wow wow wow

(Editor’s Note: This article was first published by our friends at Just Security and is the third in a series that is diving into the foundational barriers to the broad integration of AI in the IC – culture, budget, acquisition, risk, and oversight.)

OPINION — As I have written earlier, there is widespread bipartisan support for radically improving the nation’s ability to take advantage of artificial intelligence (AI). For the Intelligence Community (IC), that means using AI to more quickly, easily, and accurately analyze increasing volumes of data to produce critical foreign intelligence that can warn of and help defuse national security threats, among other things. To do that, the IC will have to partner closely with the private sector, where significant AI development occurs. But despite the billions of dollars that may ultimately flow toward this goal, there are basic hurdles the IC still must overcome to successfully transition and integrate AI into the community at speed and scale.

Among the top hurdles are the U.S. government’s slow, inflexible, and complex budget and acquisition processes. The IC’s rigid budget process follows the standard three-year cycle for the government, which means it takes years to incorporate a new program and requires confident forecasting of the future. Once a program overcomes the necessary hurdles to be included in a budget, it must follow a complex sequence of regulations to issue and manage a contract for the actual goods or services needed. These budget and acquisition processes are often considered separately as they are distinct, but I treat them together because they are closely related and inextricably intertwined in terms of the government’s purchasing of technology.

Importantly, these processes were not intended to obstruct progress; they were designed to ensure cautious and responsible spending, and for good reason. Congress, with its power of the purse, and the Office of Management and Budget (OMB), as the executive branch’s chief budget authority, have the solemn duty to ensure wise and careful use of taxpayer dollars. And their roles in this regard are vital to the U.S. government’s ability to function.

Unfortunately, despite the best of intentions, as noted by some in Congress itself, the budget process has become so “cumbersome, frustrating, and ineffective” that it has weakened the power of the purse and Congress’ capacity to govern. And when complicated acquisition processes are layered on top of the budget process, the result is a spider web of confusion and difficulty for anyone trying to navigate them.

The Need for Speed … and Flexibility and Simplicity

As currently constructed, government budget and acquisition processes cause numerous inefficiencies for the purchase of AI capabilities, negatively impacting three critical areas in particular: speed, flexibility, and simplicity. When it comes to speed and flexibility, the following difficulties jump out:

• The executive branch has a methodical and deliberate three-year budget cycle that calls for defined and steady requirements at the beginning of the cycle. Changing the requirements at any point along the way is difficult and time-consuming.
• The IC’s budgeting processes require that IC spending fit into a series of discrete sequential steps, represented by budget categories like research, development, procurement, or sustainment. Funds are not quickly or easily spent across these categories.
• Most appropriations expire at the end of each fiscal year, which means programs must develop early on, and precisely execute, detailed spending plans or lose the unspent funds at the end of one year.
• Government agencies expend significant time creating detailed Statements of Work (SOWs) that describe contract requirements. Standard contract vehicles do not support evolving requirements, and companies are evaluated over the life of the contract based on strict compliance with the original SOW created years earlier.

These rules make sense in the abstract and result from well-intentioned attempts to buy down the risk of loss or failure and promote accountability and transparency. They require the customer to know with clarity and certainty the solution it seeks in advance of investment and they narrowly limit the customer’s ability to change the plan or hastily implement it. These rules are not unreasonably problematic for the purchase of items like satellites or airplanes, the requirements for which probably should not and will not significantly change over the course of many years.

However, because AI technology is still maturing and the capabilities themselves are always adapting, developing, and adding new functionality, the rules above have become major obstacles to the quick integration of AI across the IC. First, AI requirements defined with specificity years in advance of acquisition – whether in the budget or in a statement of work – are obsolete by the time the technology is delivered. Second, as AI evolves there is often not a clear delineation between research, development, procurement, and sustainment of the technology – it continuously flows back and forth across these categories in very compressed timelines. Third, it is difficult to predict the timing of AI breakthroughs, related new requirements, and funding impacts, so money might not be spent as quickly as expected and could be lost at the end of the fiscal year. Taken together, these processes are inefficient and disruptive, cause confusion and delay, and discourage engagement from small businesses, which have neither the time nor the resources to wait years to complete a contract or to navigate laborious, uncertain processes.

---

Engage personally with experts on Artificial Intelligence and national security  at The Cipher Brief Threat Conference October 24-26.  If you are an actively working in the national security field, we invite you to apply to attend.  Seats are limited.  

---

Simply put, modern practices for fielding AI have outpaced the IC’s decades-old approach to budgeting and acquisition. That AI solutions are constantly evolving, learning, and improving both undermines the IC’s ability to prescribe a specific solution and, in fact, incentivizes the IC to allow the solution to evolve with the technology. The lack of flexibility and speed in how the IC manages and spends money and acquires goods and services is a core problem when it comes to fully incorporating AI into the IC’s toolkit.

