they're Investing intelligence is a process that is We get tip information or source information. We begin to investigate that And if we develop a criminal predicate then the investigation kind of moves on and in this case What we're asking of the community is to report to us behaviors not profiles not Personal identifying information to a certain extent. We're asking them to identify behaviors report those to us And if there is no Connection to terrorism and there's no connection to a criminal activity all that personal information is stripped away It's not stored anywhere. We're not keeping dossiers. We don't have a database I think that's the right way to go about doing it because the information that you're gonna get is gonna come from somebody who goes to the mosque and we've had cases like this where Regular participants that go to a religious whether it be a mosque or a Catholic church or whatever say, you know There's there's a person that's behavior is very suspicious and we think you should look into it I think then it's perfectly appropriate to determine whether there's a criminal predicate or there's a terrorism Connection and if so then to move forward, but there has to be an initial analysis There has to be that initial vetting and then pushing that information up if it's counterterrorism related pushing that up to our federal partners And in handling that the right way. That's how you keep people's trust That's how you keep people reporting suspicious activity, and that's how you do it without violating people's rights Suzanne you're the one non-governmental person up here your thoughts on that program as reported by the AP and its implications yeah, well and and and It's hard to know what the facts are here the article itself pointed out that that there was some pushback on on their portrayal of the facts so Like Kathy, I'm gonna be careful about Assuming the facts in it, you know that have been put out there, but I do think you know We heard this morning how important it is To have that seamless relationship Clearly some of the training it seems to me is not inappropriate the thing that raised You know real red flags in my mind was the assertion that there was somebody still on the CIA payroll who was sitting in Dave Cohen's office as his deputy I think that's you know clearly very troubling in light of the restrictions that we appropriately put on CIA with regard to intelligence collection in this country And and and the assertion that they were that that the other thing that I thought was very troubling Was that the city council was not aware of a lot of the activities that that are going on in NYPD? I do think that the issue of local oversight I think it's raised particularly by the JTTFs But apparently it's also raised by some of the activities of NYPD Making sure that you've got that local oversight by the mayor by the sheriff by the city council is Is critically important Let me segue to a little discussion of fusion centers, which have proliferated around the country and They're engaged in some of this gathering and collating and distribution of information DHS is now tied privacy policies to funding in an effort to To address this very issue that we're discussing today, but is there inconsistency Amongst the fusion centers that also maybe you can tackle that I'm tempted to hand it over to my colleague here So I really don't you know, I really don't have a lot of Yeah, I really don't have a lot of experience with the fusion centers I can speak to it some Because I've been engaged in from the beginning from 2001 in the development of what later became the fusion centers and I think it was a very good move to ensure that Fusion centers do have Privacy policy across the board and there is Pretty consistent guidelines and the Dakota federal regulations for what your privacy policies and what guidelines you should operate in Are there still gaps in that and should there be one single? Kind of consistent privacy policy across all fusion centers. Yeah, probably so There's been some mistakes made by fusion centers I mean, I I run a fusion center, you know in Washington, DC And I can tell you that the evolution that's gone through for fusion centers, you know In the last six or seven years They've come a really really long way and there there has been some mistakes and there will be mistakes But I think you know, you're damned if you're doing a damned if you don't you better be damned for doing in this world And the kind of mistakes you're talking about I'm sorry and the kind of mistakes you're talking the ones that I've seen have been Information that was passed on from one agency to another third-party Information that wasn't approved to be shared or probably wasn't appropriately shared with personal personal identifying information Some information I've seen with regard to protest activity and political affiliations, you know Those are evolutions that local law enforcement Most of the major cities have been through years and years ago But some of the newer fusion centers coming online They're not in a major metropolitan area and haven't been through that evolution that's a learning curve for them So I think the consistent privacy policy and the you know across the board implementation Dakota figure Federal regulations for the all those things are going to be important But we can't throw the baby out the bathwater. There's gonna be mistakes. There's been mistakes but I think the fusion centers are an important part of this network that we have to form for homeland security going forward so You know we just have to be Tolerant and put the effort in as as in the paper that that that was released today Says is we have to put the effort in if