Director Says NSA’s Domestic Surveillance Authority ‘Rightly’ Limited

Gen. Paul Nakasone is not eager to embrace new authorities that would allow the National Security Agency to use its surveillance tools within the United States and pushed for other ways to gain the visibility needed to detect hacks like those recently executed by suspected nation-state actors.

“My responsibilities both as a commander of U.S. Cyber Command and as a director of the National Security Agency are rightly outside of the country,” he told Senate Armed Services Committee Chairman Jack Reed during a committee hearing Thursday.

Previous hearings on the recent breaches of nine federal agencies and many more state, local and private-sector entities highlighted the perpetrators' use of domestic infrastructure to mask their operations. The hackers took advantage of laws barring unwarranted surveillance within the U.S., some members of Congress suggested.    

Nakasone said there is a need for greater visibility into domestic infrastructure but that it could also be achieved through public-private partnerships and is something the administration is working on.

He said the military’s role in implementing the previous administration’s “defend forward” initiative where the NSA and CYBERCOM actively hunt for and eliminate threats overseas is crucial but added, “I also think there's a broader piece that that is being worked right now by the administration in terms of how do we improve the further resilience of the United States, as we look at adversaries continuing to avoid our laws and policies, and [trying] to use our own infrastructure in their own attempts.”

Senator after senator asked the general whether he needs more authorities to effectively detect hacks like the ones that exploited weaknesses in software from Microsoft and network management company SolarWinds. 

To Sen. Mike Rounds, R-SD, the ranking member of the committee’s panel on cybersecurity who asked him to make an exception to his general reluctance to prescribe policy, Nakasone said it’s important to respect Americans’ right to privacy.

“It's not just a matter of policy: It's also law. In terms of, we as a nation, rightly so, have a very, very determined balance between privacy and security,” he said.

Noting that the FBI already has domestic surveillance authority, he also reiterated the challenge while suggesting other ways the government might approach gaining more of the necessary visibility into U.S. networks.

“What I'm identifying right now though is our adversaries understand that they can come into the United States and rapidly utilize an internet service provider, come up and do their activities and then take that down before a warrant can be issued, before we can actually have surveillance by a civilian authority here in the United States,” he said. “That's the challenge that we have right now.”

On the way out the door, the Trump administration cited the SolarWinds hacking campaign in issuing an executive order that would require cloud service providers to implement what are referred to as know-your-customer laws. During the hearing, Nakasone suggested such an approach is among a number of ways to gain greater visibility without conferring domestic surveillance powers to the NSA. 

“Whether or not it's greater public-private partnership, whether or not it's, you know laws in terms of private sector understanding who their customers are, but these are all areas that I think we as a nation have to be able to address,” he said.

“It's not necessarily that it's U.S. Cyber Command or the National Security Agency that needs to be doing this,” Nakasone told Sen. Angus King, I-Maine. “I'm saying that the nation needs an ability to be able to see what's going on within the United States.”

When Sen. Jacky Rosen, D-Nev. asked how the government could go about keeping people up to date on threats, he again stressed the importance of private-sector participation.

“Obviously that's through the continuing dialogue in terms of what our intelligence community is talking about, obviously what our governments talk about and also—really important—what the private sector is talking about because they're seeing so many of these threats,” he said.