Even while we introduce more speed and agility into these processes, however, the government must continue to ensure careful, intentional, and appropriate spending of taxpayer dollars. The adoption of an IC risk framework and modest changes to congressional oversight engagements, which I address in upcoming articles, will help regulate these AI activities in the spirit of the original intent of the budget and acquisition rules.

As for the lack of simplicity, the individually complex budget and acquisition rules are together a labyrinth of requirements, regulations, and processes that even long-time professionals have trouble navigating. In addition:

• There is no quick or simple way for practitioners to keep current with frequent changes in acquisition rules.
• The IC has a distributed approach that allows each element to use its various acquisition authorities independently rather than cohesively, increasing confusion across agency lines.
• Despite the many federal acquisition courses aimed at demystifying the process, there is little connection among educational programs, no clear path for IC officers to participate, and no reward for doing so.

The complexity of the budget and acquisition rules compounds the problems with speed and flexibility, and as more flexibility is introduced to support AI integration, it is even more critical that acquisition professionals be knowledgeable and comfortable with the tools and levers they must use to appropriately manage and oversee contracts.

Impactful Solutions: A Target Rich Environment

Many of these problems are not new; indeed, they have been highlighted and studied often over the past few years in an effort to enable the Department of Defense (DOD) and the IC to more quickly and easily take advantage of emerging technology. But to date, DOD has made only modest gains and the IC is even further behind. While there are hundreds of reforms that could ease these difficulties, narrowing and prioritizing proposed solutions will have a more immediate impact. Moreover, significant change is more likely to be broadly embraced if the IC first proves its ability to successfully implement needed reforms on a smaller scale. The following actions by the executive and legislative branches – some tactical and some strategic – would be powerful steps to ease and speed the transition of AI capabilities into the IC.

Statements of Objectives

A small but important first step to deal with the slow and rigid acquisition process is to encourage the use of Statements of Objectives (SOO) instead of SOWs, when appropriate. As mentioned, SOWs set forth defined project activities, deliverables, requirements, and timelines, which are used to measure contractor progress and success. SOWs make sense when the government understands with precision exactly what is needed from the contractor and how it should be achieved.

SOOs, on the other hand, are more appropriate when the strategic outcome and objectives are clear, but the steps to achieve them are less so. They describe “what” without dictating “how,” thereby encouraging and empowering industry to propose innovative solutions. SOOs also create clarity about what is important to the government, leading companies to focus less on aggressively low pricing of specific requirements and more on meeting the ultimate outcomes in creative ways that align with a company’s strengths. This approach requires knowledgeable acquisition officers as part of the government team, as described below, to ensure the contract includes reasonable milestones and decision points to keep the budget within acceptable levels.

---

The Cipher Brief hosts private briefings with the world’s most experienced national and global security experts.  Become a member today.

---

New Authorities for the IC

Two new authorities would help the IC speed and scale its use of AI capabilities: Other Transaction Authority (OTA)  and Commercial Solutions Openings (CSO). Other Transaction Authority allows specific types of transactions to be completed outside of the traditional federal laws and regulations that apply to standard government procurement contracts, providing significantly more speed, flexibility, and accessibility than traditional contracts. While OTA is limited in scope and not a silver bullet for all acquisition problems, OTA has been used to good effect since 1990 by the Defense Advanced Research Projects Activity (DARPA), DOD’s over-the-horizon research and development organization, among others.

CSOs are a simplified and relatively quick solicitation method to award firm fixed price contracts up to $100 million. CSOs can be used to acquire innovative commercial items, technologies, or services that close capability gaps or provide technological advances through an open call for proposals that provide offerors the opportunity to respond with technical solutions of their own choosing to a broadly defined area of government interest. CSOs are considered competitively awarded regardless of how many offerors respond.

Both OTA and CSO authority should be immediately granted to the IC to improve the speed and flexibility with which the IC can acquire and transition AI into the IC.

Unclassified Sandbox

The predictive nature of the IC’s work and the need to forecast outcomes means the IC must be able to acquire AI at the point of need, aligned to the threat. Waiting several years to acquire AI undermines the IC’s ability to fulfill its purpose. But with speed comes added risk that new capabilities might fail. Therefore, the IC should create an isolated unclassified sandbox, not connected to operational systems, in which potential IC customers could test and evaluate new capabilities alongside developers in weeks-to-months, rather than years. Congress should provide the IC with the ability to purchase software quickly for test and evaluation purposes only to buy down the risk that a rapid acquisition would result in total failure. The sandbox process would allow the IC to test products, consider adjustments, and engage with developers early on, increasing the likelihood of success.

Single Appropriation for Software

DOD has a pilot program that funds software as a single budget item – allowing the same money to be used for research, production, operations, and sustainment – to improve and speed software’s unique development cycle. AI, being largely software, is an important beneficiary of this pilot. Despite much of the IC also being part of DOD, IC-specific activities do not fall within this pilot. Extending DOD’s pilot to the IC would not only speed the IC’s acquisition of AI, but it would also increase interoperability and compatibility of IC and DOD projects.

