Former top NSA lawyer wants new domestic surveillance authority to improve cybersecurity

A former top U.S. National Security Agency lawyer is advocating for new domestic surveillance authorities to improve the country’s cybersecurity.

The proposal for an expanded domestic surveillance regime from former NSA general counsel Glenn S. Gerstell, who left the agency in 2019, comes as questions remain about how the new cyber leadership of the Biden administration will look to overhaul cybersecurity policy.

NSA and Cyber Command have responsibility for signals intelligence collection and offensive cyber operations abroad. President Biden has selected several former NSA officials for leading cybersecurity roles in his administration, including serving as the nation’s first national cyber director, as head of the Cybersecurity and Infrastructure Security Agency, and as the deputy national security adviser for cyber and emerging technology.

Whether the officials set to take charge of domestic cybersecurity want the authority to function at home the way their former agency does abroad remains to be determined. Their former colleague Mr. Gerstell, however, wrote that he thinks a new legal framework is needed to combat foreign hackers from exploiting what he views as a “gap” in America’s cyber-surveillance system.

“For important legal and organizational reasons, we’ve had a long-standing and sharp delineation of governmental responsibilities for keeping tabs on foreign versus domestic cyber activity. That arrangement, however, isn’t effective when it comes to tracking wrongdoing unconstrained by national boundaries,” Mr. Gerstell wrote in a Politico op-ed. “Designed to protect the civil liberties guaranteed to Americans by the U.S. Constitution, the system is now deliberately exploited by sophisticated foreign cyber adversaries.”

Under a sample of what new legal authorities for domestic monitoring and inspection could look like, Mr. Gerstell wrote that such monitoring should be limited in time and ought to be constrained for government use only in furtherance of cybersecurity policy. If domestic snooping on Americans turns up something untoward that does not include evidence of a federal crime, the government would simply delete the data of its discovery in Mr. Gerstell’s framework.

Intelligence community officials, for their part, do not appear eager to request, or take control of, new domestic surveillance authorities. At a Senate Intelligence Committee hearing last week with the heads of the CIA, FBI, NSA, Defense Intelligence Agency and the Office of the Director of National Intelligence, Sen. Kirsten Gillibrand was disappointed the government did not want more domestic monitoring authorities.

“I don’t like hearing that we have blind spots, so I’d like a little more analysis about if there are other authorities that are needed and I’ve heard you all say you don’t need other authorities but I guess I’m not willing to accept that we are going to have blind spots,” said Ms. Gillibrand, New York Democrat. “I think there has to be an appropriate way to give the tools that our intelligence community needs to be able to constantly protect against cyber threat, cyber terrorism, and cyberattack.”

Gen. Paul Nakasone, commander of U.S. Cyber Command and the NSA, replied that foreign adversaries realize the time it takes for the federal government to get a warrant and look to conduct cyber operations during that window of opportunity.

Despite knowing that foreign adversaries look to exploit such potential gaps, Gen. Nakasone made it clear the NSA was not asking to change laws regarding domestic monitoring.

“It’s not that we are looking for authorities for the National Security Agency, it’s let’s make sure that we identify what’s taking place so the appropriate measures can be undertaken,” he said.

Mr. Gerstell also wrote that his proposal was not the single resolution to the cyber problems facing the country.

“This proposal is by no means the only solution, it’s merely one way to balance the need for more cyber visibility while preserving our constitutional freedoms,” Mr. Gerstell said. “After all, the Constitution is designed to protect our liberties, not to provide authoritarian regimes with no use for such liberties a means to exploit our vital online systems with virtual impunity.”