I tell our people constantly we’ve got to focus on the next attack, let’s anticipate the next attack as well as learn the lessons from the last attack. -Jeh Johnson, Secretary of Homeland Security
As promised, here is the second part of my analysis of the recent Aspen Security Forum. Jeh Johnson who heads up the Department of Homeland Security (DHS), the third largest government cabinet, opened up the conference in a session moderated by Thom Shanker from the New York Times. DHS has a wide portfolio that includes FEMA, TSA, border security, the Secret Service, the U.S. Coast Guard, cyber security, and counterterrorism. As expected, most of the questions and discussions revolved around counterterrorism.
Secretary Johnson focused on the evolving nature of the terrorism threat, what we need to do in response, and the need for resiliency. He began by pointing out that during his time in the current administration he has seen the terrorist threat evolve from terrorist directed threats mainly from al-Qaeda, and its affiliates in Yemen and Somalia (AQAP and al-Qaeda elements of al-Shabaab).
“Now we see not only the rise of ISIL (also known as ISIS) but the rise of the terrorist—inspired attack where the operative may not have met a single other member of the terrorist organization that he is inspired by, may never have trained with the organization, have never been to Iraq, Syria, and is—may not have ever received a direct order from a terrorist leader, but is inspired by something in social media, on the Internet, to go commit an attack.”
Our response to the threat during the first Obama administration was to “take the fight to the enemy overseas in places like Yemen and Somalia, get them before they can get us, get them before they can put on the suicide vest and go to the next airport and try to get on an airplane to come here.”
This latest iteration of the terrorist threat is a much more complex one is harder to detect by law enforcement and requires a whole of government approach. He briefly outlined some of the successes of this approach, taking back territory ISIS holds, and degrading their communications and ability to finance their operations. He also spoke to areas DHS was working on to improve.
“We have added security around our Visa Waiver Program. We’re building the capability to monitor the travel of individuals of suspicion from overseas into the United States. I want to add to our pre-clearance capability at airports overseas where we screen people on the front end rather than when they get here to the one yard line.”
The Secretary also stressed there is a role for the public to play through vigilance and awareness saying they have built upon the “if you see something, say something” campaign and reaching out to the American Muslim community.
When asked by Shanker if there was an increasing risk to the homeland, Secretary Johnson replied:“It should be apparent that when it comes to the homeland, ISIL’s principal objective is to inspire people to stay at home and commit terrorist acts, self-radicalize. For ISIL it’s low cost, low risk versus trying to export somebody through our borders, through our ports of entry, through our airports, through our various different layers of mechanisms to detect an individual of suspicion. Which is why, you know, public vigilance, public awareness, and our law enforcement efforts, and our CVE (Countering Violent Extremism) efforts are so critical.”
The resiliency issue came in when Shanker asked: “What do our political and government leaders have to say to speak truth to the American people without instilling fear but making them more muscular in their resilience?”
Johnson replied: “Two things. One, I think it is incumbent upon us in public office to accurately and fully describe the homeland security threat… But then you have to go on to say—and it is not just scare the crap out of people—tell them what is happening, but then tell them what you’re doing about it and say, and you can help us by public vigilance, public awareness, followed by the message that terrorism cannot prevail if people refuse to be terrorized…
It’s no accident that after the Boston Marathon 2013 something like 50% more runners signed up in 2014. You look at Lower Manhattan now and how it has rebuilt itself; the new Freedom Tower which is taller than the Twin Towers. It is a new New York when you go to Lower Manhattan now. And so we are a resilient country and we do bounce back.”
I believe this is an extremely important topic. In my opinion there is a lack of public understanding of the varied and complex nature of modern day threats. Leading intelligence officials have consistently remarked that this is most national security threats they’ve seen in the last 50 years. Why is this important? If you do not understand the severity of the threat, there is a major danger of not understanding the need or motivations for potential solutions.
