Inside the CIA's new Digital Directorate

The Central Intelligence Agency took a significant step into the digital age with the official launch of its Directorate for Digital Innovation (DDI), a bureau devoted to giving officers around the world better IT tools to do traditional cloak-and-dagger work.  

The new directorate, the CIA's first in a half century, is a milestone in the agency's quest to modernize its IT systems and further operationalize its cyber capabilities. CIA Director John Brennan announced plans for the directorate, which includes the spy agency's CIO shop, in March in a message to the CIA workforce, saying "we must place our activities and operations in the digital domain at the very center of all our mission endeavors."

With that mantra in mind, DDI Deputy Director Sean Roche, a career agency man, and DDI Director Andrew Hallman have laid the groundwork to carry out the directorate's core mission of, as Roche put it, "accelerating the next generation" of digital solutions for the agency. The directorate has been operating for months, but on Oct. 1, it formally came out of the shadows.

The goal of the new directorate is to provide CIA analysts with a "wide range of cyber options in the initial trade space" to help them solve problems earlier in the intelligence cycle, Roche told FCW during a recent visit to Langley. This means, among other things, locating and understanding the "digital dust" left behind by actors in the cyber domain. It is an open question whether the new directorate will serve as a platform for offensive operations.

There are three key components to the DDI: an open source center; a center for handling cyber threats and operations; and the agency’s IT enterprise, led by CIA CIO Doug Wolfe, whom Roche described as the Elon Musk of the agency.

The new directorate is focused on the promise of data, with the goal of providing mission centers around the world with greater insights from analytics. Roche said that he is already seeing a payoff for the mission centers leveraging DDI support.

The foundation for the new directorate is the agency's Information Operations Center, which analyzes foreign threats to U.S. computer systems. The IOC has been the traditional enclave for IT experts at the agency, but the agency now seeks to infuse this expertise in pretty much everything it does.

Retired Gen. Michael Hayden, who was CIA director from 2006 to 2009, told FCW that getting the digital directorate up and running was a matter of waiting until the IOC’s digital capabilities had sufficiently matured. "Once you get it to a certain level of maturity, then you can more productively disperse it and embed it into other activities," he said.

Now that capability is out the door. The DDI has already dispatched some of its officers to embed in mission centers overseas, Roche said.

"Aggressively" retiring legacy systems

Brennan likes to talk about moving the CIA into a new digital era, but just how IT-savvy is the agency right now? The CIA is grappling with legacy IT systems and will find it challenging to drive innovation into the hands of officers, according to current and former officials.

"For security, cultural, and occasionally budgetary reasons, it's safe to say CIA was never at or even near the cutting edge in information technology," former CIA official Stephen Slick told FCW. And while the CIA has a storied history in science and technology, Slick, who now heads the Intelligence Studies Project at the University of Texas at Austin, said, "this institutional prowess … rarely translated to the individual officer's workstation, and that will be a challenge for the new directorate."

The task of getting the latest technology to agency officers is potentially compounded by a loss in trust between the intelligence community and the private sector following the revelations of government surveillance that came from Edward Snowden.

"CIA, NSA and other agencies will continue to labor into a headwind on digital technology until a new, more cooperative, more rational relationship develops between the government" and the private sector, Slick said.

The more tangible task of modernizing the agency's IT infrastructure could also prove difficult.

Roche said the CIA currently has any number of legacy processes and systems that "have not kept pace" with innovation going on in the outside world. "You have to very aggressively retire legacy systems" and cannot do it gradually, he said, adding that the directorate is assessing how best to utilize in-house contractors, some of whom are maintaining legacy systems. "I’d rather have [some of those contractors] sitting side-by-side with us writing code" than maintaining legacy systems, Roche said.

Hayden, when he was CIA director, tasked a handful of private-sector executives with reviewing the agency's IT posture. The outside advisers, which included former Hewlett-Packard CEO and current Republican presidential hopeful Carly Fiorina, concluded after several months of study that the agency's IT is "pretty good," but that "you're paying probably twice as much as you actually should be paying for it," Hayden said.

Roche, for his part, will be looking to see if the new directorate reduces the time it takes the agency to deploy new applications. A challenge there is understanding the "tradecraft" involved in hosting software across an enterprise, he said, adding that CIA personnel working in counterintelligence, for one, stand to benefit if the directorate can get that project right.

Given Wolfe’s prominence in the new directorate, it is no surprise that, according to Roche, the DDI is intended to be a "key facilitator" of the Intelligence Community IT Enterprise, an ambitious, cloud-driven quest for a single IT architecture for the IC. Roche described the broad trend of organizations adopting more cloud computing as "inevitable."

Working with Fort Meade

With news of Brennan’s plans for enhancing the agency's cyber capabilities came natural questions of how the revamped CIA would interact with the National Security Agency, whose more-robust cyber capabilities have been matched with greater funding. The CIA requested $685.4 million for computer network operations in fiscal 2013, compared with $1 billion requested by the NSA, according to a classified budget Snowden shared with the Washington Post.

The CIA has tended to use its cyber access to act, while the NSA has focused on observation, Hayden said. That has at times created a tension during operations that has had to be "de-conflicted" through a formal process that Hayden oversaw as NSA director, he said.

Nonetheless, the CIA's Information Operations Center is uniquely tailored to the agency’s needs, Hayden said, adding that the IOC is not "an alternative NSA. It's using a new capacity to do what CIA has always done, which is classic espionage."

Susan Gordon, a former director of the IOC and former senior adviser on cybersecurity to Brennan, said the NSA-CIA relationship in cyberspace is not so much "bigger brother and little brother," but rather driven by different missions.

The CIA’s mission is broader than that of the NSA or the National Geospatial-Intelligence Agency, where Gordon is now deputy director. The CIA’s drive to modernize was therefore always going to cut a wider path and potentially raise questions about overlapping missions.

The CIA also sometimes supplements the NSA's cyber work with its own human spying, according to journalist Shane Harris. For example, the CIA’s Technology Management Office has helped an elite NSA hacking unit known as the Tailored Access Operations office break into computer networks to conduct cyber espionage, Harris reported in his book @War.

Roche declined to comment when asked if the new directorate’s mandate includes offensive cyber operations. And Hayden would only say: "That would seem logical."

Bringing digital personalities to Langley

Part of the rationale behind the new directorate is getting agency personnel to immerse themselves in the online world rather than compartmentalize their interaction with it. Before the directorate, "CIA guys were kind of checking their digital personalities at the gate, and they had to be kind of different people inside the fence line than they were outside the fence line," Hayden said. By contrast, DDI is meant to "allow the digital culture to permeate everything CIA does."

The new directorate's charge includes overseeing the career development of the agency’s cyber hands, to nurture "the next generation of digital-savvy leaders" at the CIA, as Roche put it.

 Transforming the agency workforce for the digital age will be a tall but rewarding order, according to Slick. "CIA's most significant, and lasting, challenge will inevitably prove to be cultural as a workforce pursuing multiple missions adapts to a fundamentally changed global information environment," he said. "When CIA's culture fully embraces the digital age, the agency is likely to identify and exploit at least as many new opportunities as it will encounter risks."