there's a if there's a training issue Let's address it if there's a policy issue. Let's address it But let's not throw out something that's eight years in the making that's finally starting to add value You suggested that there are improvements that can be made if you get any specific ideas on how to bring better consistency amongst the centers and make the system work With more attention to privacy and civil liberties. Yeah, I think the I think there needs to be kind of a single Effort a singular effort across the board from the federal agencies because again, this is if you're not in a major metropolitan area You're not in a major city a lot of those Privacy issues are not something you deal with every single day It's a different type of privacy issue the stakes are much higher here. So I think that The intelligence community in the in the federal agencies have to take that on to educate This these fusion centers and make it consistent across the board because where it may be well understood in a one major city It may not be well understood in a state agency that has a lot of rural participants in there So I just think that that has to come out as a consistent policy consistent training Across the board from those who know it who've been doing it for for many many years Something else for you to worry about exactly You know NCTC does this on a much grander stale of course coming through the databases and and collecting the data and and It does give some people the heebie-jeebies to think that there's a big brother all seeing I up there Gathering this data from all kinds of sources Is there anything you can say to reassure people that You're staying in the right lane, and you're not just conducting a drag net sure I mean first of all the NCTC is not a collector in the same way that other intelligence agencies are collectors of information You're an integrator. We were essentially an integrator We obtained information from other agencies other intelligence agencies and law enforcement agencies I mean really NCTC was an outgrowth of one of the key insights post 9-11 that we've all touched on and that is that There there's really shouldn't be this distinction between Law enforcement and intelligence. It doesn't really make sense to information It doesn't really make sense to make that distinction and it doesn't make as much Are there aren't there boundaries shouldn't there be boundaries somewhat between law enforcement and intelligence? Well when it comes to terrorism now, I think the answer is no I think it when it comes to counterterrorism that information that relates to an act of terrorism in the United States is Is no different from intelligence about that about that act or about that threat and we need to be able to put that information together I mean that was one of the key, you know changes to the law post 9-11 That was to take down the wall that existed between Intelligence information and law enforcement nation information that prevented FBI agents from talking to each other one on the national security side one on the law enforcement side So we really I think at NCTC are the sort of embodiment of of that recognition The other aspect is the sort of distinction between foreign and domestic certainly there are laws that apply to Certain types of collection activities when they occur in the United States versus outside the United States But when those laws are followed and then we get that information the key that I think that what the contribution in CTC makes is The ability to look at all that information in one place domestic and foreign But the information we get has been lawfully collected by others we integrate it and then analyze it and then share it civil libertarians have raised the question of redress if you have information about someone in it simply not correct What can they do by it? Well, there's a process for in particular with respect to watch listing for redressing if there's a mistake if someone is Wrongly placed on the watch list and that's happens That is effectively, you know, that's successful hundreds of times a year Profiling one of those words that comes up a lot when we discuss privacy and civil liberties and administrator pistol on that I know in CTC doesn't profile. The chief doesn't profile. I know Suzanne does not but does the TSA Does not profile so yeah, so obviously there's been a lot of talk about the behavior detection office Okay, sure, let's talk about it in regards. Yeah, so the the question about how can we use intelligence in a more Informed fashion to make judgments about each individual looking at the person rather than the prohibited items that that person may carry That's one of the ways we want to go as an organization and trying to be a risk-based intelligence driven organization That being said we have to make sure that we don't profile that we that we use information about the person that they either share Voluntarily through this known trusted travel program that that we're working on with airlines and airports who would provide a dedicated lane That's all voluntary. So if somebody doesn't want to share that information, that's fine They would go through the normal screening process For those other issues, for example, we have a number of behavior detection officers And you've probably read about what we're doing at Boston Logan Airport. Some of you have been through there perhaps Had a brief Conversation engagement with a behavior detection officer and assessor The whole purpose is to try to get away from the one-size-fits-all to use what some people describe as an Israeli model That's a that's a very broad brush But to use more information about a person are they exhibiting any suspicious activity in