It has been my experience that if people have a thorough understanding of the threat and also understand what problems may come about if its not addressed, they will move mountains to help you solve the problem. If not then you are in for what I call Ugly Ops. Case in point: Cyber. John Brennan, the head of CIA, was also at Aspen and made some key points on the topic. He began by outlining the threat environment:
“…the government as well as others have been saying for the past number of years, the capabilities of foreign actors, whether they be nation states, sub-national actors, companies that are working on behalf of governments are able to carry out these cyber activities that can disable, that can destroy, that can manipulate our systems and our networks.
And so therefore, as we’re moving more and more into this Internet of Things where we’re all going to be interconnected, the vulnerabilities that exist are significant and this is the domain where most human activity takes place right now. And so as a country, as a government, as a people, we need to be mindful of the havoc that could be wrought not just in terms of taking down electric grid, but in terms of the potential to manipulate the foundation of our democracy, which is an election.
So we really need to make sure that we as a people agree and reach a consensus on what the government’s role along with the private sector should be to safeguard that environment that holds our security and our prosperity within it. And if we are not able to reach that consensus, I think we are going to be facing these serious challenges and threats.
And that’s why as there was this great debate between a certain law enforcement national agency and a certain private sector organization about encryption that is just symptomatic of the issue that we have to grapple with. What is the right of the government? If we are a country of laws and if rule of law prevails, what should the government be able to do and be able to access in order to protect the welfare of its citizenry?”
He indicated that there seemed to be a sense that the CIA, FBI and NSA wants to read everyone’s email. He called that a “misrepresentation and mischaracterization of what the government is trying to do”. He stressed the need and importance of an honest conversation on the topic. “But let’s do it without the sort of reckless accusations about what the government is trying to do, no. And people say, well, if the U.S. companies are going to be limited in terms of what they can do and has to make it available then, our foreign competitors are going to seize that field.
…the U.S. basically is the predominant country in this digital environment and right now Russia and China are not rules of law. And so, this is a country that firmly believes in the rule of law, otherwise chaos is going to reign. And if we want chaos to reign, okay let the cyber environment go and let the terrorists and the extremists and the criminals and the pedophiles and others have their way in that environment. And I don’t think that’s the world and the country that we want to live in.”
I’ll end with a question I asked Secretary Johnson about cyber. On April 4, 2016, a GAO (Government Accountability Office) report with the title: Civil Support: DOD Needs to Clarify Its Roles and Responsibilities for Defense Support of Civil Authorities during Cyber Incidents. The bottom line was who is in charge in the event of a cyber attack.
My question to Secretary Johnson: “What if ISIS or a nation state takes down the electric grid in five of our major cities? Now I know Homeland Security, Cyber Command, and FBI all have a role. But who would be in charge of—in that scenario?”
He replied: “Couple of things. First, just yesterday the President signed a directive that publicly clarifies the roles of the various components of the U.S. government in cyber security. And basically what this PPD does in a rather clever way is to differentiate between a threat response and an asset response. And it says that for threat responses Federal Law Enforcement is principally responsible, though we’re all in a coordinated way involved. And for asset response the Department of Homeland Security is the lead.
So basically what the PPD does is clarify. There is the cop and there is the firemen. Jim Comey (FBI Director) is the cop and I’m the fireman. So when you want to report the crime, the hack, the threat, you go to Law Enforcement. If you need somebody to help you put out the fire, plug the vulnerability, prevent it from spreading, and root out the bad actor from your systems—the Department of Homeland Security is in the lead.”
He also said DHS has been tasked with writing a national cyber response plan for critical infrastructure within the next 180 days. Critical infrastructure includes things like our financial institutions, power grids, etc.
I will end here. As always my comments are my own. In my next blog entry I will do a deeper dive into what the various speakers, to include the head of the CIA and the Commanding Officer of U.S. Central Command (military commander in charge of wars in Iraq, Afghanistan, and Syria) had to say about terrorism.