No-Year Funds

Congress should reconsider the annual expiration of funds as a control lever for AI. Congress already routinely provides no-year funding when it makes sense to do so. In the case of AI, no-year funds would allow the evolution of capabilities without arbitrary deadlines, drive more thoughtful spending throughout the lifecycle of the project, and eliminate the additional overhead required to manage the expiration of funds annually. Recognizing the longer-term nature of this proposal, however, the executive branch also must seek shorter-term solutions in the interim.

A less-preferable alternative is to seek two-year funding for AI. Congress has a long history of proposing biennial budgeting for all government activities. Even without a biennial budget, Congress has already provided nearly a quarter of the federal budget with two-year funding. While two-year funding is not a perfect answer in the context of AI, it would at a minimum discourage parties from rushing to outcomes or artificially burning through money at the end of the first fiscal year and would provide additional time to fulfill the contract. This is presumably why DOD recently created a new budget activity under their Research, Development, Test and Evaluation (RDT&E) category, which is typically available for two years, for “software and digital technology pilot programs.”

AI Technology Fund

Congress should establish an IC AI Technology Fund (AITF) to provide kick-starter funds for priority community AI efforts and enable more flexibility to get those projects off the ground. To be successful, the AITF must have no-year funds, appropriated as a single appropriation, without limits on usage throughout the acquisition lifecycle. The AITF’s flexibility and simplicity would incentivize increased engagement by small businesses, better allowing the IC to tap into the diversity of the marketplace, and would support and speed the delivery of priority AI capabilities to IC mission users.

---

Go beyond the headlines with expert perspectives on today’s news with The Cipher Brief’s Daily Open-Source Podcast.  Listen here or wherever you listen to podcasts.

---

ICWERX  

To quickly take advantage of private sector AI efforts at scale, the IC must better understand the market and more easily engage directly with the private sector. To do so, the IC should create an ICWERX, modeled after AFWERX, an Air Force innovation organization that drives agile public-private sector collaboration to quickly leverage and develop cutting-edge technology for the Air Force. AFWERX aggressively uses innovative, flexible, and speedy procurement mechanisms like OTA and the Small Business Innovation Research and Small Business Technology Transfer programs (SBIR/STTR) to improve the acquisition process and encourage engagement from small businesses. AFWERX is staffed by acquisition and market research experts who are comfortable using those authorities and understand the market. While the IC’s needs are not identical, an ICWERX could serve as an accessible “front door” for prospective partners and vendors, and enable the IC to more quickly leverage and scale cutting-edge AI.

De-mystify Current Authorities

While there is much complaining about a lack of flexible authorities in the IC (and a real need for legal reform), there is flexibility in existing rules that has not been fully utilized. The IC has not prioritized the development or hiring of people with the necessary government acquisition and contracts expertise, so there are insufficient officers who know how to use the existing authorities and those who do are overworked and undervalued. The IC must redouble its efforts to increase its expertise in, and support the use of, these flexibilities in several ways.

First, the IC should create formal partnerships and increase engagement with existing U.S. government experts. The General Services Administration’s Technology Transformation Services (TTS) and FEDSIM, for example, work across the federal government to build innovative acquisition solutions and help agencies more quickly adopt AI. In addition, DOD’s Joint AI Center has built significant acquisition expertise that the IC must better leverage. The IC also should increase joint duty rotations in this area to better integrate and impart acquisition expertise across the IC.

Second, the IC must prioritize training and education of acquisition professionals. And while deep acquisition expertise is not necessary for everyone, it is important for lawyers, operators, technologists, and innovators to have a reasonable understanding of the acquisition rules, and the role they each play in getting to successful outcomes throughout the process. Collaboration and understanding across these professions and up and down the chain of command will result in more cohesive, speedy, and effective outcomes.

To that end, the Office of the Director of National Intelligence (ODNI) should work with the many existing government acquisition education programs, as well as the National Intelligence University, to develop paths for IC officers to grow their understanding of and ability to navigate and successfully use acquisition rules. The ODNI also should strengthen continuing education requirements and create incentive pay for acquisition professionals.

Third, the IC should prioritize and use direct hire authority to recruit experts in government acquisition, to include a mix of senior term-limited hires and junior permanent employees with room to grow and the opportunity for a long career in the IC. Such a strategy would allow the IC to quickly tackle the current AI acquisition challenges and build a bench of in-house expertise.

Finally, practitioners should have an easily accessible reference book to more quickly discover relevant authorities, understand how to use them, and find community experts. A few years ago, the ODNI led the creation of an IC Acquisition Playbook, which describes common IC acquisition authorities, practices, and usages. The ODNI should further develop and disseminate this Playbook as a quick win for the IC.

Incentivize Behavior

To encourage creative and innovative acquisition practices, as well as interdisciplinary collaboration, the IC must align incentives with desired outcomes and create in acquisition professionals a vested interest in the success of the contract. Acquisition officers today are often brought into projects only in transactional ways, when contracts must be completed or money must be obligated, for example. They are rarely engaged early as part of a project team, so they are not part of developing the solutions and have minimal investment in the project’s success. Reinforcing this, acquisition professionals are evaluated primarily on the amount of money they obligate by the end of the fiscal year, rather than on the success of a project.