any Cop any law enforcement officer can tell you in just a few seconds really of talking to somebody is there something up about that person? So the whole idea is to take that information and use it in an informed way and to if feasible to extradite that person's screening or Do we need some follow-up questions? So that's the whole premise behind it as we Move forward with that if we'll see do we need to recalibrate do we need to make sure I got to jump it on the Jump thing for just a second because you know profiling became a dirty word because of issues in local law enforcement So I but I have to say that It's not necessarily a negative thing if profiling is looked at appropriately and done the right way the drug courier profile Mass transit for many many years was very successful. You know person pays cash for a one-way ticket no luggage It just is identified something that is an anomaly that was consistent with drug courier profiles It didn't make reference to race or you know any of the things that are associated with negative profiling So I think you again you can't throw out the baby the bath water here There are some positive ways to profile behaviors to profile other things other than Physical characteristics that can help you decide if there's a more intensive look that needs to be taken So I think just the whole concept of profiling all being negative is a bad way to look at it We're getting some great questions in from the audience. There are cards if you've got questions send them in I'm gonna start using some of these because they're good Chief linear one of these is a follow-up to something you said about discarding information if you don't find a link You don't find anything detrimental This question asked don't you run the risk of later finding it was one of several warning Indicators in other words could there be a case where several early indicators might really prove to be valid later Should we retain the data should it be shared? Well, the rules are the the rules are pretty complicated But the if you're retaining anything it has to be separated. It has to be kept separately. It's not access It's not shared. I think it all depends on what the if it's suspicious activity reporting behavior Information we do this all the time now and this is a current battle that I'm facing with hate crimes reporting Tracking hate incidents versus hate crimes There's a real demand for me to document incidents where people are Say verbally harassed with hate speech hate speech is not a crime I mean look at von Brun the FBI took a beating on von Brun because he was a known hate monger But he had never crossed the line to anything criminal so you really don't take any action So we have to meet that balance again So my balance is for me to track those incidents without tracking identifying information Because no crime has been committed and then using that as an analytical tool more so than an investigative tool And that's the balance that we have to to strike. So that information is retained in that sense But if we keep anything identifying at all it is separate from anything else And it still has to be purged if there's no criminal product associated and Gina I'm sorry But I do think when we talk about data retention because I've heard this argument for years That you shouldn't throw away any information you ever you ever got because someday it might be relevant to something and I think it is a Reflection of a of a larger problem in this whole arena, which is this chasing the myth of risk elimination Rather than acknowledging that what we're engaged in is an exercise in risk management So it's it's both recognizing that there are national security costs to privacy Incursions so there's some cost there to keeping that data not to mention the potential risk of a cyber Incident in that information becoming public and recognizing that every little thing that you you know that you that you might want to do It is does not mean that you should pursue that and that in fact When you chase that myth of risk elimination you're ignoring risks that you're creating by doing that in other places and Retaining everything May may make you feel you've eliminated the risk that you won't have that information when you need it But you've created a risk of Public backlash and of exposure and I'm glad Suzanne mentioned that because that's the whole approach that we in TSA Are taking in terms of ensuring that we are doing the best possible job to mitigate to manage risk But not to eliminate risk if we if we truly want to eliminate risk We would have at least two hour lines in every airport Worldwide global supply chain cargo would be shut down Weeks at a time so the whole you still wouldn't have a little and we still wouldn't have that So so the reality is that we are in the risk mitigation risk management business With the traveling public with airlines with everybody in the mass transit area You mentioned cyber. Let me turn a corner there if I could The systems in which you store all this information. How safe are they every day? We read about another incursion into a government database by a foreign entity Well, you know, I think there's there's reason to be concerned about the security of all this information From a cyber perspective I don't think you can hardly pick up the newspaper and not read about Some sort of cyber intrusion whether at a government agency or or a company So I think there's real reason to be concerned and I know that there's lots of effort being put into Two ways to try to protect that information And if I could just actually go back to a point on the retention because I just as I think about retention is an issue We're and it's a balance as I think we've