Page 221

influence and the FBI’s warnings about continued efforts through the 2022 midterms highlight the folly of undue certainty without consideration of alternatives.

On election influence and other controversial issues, such as the origin of COVID-19, analysts at the most powerful intelligence agencies have increasingly tended to use the leeway they have been given to insert their political views into their work in order to influence (if possibly even control) the analytic process. They do this in ways that attempt to squash dissent and impair the creation of a culture in which entrenched views are challenged and unpopular analytical lines can survive or not according to their merits.

To help the United States and its leaders to outcompete China across multifaceted societal, economic, military, and technological threats, the IC’s capability to conduct strategic intelligence analysis that is relevant to policymakers in both parties must be rebuilt and strengthened. Because Beijing may be a peer or even exceed U.S. capabilities in some areas, the post-9/11 analytic focus on quick-turnaround secrets is not good enough. Strategic planning—informed by intelligence—must take place for the United States to stay ahead of whatever new threats China may pose.

An incoming conservative President will have the opportunity to signal the demand for such strategic products and prioritize their production through communications to intelligence leaders and formal mechanisms such as shifting priorities within the National Intelligence Priority Framework and structuring the President’s Daily Brief. The incoming DNI should also emphasize implementing the recommendations in the Ombudsman’s report, especially regarding objectivity, the inclusion of dissenting viewpoints, and more serious efforts to hold senior leaders accountable for backchannel attempts to change or suppress analytic views.

Accounting for the long history of intelligence failures and surprises, an incoming conservative President must appreciate the ambiguity, complexity, limits, and assumptions inherent in intelligence assessments. Intelligence often deals with the human dimension in complex decision systems within a foreign country or organization, and this makes consistently accurate predictions difficult if not impossible to develop. Seeing something and understanding what you are seeing are two different things, so a President should consistently and patiently press the IC about its potential biases, assumptions, methodology, and sourcing.

With regard to election-threat analysis and politically controversial topics, agency leaders should take seriously the Ombudsman’s admonition that we need to maintain tradecraft standards across all countries and topics by ensuring that equitable standards apply across all foreign threat actors. Analysis should be put forward without regard to the domestic political ramifications of intelligence conclusions.

“Obligation to Share” and Real-Time Auditing Capability. The federal government has made admirable progress in recent years by being more

— 221—

forward-leaning in sharing cyber threat intelligence with private-sector partners

and the public, emphasizing that the protective nature of such information is of value only if put into the right hands at the right time. Since critical infrastructure

and services are overwhelmingly owned, managed, and defended by the private

sector in the United States, there has been an increasing emphasis on declassifying intelligence and sharing actionable information with private-sector partners, often through industry-specific Information Sharing and Analysis Centers (ISACs);

regional meetings of government and private-sector experts called InfraGard, run

by the FBI; direct public notification from the Department of Homeland Security, the FBI, and (increasingly) the NSA; and more discreet one-on-one engagements

led by the collecting agencies.

These programs properly recognize the private sector’s role in providing cybersecurity for Americans; in practice, however, the intelligence shared by the U.S. government through these venues is too often already known or no longer relevant by the time it makes its way through the downgrade process for sharing. In addition, government-shared information often needs to take advantage of the opportunity to provide contexts, such as attribution, trends, and size of the observed cyber problem. As warranted, additional context should be provided to the private sector as a matter of routine.

To continue improving the U.S. government’s ability to defend the country’s most vital networks, the IC must adopt an “obligation to share” policy process, including the capacity for “write to release” intelligence products whereby newly discovered technical indicators, targeting, and other intelligence relevant to cyber defense are automatically provided either to the public or to targeted entities within 48 hours of their collection—which is how counterterrorism intelligence has been managed for years when it comes to a “duty to warn.” Under this policy, agency heads should still have the flexibility to withhold intelligence for operational or counterintelligence reasons but would need to report regularly to Congress on the number of and justification for exceptions. This policy would make sharing intelligence and defending networks the default, as it already is in the rest of the cybersecurity community outside the IC, to improve the quantity, relevance, and timeliness of defensive information while ensuring accountability for top leaders when they must withhold this information.

One of the most significant challenges within the IC is presented by the need to share information promptly among the 18 elements of the intelligence enterprise. The only long-term solution to the understandable tension between the need to share information and the need to protect intelligence sources and methods is a robust real-time auditing capability that electronically flags unauthorized access. Under an identity management system with real-time audit, even the most sensitive information acquired by America’s intelligence agencies can be shared, and the access to and use of that information are appropriately monitored. Establishing