Therefore, to start, project teams should be required to engage acquisition officers early and often, both to seek their advice and to ensure they have a good understanding of the project’s goals. In addition, evaluation standards for acquisition officers should incorporate effective engagement and collaboration with stakeholders, consideration of creative alternatives and options, and delivery of mission outcomes. If an officer uses innovative practices that fail, that officer also should be evaluated on what they learned from the experience that may inform future success.

Lastly, the ODNI should reinvigorate and highlight the IC acquisition awards to publicly reward desired behavior, and acquisition professionals should be included in IC mission team awards as a recognition of their impact on the ultimate success of the mission.

Conclusion

Between the government’s rigid budget and acquisition processes and confusion about how to apply them, there is very little ability for the IC to take advantage of a fast-moving field that produces new and updated technology daily. Tackling these issues through the handful of priority actions set forth above will begin to drive the critical shift away from the IC’s traditional, linear processes to the more dynamic approaches the IC needs to speed and transform the way it purchases, integrates, and manages the use of AI.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

 

The post AI and the IC: The Tangled Web of Budget and Acquisition appeared first on The Cipher Brief.

Chris Inglis’ new White House office has a startup feel to it. There are desks, a few chairs, a coffee maker and a poster hanging on the wall.  But as the head of the newly established Office of the National Cyber Director, Inglis has to make due with what he has while still advising President Joe Biden on the smartest ways for the US to prevent and respond to cyberattacks.

Inglis has already had numerous conversations with the president, who has made clear that the government has a role to play in the defense of the private sector and in assisting the private sector in defending critical infrastructure.  And the president knows, says Inglis, that means the government needs to get its own cyber house in order. 

But like any real startup, Inglis’ resources are scarce.  More than three months after being confirmed by the Senate, he still doesn’t have the full staff he needs to take on his timely and critical mission.  That’s because the funding for his office – some $21 million, part of the $1 trillion infrastructure bill making its way through Congress – is still stuck in the political spin cycle.  Why does it matter?

“The threat is greater than I can ever remember,” Inglis told me during last month’s AFCEA and INSA Intelligence & National Security Summit in National Harbor, Maryland. “The audacity, the brazenness, the thresholds that have been crossed at every turn; we’re in a difficult place.”

While he’s waiting for Congress to act, he says he’s spending about fifty percent of his time defining his role, being careful not to duplicate the work already being done by other agencies and departments, while spending another fifty percent building relationships that will be important later.  Eventually, he’s expected to have a staff of some 75 people who will be expected to work hand in glove with CISA, the National Security Council’s cyber staff, the OMB and others.  The remaining fifty percent of his time, Inglis jokes, is spent figuring out how to attract the country’s best talent.   

“People are starting to flow into the organization. I’m confident that we’re coming up to a breakout moment, not for the National Cyber Director, but the contribution that we can and should make. I’m sobered by the nature of the challenge, I’m optimistic we can make a difference.”

Optimistic he is.  And he’s not even complaining about being given a critical task for US national security and then having to wait for politics to play out before being able to act on it.

“It has been a semi-silver lining in that we would not have had time to think about how we want to apply the resources coming our way.”

While Inglis has been waiting, he and his small team have had time to think about the four things they’d like to focus on right away. 

First, is streamlining the roles and responsibilities in government of who handles what when it comes to protecting the public and private sectors from cyberattacks.  He also spoke during his confirmation hearing about the importance of allocation of resources and while the Office of the National Cyber Director doesn’t have the authority to move money, it does have what Inglis calls the responsibility to account for cyber money.

“One of the most critical gaps in cyber is that the physical digital infrastructure is not built to a common standard. The executive order related to this requires that within a certain amount of time we have to install basic procedures like multifactor authentication and encryption of stored material. That is a challenge and a potential vulnerability for us. We need to make sure that we make these investments necessary to buy down the lack of investment for years.

The second gap is in talent related to number of people required to occupy these jobs. It’s not simply the folks with IT or cyber in their name, but general cyber awareness. There is some expenditure of resources of time, attention, and money to get awareness right on the part of the truly accountable parties like agency and department heads. We have to make sure they don’t see cyber as a cost center, but an enabler on the part of all the users as they understand what their roles are and what the accountability is.

He admits there is still a level of education needed within government to get there.

“That is usually the case in both the government and the private sector,” he said.  “We need to think this way about cyber and invest in cyber so that we can enable the mission, not hold it back. I think that education is the most important and effective way to handle this. Then, it is to make sure that the accountability is aligned and harmonized. We tend to take risk in one place and expect someone in another place to be the mitigator of a risk they don’t understand was taken in the first place. We need to operate in a collaborative fashion and get away from divisions of effort which are an agreement not to collaborate and allow adversaries to pick us off one at a time.”