all tried to make that point how long you keep this data But retention is only one part of a broader Set of controls that you can place on information in order to protect privacy and civil liberties And it's and it's a it's sort of an end-to-end sort of set of procedures and systems So you control access you control who can access the information you make sure they have training You make sure that if they do access access that information you can audit it then you control how long you retain it But you also control how you disseminate it who you can disseminate it to so retention I just want to make the point and that I've seen this in NCT See it's certainly true at other other places. I've worked NSA in particular Very very strict controls from beginning to end on how that is handled Security isn't the only challenge posed by cyber general Hayden said a short time ago That he didn't believe we had any reasonable sense of what privacy really is in cyberspace How do we grapple with that one? Who wants to jump into that? Tough one Suzanne. Well, I do think our our concept of privacy is evolving And so it is hard to figure out where those tripwires are I disagree with those who say that that that young people today have no sense of privacy certainly we've seen there are tripwires and And when Google or Yahoo, you know steps over the line that the community rises with one voice and beats them back very effectively So there there is a sense of wanting to control your information even if that doesn't mean you're trying to keep it secret I think it's a growing recognition on some level that keeping secrets in today's world is a losing proposition But perhaps trying to control what others can do with your information Is the next stage and what about the question of surveillance and how much I was just gonna say technology is a next issue They're the technology that's available now is gonna take, you know Hundred years of law enforcement case law back to task. I think because of just the availability of technology to better Protect the community having the ability to Quickly locate someone through a cell phone tracking Having it, you know, it was committed a homicide and and has a victim's cell phone having the license plate reader system Having automated speed enforcement digital cameras. I mean, there's a whole world of I think we're gonna see them in the cell phone It's just the first one. There's a whole world of issues They're gonna have to be redefined legally because of technology. Well, where in a general way I just think we have to accept the the idea that Things are changing very fast and it will always be the case I believe that the law is gonna lag behind Technology and our adversaries so we see that in a number of contexts The the adversaries is changing faster than the law and technology is changing So the law is gonna tend to lag behind and law enforcement has asked for some new capabilities They'd like to be able to tap in to internet communications Polling indicates that that's one place where Americans are uncomfortable when we're talking about emails between two American citizens Who draws the limits? How do we draw the limits? Is that just unlegislatively? Is this something that's going to be a long out litigation in the courts? No, well the the law is pretty well settled and pretty clear on how to obtain a warrant to Listen into someone's conversations or read their emails on so on on a lot of phone communications But doesn't the technology of the internet pose a different a different scenario? I think the law actually applies pretty well in that and that's a thing as well. I will That's the standard. I'll tell you that right now because that the community will drive what happens with the law They're the ones that will set the standard if if What currently is being done is not acceptable to the community. They will fight to have that Moderated somehow and and right now. I think that balances the community wants us to keep them safe At the same time keep their privacy and that balances where we end up with the laws that we have now Suzanne well, I think that the the law is pretty clear with regard to real-time communication It's a little less clear with regard to stored emails for example And it's even less clear with regard to all kinds of online activities And so I think there is some room for going back and looking at those laws and and and the community can only drive that process to the extent the community is informed and Transparency is a real challenge and incredibly important here One of our audience members asks if potential illegal activities are discovered through social media sites such as Facebook or Twitter Is this an invasion of privacy not being a lawyer? I'll punt it to you guys So John's a lawyer Yeah, I got out of that business about 30 years ago Well, it really is very context-dependent. It's a hard question to answer and it does depend on Very much on why this is a hard issue. That's our issue I mean, but some things are public on the internet and can be reviewed with very little Matters there is left for Facebook and in my space and all those other things and YouTube for that matter if it's put into a public domain without any privacy restrictions or security restrictions set by the Poster so in other words on my Facebook page if I post something that anybody who goes to my Facebook page can see It's it's like on the public street Correct So if I then have security measures in place so that some of the things I post are just for people that are Friends in my network and then the government intrudes beyond that then you start to cross that line But I think there's a there's an element of what is the expectation of privacy