Former NSA director offers his advice on deterring cyber attacks
To effectively deter cyber aggression from the likes of Russia and other nation-state adversaries, the Trump administration's rhetoric should better match its actions, advises retired Adm. Mike Rogers, who until recently served as director of the National Security Agency and Commander of U.S. Cyber Command, the military's cyber warfare arm.
"If we're doing one thing but saying another, that's not particularly effective," said Rogers, who was nominated by President Obama in 2014 and announced his retirement from the dual role last June. "I think we need to make sure that we're synchronizing between the statements and the actions of our senior-most leadership and the policies that we're developing."
The Trump administration has imposed some of the toughest sanctions in years on top Russian officials and businesses and, unlike the Obama administration, authorized the sale of lethal weapons to Ukraine. Statements President Trump has personally made in praise of Russian President Vladimir Putin, however, have routinely raised questions as to whether Mr. Trump supports his own administration's policies – and whether he believes the conclusions of his own intelligence community.
A 2017 U.S. intelligence assessment found Putin ordered an interference campaign to boost Trump's chances of being elected in 2016, though the president has characterized Putin's denials of Russia's involvement as persuasive, calling them "extremely strong and powerful" after a joint summit in July.
According to a report in the Washington Post, Mr. Trump also put pressure on at least two intelligence officials in his cabinet – including Rogers, who was one of few cabinet-level holdovers from the Obama administration, and Director of National Intelligence Dan Coats – to push back against an ongoing FBI investigation into connections between his campaign and the Russian government.
But in an interview with Intelligence Matters host and CBS News senior national security contributor Michael Morell, Mr. Rogers reiterated what he had told Congress when he was questioned about the report, that he "never felt coerced, intimidated, threatened about having to do something."
"I have never felt that in my time as the director or as the commander," he said, "that I was directed to do something that I believed was illegal, immoral, or unethical. And when there were things that I thought were starting to potentially get close, I said flat out, 'Nope. We're not going down that road.'"
A former Navy cryptologist who spent more than 30 years in the military, Mr. Rogers also said that publicly acknowledging the use of offensive cyber measures – as the Obama administration did regarding a cyber campaign against ISIS in 2016 – could also be an effective deterrent step against adversaries, like Russia, that may attempt to engage in disruptive cyber activity.
"I thought there was value in the United States acknowledging it has cyber capability, acknowledging that in considering what it should do in response to the actions of others, it is prepared to look at a full range of options," Mr. Rogers said of the 2016 decision.
"It's not always the right answer. And just because someone comes at us via cyber doesn't mean we should just respond in kind," he said. "But I thought there was value and believe there's value in publicly acknowledging, 'We are developing a set of capabilities. We will be very measured in how we employ them. We will employ them in a legal framework just as we do kinetic force. But if you engage in these types of behaviors, we are prepared to use this as a potential response tool.'"
The Trump administration has not said publicly whether it has authorized offensive cyber operations against Russia or other targets, though it did issue a new directive in August loosening some restraints on the military's use of cyber weapons.
Though Roger's successor, Gen. Paul Nakasone, reportedly recommended soon after he assumed the roles that the two organizations – the NSA and U.S. Cyber Command – remain under single leadership for at least two years, Rogers said the time to end the dual-hat arrangement may have already arrived.
"As the guy who's actually done it and done it recently, my concern became, 'So how does one individual be one of the ten senior-most commanders in the DOD and run the largest intelligence organization in the U.S. government?'" Rogers said. "'This span of control is pretty significant.'"
He also indicated there were often significant differences between how, in theory, an operational military commander and an intelligence professional would approach a given situation. "Sometimes the level of risk you're willing to run, the level of potential compromise you're will to accept – very different," he said.
He told Morell the technical, security and cultural challenges posed by developments in cyber capabilities writ large were long-term and likely permanent, and that the United States' relative superiority in the cyber realm was far from assured.
"This challenge is going to be foundational to the future," he said. "I can't think of a major nation that is either, number one, not investing in this capability, or two, is decreasing their level of investment. Quite the opposite."
"I see the trend," he said, "and everybody is investing in this."
Rogers also made a direct appeal to the men and women working in the intelligence community. "We're in a tough time right now. We're divided," he said. "And the challenge I always thought for us as intelligence professionals is, we must retain our focus on mission and our values. And we cannot get sucked into those political things."
"I urge every employee, whether you're a civilian or in uniform, you should all exercise your rights. You should all push for what you believe in," he said. "But remember -- we don't do politics."
For more from Michael Morell's conversation with Michael Rogers, you can listen to the new episode and subscribe to Intelligence Matters here.