Inglis says that unity of effort must start at home.  “The executive order issued in May has begun to lay out common expectations about the hardware, software, and practices that we need to begin in those spaces,” he said.  “Externally, if we have sector risk management agencies who engage the private sector for the purposes of supporting and engaging the critical components of that infrastructure, we need to make sure you don’t need a Ph.D. in government to know who to deal with and what you’re going to get from them.”

He is arguing for the government to also put ‘valuable material’ on the table.  “That could be our convening power,” said Inglis. “We could perhaps address and reduce liability or give companies a clue as to what might be around the corner because the government has access to exquisite intelligence. If that setup is possible, we also need a venue where collaboration takes place. Information doesn’t collaborate, people do.”

Inglis likes to point to the example of CISA and the Joint Cyber Collaborative.  “They put people from the private sector and the public sector side by side to co-discover threats that hold us at common risk. That project sets up the possibility of implicit collaboration in what we then do with that common operational picture. The government could take ideas that private sector companies turn into proprietary systems and enrich and classify them to deal with it in their system.”

Using what he calls “all the tools in the toolkit,” Inglis also notes the importance of international relationships, which fits nicely into the White House’s International Summit on Ransomware last week in Washington, which zeroed in on tighter cryptocurrency standards, among other things. “Beyond the Five Eyes, what do other like-minded nations think about what is expected behavior in this? What are governmental actions that are appropriate,” he asked.  

Inglis has been an active participant in the president’s recent actions in cyber.  He took part in a White House meeting with tech leaders in August that was hosted by President Biden, who Inglis says, spent the first hour sharing his vision about how the country should focus on collaborative integration.  “The companies represented weren’t only companies like Microsoft and Apple, but people who operate in the critical infrastructure space,” said Inglis.  “The people component, educators, were represented reflecting the president’s view that cyberspace is not just technology, it is also the people component. They are a major link in the chain, and we need to get the roles and responsibilities right.”

While he’s waiting for the funding he needs to get his office fully staffed, Inglis said he’s also putting thought into reconciling resources with aspirations.  Managing expectations is going to be important.  Frustration has been growing for years over what some see as a lack of government response to some of the largest hacks in history.  The phrase ‘time and place of our choosing’ as a definition of response has grown old and some Americans are weary of a government that isn’t responding in a more public way to the beating it sees the US taking in cyberspace.

So, I asked Inglis whether there should be red lines in cyber.

“Red lines are both good and bad,” he answered.  “They are clear and crisp, and everybody knows what they are. The downside is that because of that, an adversary knows exactly how far they can go. It means that you set up a somewhat permissive environment. Red lines also don’t have context; sometimes there is a reason that a defender would make the ransomware payment. As a matter of policy, the U.S. government does not pay ransomware, but I imagine there will be a situation at some point where a hospital is against the Russian state and actual life and safety is at risk. If there is no other way to get the material back, in order to get back in the business of saving lives, they would want to rethink if a red line is a red line in that particular situation. I think the right thing to do here is not to establish hard thresholds of things with scripted responses, but outline what we are prepared to defend and what principles we will exercise in defense of those things. We commit to defending the private sector when it is held at risk by a nation state in cyberspace as much as in the kinetic space and make that clear to adversaries. I think that would be more helpful in changing decision calculus and creating a useful ambiguity about when and where we will come in.”

Inglis said he’s also thinking a lot about present and future resilience.  It’s a worthwhile focus, given that the White House estimates that nearly half a million public and private sector cybersecurity jobs are currently unfilled. 

“That is a massive problem,” said Inglis. “However, the more insidious problem is that the 320 million people in the United States who use the internet who have no idea how to properly take their place on the front lines of this issue. There is an awareness issue that requires us not to make Python programmers out of them but to make sure they understand the nature of this space.”

Everyone has heard the old saying that time is money, but in Inglis’ case, time is security so I asked him point blank whether he thought government was moving has quickly as it should on the cyber problem.

“Government is moving at speed; the question is if it is at the necessary speed. I don’t think anyone is moving at the necessary speed. Some are moving at light speed, but at the end of the day, we need an integrated, collaborative approach. While we won’t have unity of command, I think there needs to be a universally felt sense of urgency so that we will all get our heads in the game.”

Congress, are you listening?  Oh, and by the way, that poster in Inglis’ office? It reads, ‘Hours Since the Last Surprise.”

“As a startup with maybe too few resources at the start and who often didn’t understand how all the wickets are run, we have our occasional surprise,” said Inglis.  “When we encounter those surprises and go to someone with the deep and sharp expertise to help us navigate that, we get what we need. However, we are not a full functioning, full featured, fully capable organization yet. We’re trying to build somebody else’s airplane while we’re free falling from our own. We have a parachute, and we can land safely, but it is a bit of a challenge at times.”