in the social media For what is posted publicly and what is posted behind security measures that we break through And there's also at least there used to be when I was in the intelligence community the issue of undisclosed participation so if you're participating in what is a you know relatively public Conversation where you don't have to reveal who you are or what your affinity your affinity is that that's one thing But if you're then pretending to be someone other than somebody from CIA that presents a different issue Another audience member has posed a question here they posted I think better than I did it had to do with that quote about from General Hayden about the reasonable expectation of privacy and what constitutes that on the internet this audience member asks What specific challenges does technology and easy government access to so much electronic data posed to American civil liberties and how Should we address it? So, you know speech like I'll take I'll take a little bit of a stab at it because I think it is a big and complex question, but I do think that Creating a sense that the government is out there Watching and listening in a very broad way Really does again goes back to my point of undermining our national security to the extent that it breaks down a sense of trust That it chills Conversations and activity that is perfectly legitimate Because I think we derive a great deal of our strength from that marketplace of ideas from you know I mean there are real national security costs to chilling legitimate activity so so I think there are some National security consequences to the government's ability through the use of technology to for each and every one of us to know Intimate details of our day-to-day lives from moment to moment because of Technology and the ability to access records surveillance, etc And I think we do you think about that let's just make sure we're all Working for the same framework though in terms of Matt alluded to it earlier in terms of for the government whether It's the FBI on the domestic side in a criminal investigation or through the foreign intelligence surveillance court on the the intelligence the counterterrorism side Obviously you have to have probable cause that the communicants are talking about something that is Violent of a federal law whether it's counterterrorism or criminal and that probable cause has to be proven to Either the district court judge federal district court judge or the FISA court judge and that judge has to approve that and so there Is a rigorous review of that whole process before the government intercepts communications whether phone email Whatever it may be it's those other areas where you're talking about yeah What is the expectation privacy on a Facebook post if it's if it's something that that you want just your friends to see or otherwise So that's that's where there's questions everybody and there's maybe some in this in the audience who? monitor Let's say jihadist websites on their own and then may report that to MPD or the FBI or CIA and so if that person's not acting as an agent of the government then the question comes can that be used and How so so there are rigorous protocols and rules in place So it's not just like the government's out there doing all these things But we don't have rules really we don't the ground we haven't yet figured out the geo location for example Across the spectrum from the you know after an incident all the way through to Putting something on somebody's car for a week or two weeks or a month And so I think there are areas where where we haven't yet quite figured out what where the lines are But in some ways I do think that that on that makes the point that there are some areas that are gray areas that are that are Evolving in that case in there's a DC case involving the geolocation and and I was a prosecutor in DC for many years working with the Metropolitan Police Department and there was the general view that a Tracking device on a car over a short period of time didn't require a probable cause right now You know so now we're in a new area that in the DC circuit is Issue this opinion but but the point I think that John makes is a really important one and that is that that this idea of sort of widespread government surveillance outside of the rubric of of judicial and congressional oversight is not an accurate picture at all when it comes to surveillance of phone conversations involving us persons that's done with orders given provided by the files of court based on a very rigorous review procedure and and at the end What must be established is the same standard that's required to for someone in the Metropolitan Police Department to get a search warrant And that's probable cause So it's a very very rigorous process to get the kind of Approval that's needed to conduct the sort of surveillance of communications at that question You know and even in that case a lot of people realize that even that case through abundance of caution the detectives got a warrant It was the timeline that was the issue. They actually without I mean they went and had a judicial review and got a warrant for the Tracking it was the timeline and how long that the tracking when was placed and how it was on there was the issue so You know just to clarify that a little bit yeah Another question from the audience and this one I think mr. Olson goes to you How do we strike the balance between? Identity identity data requirements to facilitate effective identification of terrorists and being inundated with data Not exactly a privacy question Right, I mean the the issue one of the things that we're doing and I think this is we've tried to step this up at NCTC Following the the failed