Find out more about why experts like former NSA Director General Keith Alexander (Ret.), Mandiant CEO Kevin Mandia and others have joined The Cyber Initiatives Group, powered by The Cipher Brief

Read more expert national security insights, perspective and analysis in The Cipher Brief

The post Chris Inglis and the Gathering Cyber Storm appeared first on The Cipher Brief.

EXPERT OPINION — More than 200 U.S. officers have been hunted around the globe and targeted by an adversary using a mysterious weapon that causes permanent brain injury. It’s time to get serious about fighting back.

The Authors:

Paul Kolbe served for 25 years in the CIA’s Directorate of Operations. He is currently Director of the Intelligence Project at Harvard Kennedy School’s Belfer Center for Science and International Affairs.

Marc Polymeropoulos worked for the CIA for 26 years. He is author of “Clarity in Crisis: Leadership Lessons from the CIA.

John Sipher worked for the CIA’s clandestine service for 28 years. He is now a nonresident senior fellow at the Atlantic Council and a co-founder of Spycraft Entertainment.

Prior to 9/11, al Qaida declared war on the United States, bombed the USS Cole, and blew up U.S. embassies in Nairobi and Dar es Salam. Despite heavy casualties, America viewed successive al Qaida terrorist attacks as somehow unique, not representative of a larger threat or state of war. We went about our business and failed to take hard action against al Qaida despite clear warning. Our failure to respond forcefully led to 9/11 and the two decades of war that followed.

Fast forward to today.  Since 2016, more than 200 U.S. officials have reportedly suffered from a mysterious series of symptoms which have caused long-lasting, debilitating injuries. Suffering from searing headaches, vertigo, vision impairment, and nausea, many victims have been formally diagnosed with traumatic brain injuries (TBI) at the Walter Reed National Military Medical Center and other leading hospitals. Family members and young children have suffered as well. Some medical tests can now confirm the markers of brain injury, similar to those suffered by victims of concussive injuries in Iraq and Afghanistan.

These injuries began with a cluster of reports from Cuba in 2016 and have become commonly referred to as Havana Syndrome. Moscow, Vienna, Belgrade, and Hanoi are among more than a dozen cities where U.S. officials reportedly have been attacked and injured. In residences, on the street, in vehicles, and even at secure U.S. facilities, U.S. officers are being hunted. Stunningly, even a close aide to CIA Director Bill Burns was reportedly attacked on a trip to India just this past August.

The CIA, after a period of confusion, delay, and even denial at times, now appears to take these threats very seriously. CIA Director Burns and Deputy Director David Cohen have publicly stated that U.S. officials are being “attacked.” They have improved health care for CIA officers who are hurt. And an agency task force is hard at work trying to obtain additional intelligence on those responsible. We credit Director Burns for his solid leadership.

The cause of these injuries? The National Academy of Sciences has pointed to Directed Energy Weapons – devices which emit microwave pulses which can inflict pain and damage tissue. The United States, Russia, China, and others have all developed Directed Energy Weapons to destroy equipment, counter drones, and control crowds. This is not science fiction.

Directed energy weapons would account for the highly directional and locational nature of these incidents. When victims can “move off the x,” the signature sounds, sensations, and pain that goes with the attacks often stop, though damage has already occurred. The amount of exposure seems to affect the degree of injury. Other technologies could be at play and are being investigated, but microwaves appear to be the most likely vector. Russia has used them before, flooding the U.S. Embassy in Moscow with microwave radiation for decades.

Regardless of form, the weapons being used in these attacks are nothing less than weapons of terror, designed to cause injury to non-combatants. Who would use such a weapon to attack U.S. intelligence officers, diplomats, and military personnel, and to what conceivable end?

---

The Cipher Brief hosts private briefings with the world’s most experienced national and global security experts.  Become a member today.

---

CIA Deputy Director Cohen stated at a recent intelligence summit, that the U.S. was closer to identifying the culprit, and Politico has reported that members of the Senate Intelligence Committee are increasingly convinced that Russia or another hostile adversary is behind the attack, although reportedly, no smoking gun has been found.

As former CIA operations officers with extensive experience dealing with both counterterrorism and counterintelligence issues, we have few doubts about who will be named as the culprit. For at least a decade, Russia has conducted itself as in a state of conflict with the West in general and the United States in particular. Russia has launched cyberattacks impacting critical infrastructure and supply chains, assassinated opponents with nuclear poisons and chemical weapons, gunned down people in the streets using criminal proxies, sabotaged a Czech ammunition depot, and mounted a violent coup attempt in Montenegro. It has also bombarded the U.S. embassy in Moscow with microwave radiation and used carcinogenic “spy dust” without regard to health effects. The attacks on U.S. officials would fit this pattern of behavior.

We recognize that it is important to let the intelligence community do its job and its findings must inform policy action. Congress and the administration must work together to formulate a range of possible responses and it is not too early to begin. As Senator Collins and others have stated, these attacks are “an act of war,” and as such, preparation for a future attribution call by the national security establishment is in order. So how could the U.S. respond?