attack of December 25th 2009 in Detroit is to really enhance our watch listing Information so the information that we already have on identities We've really tried to make an effort to go out and find other sources of data to get as accurate a picture as possible of The identities of the known and suspected terrorists that are then placed on watch lists I mean the I think the question might be asking a little bit about how do we deal with the inundation of data? I mean I think their Technology can help you know better ways to sort through data to make sure that we're separating the week from the chaff I mean that is I think there are improvements in analytical tools that give us more More capabilities in that regard. Let me switch from high-tech to low-tech for a minute chiefs linear You mentioned see something say something This is a campaign that's been embraced and promulgated by the Department of Homeland Security Encouraging citizens if they see something they think is suspicious to report it to authorities civil libertarians Feel the hair going up at the back of their neck over that one And are afraid for instance that you know when angry boyfriends gonna Report that you're doing something nefarious to the local authority. You know that gonna happen today anyway That one me that has always been the people could always do that I mean poison pens or something that have gone on you know people writing in stuff the law enforcement about Other people in the community is has always happened That's not changed by the see something say something. I think the and part of what we're doing With our launch of I watch today gets to what Matt was just talking about is that you know what a flood of information People will report through this tool suspicious behaviors or suspicious activity We have two ways of analyzing that initially when it comes in first of all, you've just added 850,000 local law enforcement to the picture when you add the see something say something campaign So initial information can come in it is looked at through an analytical tool Trap wire and it's also looked at by an analyst and then there's a decision made as to whether this is criminal Counter-terrorism or it's useless. It's it's it's bad information near preliminary investigation that it's it's not Either of those things, but it also gives us the ability to push those Legitimate suspicious behaviors up into a shared space where we can look around the country through the network of fusion centers If there is an increase in suspicious activity or suspicious packages around critical infrastructure So I think the fear that see something say something is encouraging neighbors to spy on neighbors Is something that people could use as a fear long before see something say something? So and I tell you I implemented several things to fight crime in the city And in much to the opposition of many of the prosecutors anonymous tip lines I have anonymous tip lines and anonymous text messaging lines Our standards are very high once we get that anonymous information in as to how we vet verify and investigate that anonymous information But as long as you have good policies and good management and good supervision and you do that the right way That's been very very successful for us So I think that's really going to be the key is making sure that these things are managed the right way And they are focused specifically on behaviors This is we're coming up in the 10th anniversary of 9-11 of course in the 9-11 Commissioners recently issued a report card on what they saw as some of the successes and failures of their recommendations One they talked about was the privacy and civil liberties oversight board, which is dormant And Lee Hamilton one of the leaders of the 9-11 Commission called that a major disappointment Why is it dormant does it reflect that privacy and civil liberties? Just isn't a priority Suzanne you want to take a stab at that No, I think John Brennan addressed that I think they've had a very hard time You know filling the chair position I you know it does Raise a question about whether it's been high enough on the priority list has it You know, I'm not inside so I don't know where it is on the priority list But it seems it's very it's very frustrating and very disappointing that this many years into the administration They have been unable to fill those positions. I think it's a very important Role and an important body and and they need to have somebody in there who has real credibility With civil liberties folks, how would it make a difference and what's happening in the interim? Ideally what you would have is is then this this body of individuals That are there when that when these policies and measures are being discussed from the outset You know, there's been a lot of talk about this and it's reflected in the port not not tacking these things on at the end But but baked in so they're there they understand the imperatives On both sides of this issue and and and are there to help you formulate your policies And then they are in a position to be validators for you and in this area where we have so much secrecy You know, it is like the oversight committee is important to have credible voices who can come out and say I'm on the inside. I know all about this and I'm comfortable that that we're doing this the right way So I think it's I think it's really important benefit for the administration And I'm not sure everybody in the administration Fully appreciates the degree to which it could be really helpful and I can give personal example from the agency and departmental level Where we have very strong civil liberties privacy oversight as we try to move to more of a risk-based Intelligence driven so how do we use that intelligence? What intelligence can we use? How long do we attain data things like that and Mary Ellen Callahan from the department is here Margot Schlinger also In terms of privacy and we've been through a recent Initiative with very strong oversight in review and great feedback as to okay If you want to do this, here's what you need to do And we also have a very strong privacy officer with NTSA to address those issues So at least at the department agency level I see that working very strongly. Is there a need though for harmonization across the federal government? Oh, I think so clearly and that's the reason the Commission made a recommendation to get that position filled. I want to take one more audience question here Matt Olson this one's for you. How do you ensure that the appropriate federal agency is involved at the local level? This person raises the reports about the CIA and NYPD Are they the appropriate people to be interfacing with the NYPD or should it be the FBI? Did someone overstep and who was it? Yeah, well from NCTC's perspective. We we work with FBI and DHS in our interaction with Chief linear and the state and local agencies and I mentioned before we have an organization that helps us write things that then get Downgraded and sent out to state and local police officers I would say so I really from my perspective It's FBI and DHS and going back to something you said chief that you know having having been a prosecutor You know the level of intelligence that police officers on the street produce every day both From information they're getting from the street But also from the criminal justice system that the the level of intelligence that's generated out of the criminal justice system is Pretty phenomenal. There's almost not a murder in DC You couldn't go to the police officer on the beat and say who do you think might have been involved? It's a long way to get from that to evidence in a criminal case But it's very important to realize that what you're doing is intelligence on the street Suzanne when we had a conversation before this panel began You talked to me about the concept that the American public owns this government and as the owners of the government They should know what's happening inside it I can tell you as a reporter our efforts to find out what's happening inside the federal government have frequently been thwarted by We're told that information for instance is SSI and can't be released Is there over classification and is that? hurting This transparency that we're talking about so much I don't think there's any question that there's over classification. I don't think there's any disagreement about that There may be some disagreement about the degree But there's no question that we have a system that but that that classifies by default and as a result we have You know over classification. I think more fundamentally We have too much classification and not enough transparency that is premised on again this illusion that somehow we really can keep this information secret and And given the counterintelligence challenge we face today My worry is that the we're not keeping it secret from our adversaries We're only keeping it secret from the American public and from others who could help us and would benefit by getting that information Clearly one of the big challenges in the necessary cooperation with at the state and local level and with the private sector is classification and the answer to my mind is not Giving out more clearances and bringing more and more people under that classification Tent if Dana Priest is right and we have almost 850,000 people with clearances That's a lot of people with access to your deepest and darkest secrets potentially so that's not true I mean there are 800,000 people with access to the deepest and darkest secrets Give us the real number. Well, no, it's just an exaggeration. It's just an exaggeration to bring those terms But I do think but I do think that the the point really is that we need to find ways to get that information As was said earlier today to be releasable Rather than continue to classify and try to get and solve the sharing problem by giving more and more people clearances Seems to me. That's not the right way I'm trying to stay in my TSA lane, but with almost 27 years of FBI Be wild just a discussion. So one of the one of the key changes in the FBI post 9-11 is on the information sharing and The whole idea of of going from fairly restrictive sharing not necessarily based on classification But just on need you know typically evidence for criminal prosecution killer So the question became then how can the Bureau change to deal with the new reality of the integration? And it really became there's people in the room Partially responsible of that but shared by rule with whole by exception on a need to know basis So as many people as needed to know that information was pushed out to but the key became did they actually need to know? And so as to your SSI point the the question becomes an Individual Intel product or an SSI document in of itself may not reveal any deep dark secrets When you compile of those in a way that can form a picture of let's say security checkpoint capabilities Detection capabilities. Well, we know that bad guys look at the TSA website For example look at manufacturers websites to say what are those detection capabilities? And can they go to school on that to come up with a new type of device that defeats those capabilities? So so yes, that is important, but that need to know is is still part of that equation Matt, do you want to weigh in on that? I just I agree with that I mean, I think that there's There's a need to classify a lot of the