Let’s start with what doesn’t work – sanctions. Sanctions feel good and satisfy an action imperative but they are feckless. Sanctions have not stopped Russia from killing dissidents, halted the Nordstream II pipeline, compelled a pull back from occupied territories, reduced support for tyrants, or hindered oil and gas production. Sanctions have simply forced Russia to develop more creative money laundering and sanction circumvention mechanisms.

So, what would work? For starters, we must understand that the Putin regime considers itself in a state of conflict with the U.S., short of war, but nonetheless deadly real. We are dealing with a state sponsor of terror which conducts operations across the globe to weaken the U.S. abroad, divide it from its allies, and sow discord at home. Our policy must be calibrated to win this conflict, without sparking a shooting war, but at risk of one.

Russia understands reciprocity and strength. When four Russian diplomats were kidnapped by extremists in Beirut in 1985, and one of them was killed, Russia reportedly responded by kidnapping and gruesomely killing a relative of the group’s leader. The surviving diplomats were released immediately. The story may be apocryphal, but it does illustrate the Russian approach. Tempting as it may be for America to retaliate tit for tat, we need not mirror Russia’s actions. Instead, we should play to our greater economic, diplomatic, and military advantages.

We offer five elements to frame a response: enlist U.S. allies, expand forward deterrence, limit the adversary’s reach, choke off money, and bring those accountable to justice.

NATO: With proof of the attacks on U.S. officials, we should activate NATO’s Article Five collective defense clause. The only other time this was enacted was after 9/11. As justification, in addition to the Havana Syndrome attacks, (which also caused Canadian casualties), we would include GRU and FSB assassination operations across Europe, deadly sabotage in the Czech Republic, a coup attempt in Montenegro, persistent cyberattacks, and a litany of other actions that can only be described as irregular warfare directed against NATO members.

---

Go beyond the headlines with expert perspectives on today’s news with The Cipher Brief’s Daily Open-Source Podcast.  Listen here or wherever you listen to podcasts.

---

Forward Presence: A crystal clear signal that we understand the nature of Russian hybrid warfare and are responding would be to enhance our deployed military presence in Poland, the Baltic States, and in the Black Sea region. These units would pose no offensive threat to Russia but would be a clear signal that the U.S. is prepared to counter any Russian shenanigans. We should also significantly ramp up our lethal aid and training to the Ukraine, where the nature of Russian aggression is well known. Weakness in Eastern Europe is an invitation to conflict.

Travel and Presence: We should drastically limit Russian business and tourist travel which is being used as cover for FSB and GRU operations. We would reduce Russian diplomatic presence in each capital to the bare minimum – handfuls not hundreds. American and European counterintelligence experts believe there are more Russian intelligence officers operating from embassies than during the Cold War. Limiting the size of Russia’s espionage infrastructure will complicate the planning and execution of all of its intelligence operations.

Finance: A key tool in counterterrorism operations is the ability to target sources of finance which constitute material support to terrorism. In this case, we would apply that principle to the Russian government, state enterprises, and individuals who provide cover, tools, and sources of funding to Russia’s campaign to undermine the West with violence, terror, and media manipulation. Russia’s dirty money has been used to undermine the west and poison our politics. We should limit the easy access of shady money to western banks.

Criminal Cases: We need bring war crime cases to the International Court of Justice (ICJ) in the Hague. Following a decade of conflict in the Balkans, the ICJ brought to justice 161 indicted Serbian, Croatian, and Bosnian war criminals. This was an astounding success – a manhunt which included American and European law enforcement and intelligence services. Just as in Nuremberg after World War II, these actions to hold war criminals accountable drew a line in the sand.

This is a start.  Successive Democratic and Republican administrations have pursued Russia policies which represent the triumph of hope over experience. We have treated the symptoms of malign Russian actions rather than the underlying pathology. It is now time to finally acknowledge that we are in a long-term hybrid conflict and forget the fantasy of changing Putin’s behavior. Only a new regime in the Kremlin would hold the hope of bringing about a change in actions. Eventually, the Putin regime will wither or collapse, but until it does, we and our allies must do a better job of defending ourselves.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The post Havana and the Global Hunt for U.S. Officers appeared first on The Cipher Brief.

Chris Inglis’ new White House office has a startup feel to it. There are desks, a few chairs, a coffee maker and a poster hanging on the wall.  But as the head of the newly established Office of the National Cyber Director, Inglis has to make due with what he has while still advising President Joe Biden on the smartest ways for the US to prevent and respond to cyberattacks.

Inglis has already had numerous conversations with the president, who has made clear that the government has a role to play in the defense of the private sector and in assisting the private sector in defending critical infrastructure.  And the president knows, says Inglis, that means the government needs to get its own cyber house in order. 

But like any real startup, Inglis’ resources are scarce.  More than three months after being confirmed by the Senate, he still doesn’t have the full staff he needs to take on his timely and critical mission.  That’s because the funding for his office – some $21 million, part of the $1 trillion infrastructure bill making its way through Congress – is still stuck in the political spin cycle.  Why does it matter?