information that we're talking about in terms of protecting sources and methods and it's important to Acknowledge the the role that that classification plays in protecting the the ways that we are able to obtain information or Or when it goes back to the last few terrorist attacks think about some of the information You could almost surveil a target and get all the information you need to carry out attack through You know the internet all public information. So what is it that you can withhold? That's reasonable to withhold to you know increase security or make sure you maintain some security I mean almost every exercise we do will red sell an event or a site and we red sell it all on the computer It's all news clippings and public information that you can pull off of public sites So where do you draw the line on what you can release and how that gets put out there? Can we use against you so and one of the one of the things I think is really important that is part of this whole conversation is the effort to take intelligence information counterterrorism information and Push it out DHS and FBI do this at an unclassified Level so that state and local police officers and departments can use that information to have a better idea What to be on the lookout for and the more you can Declassify unclassified not classify Information and shrink the universe of information that you're really trying to keep secret the better The better your chance you're gonna have of keeping that really sensitive information secret You said Suzanne early on that this isn't a zero-sum game that you can have both you can't always have both though Can you I mean we can't sugarcoat this and say Yes, embrace transparency in every instance and it's not the point is not that they don't come into tension on occasion the point is that you have to recognize the national security costs of Privacy intrusions of intrusions on civil liberties of weakening the system of checks and balances which are of Failing to have adequate transparency that that that that that that they are in and of themselves Important elements of national security and so if you when you have this tension It's not national security over here and these other things over here. It is how do we? Manage these risks in a way that maximizes national security and in some cases that's going to be maximizing the protection for civil liberties and privacy Because there are national security costs to failing to do that So it's not just we need to do both and it's nice to try to do both and they never run into Detention it's recognized the national security costs of failing to deal with that. What are those costs? Can you be more so again? I think that I think the folks who are on the front line fight in this every day have been very eloquent particularly chief linear about the cost of Undermining the trust that you absolutely must have With your communities and then between the state and local and the federal level that I think that's one of the you know Very fundamental ways in which that's a national security cost someone earlier Ozzie from CSIS made the Comment earlier today about the most important thing that their study concluded was that we need to not fuel The the terrorist rhetoric the narrative that allows them to recruit and that is that the US is at war with Islam Well, that's a that means there are very real national security costs to the measures We might take that would perpetuate or allow terrorists to claim that this is targeting This is profiling Muslims that increase a sense of alienation from from the rest of society that that make them feel as though they're unfairly targeted That's not just us a civil liberty value. Although it is in and of itself. It is a national security imperative Does the polling data that I referred to at the beginning that people right now are more interested in preserving Civil liberties than securing the country does that indicate that we haven't got it right yet? What do you think I? Think it's fascinating and I I would I want to read the question Senator Warner raised some questions about exactly what what did that reflect? I think it's encouraging my sense my sense is having watched these polls over the years This is the first time that we've seen that number. I think over 50% And and I actually think it's I think it's encouraging and worrisome at all to those of you on the enforcement side It's not worrisome to me. I you know, I think it's I think Susan put it well I think We need to continue to work at this and it and it's a very dynamic environment and those polling numbers could change I think we need to also realize that it could change especially if something something happens exactly and and so I think our way it's not incumbent on us as as leaders in this community to try to give Guidance and direction to the people that that work around us and to and to be as clear as possible about the rules again My experience has been at justice at NSA and out NCTC that the people on the front line want to know what the rules are They are committed to following the rules It's just sometimes hard in a very dynamic and fast-changing environment to know exactly what the law is on a particular time or day And so and when what the poll the polls are even more fickle So I think our our responsibility is to is to be leaders and to be of direction and guidance and and but the bottom line is people Are trying very hard to follow those rules and that sounds like the perfect place to wrap it up Thank you very much to Matt Olson John pistol Kathy Lanier and Suzanne spaulding to insidious CSIS for letting us have this discussion and for all of you for listening and for your input with your questions. Thank you