“The threat is greater than I can ever remember,” Inglis told me during last month’s AFCEA and INSA Intelligence & National Security Summit in National Harbor, Maryland. “The audacity, the brazenness, the thresholds that have been crossed at every turn; we’re in a difficult place.”

While he’s waiting for Congress to act, he says he’s spending about fifty percent of his time defining his role, being careful not to duplicate the work already being done by other agencies and departments, while spending another fifty percent building relationships that will be important later.  Eventually, he’s expected to have a staff of some 75 people who will be expected to work hand in glove with CISA, the National Security Council’s cyber staff, the OMB and others.  The remaining fifty percent of his time, Inglis jokes, is spent figuring out how to attract the country’s best talent.   

“People are starting to flow into the organization. I’m confident that we’re coming up to a breakout moment, not for the National Cyber Director, but the contribution that we can and should make. I’m sobered by the nature of the challenge, I’m optimistic we can make a difference.”

Optimistic he is.  And he’s not even complaining about being given a critical task for US national security and then having to wait for politics to play out before being able to act on it.

“It has been a semi-silver lining in that we would not have had time to think about how we want to apply the resources coming our way.”

While Inglis has been waiting, he and his small team have had time to think about the four things they’d like to focus on right away. 

First, is streamlining the roles and responsibilities in government of who handles what when it comes to protecting the public and private sectors from cyberattacks.  He also spoke during his confirmation hearing about the importance of allocation of resources and while the Office of the National Cyber Director doesn’t have the authority to move money, it does have what Inglis calls the responsibility to account for cyber money.

“One of the most critical gaps in cyber is that the physical digital infrastructure is not built to a common standard. The executive order related to this requires that within a certain amount of time we have to install basic procedures like multifactor authentication and encryption of stored material. That is a challenge and a potential vulnerability for us. We need to make sure that we make these investments necessary to buy down the lack of investment for years.

The second gap is in talent related to number of people required to occupy these jobs. It’s not simply the folks with IT or cyber in their name, but general cyber awareness. There is some expenditure of resources of time, attention, and money to get awareness right on the part of the truly accountable parties like agency and department heads. We have to make sure they don’t see cyber as a cost center, but an enabler on the part of all the users as they understand what their roles are and what the accountability is.

He admits there is still a level of education needed within government to get there.

“That is usually the case in both the government and the private sector,” he said.  “We need to think this way about cyber and invest in cyber so that we can enable the mission, not hold it back. I think that education is the most important and effective way to handle this. Then, it is to make sure that the accountability is aligned and harmonized. We tend to take risk in one place and expect someone in another place to be the mitigator of a risk they don’t understand was taken in the first place. We need to operate in a collaborative fashion and get away from divisions of effort which are an agreement not to collaborate and allow adversaries to pick us off one at a time.”

Inglis says that unity of effort must start at home.  “The executive order issued in May has begun to lay out common expectations about the hardware, software, and practices that we need to begin in those spaces,” he said.  “Externally, if we have sector risk management agencies who engage the private sector for the purposes of supporting and engaging the critical components of that infrastructure, we need to make sure you don’t need a Ph.D. in government to know who to deal with and what you’re going to get from them.”

He is arguing for the government to also put ‘valuable material’ on the table.  “That could be our convening power,” said Inglis. “We could perhaps address and reduce liability or give companies a clue as to what might be around the corner because the government has access to exquisite intelligence. If that setup is possible, we also need a venue where collaboration takes place. Information doesn’t collaborate, people do.”

Inglis likes to point to the example of CISA and the Joint Cyber Collaborative.  “They put people from the private sector and the public sector side by side to co-discover threats that hold us at common risk. That project sets up the possibility of implicit collaboration in what we then do with that common operational picture. The government could take ideas that private sector companies turn into proprietary systems and enrich and classify them to deal with it in their system.”

Using what he calls “all the tools in the toolkit,” Inglis also notes the importance of international relationships, which fits nicely into the White House’s International Summit on Ransomware last week in Washington, which zeroed in on tighter cryptocurrency standards, among other things. “Beyond the Five Eyes, what do other like-minded nations think about what is expected behavior in this? What are governmental actions that are appropriate,” he asked.  

Inglis has been an active participant in the president’s recent actions in cyber.  He took part in a White House meeting with tech leaders in August that was hosted by President Biden, who Inglis says, spent the first hour sharing his vision about how the country should focus on collaborative integration.  “The companies represented weren’t only companies like Microsoft and Apple, but people who operate in the critical infrastructure space,” said Inglis.  “The people component, educators, were represented reflecting the president’s view that cyberspace is not just technology, it is also the people component. They are a major link in the chain, and we need to get the roles and responsibilities right.”

While he’s waiting for the funding he needs to get his office fully staffed, Inglis said he’s also putting thought into reconciling resources with aspirations.  Managing expectations is going to be important.  Frustration has been growing for years over what some see as a lack of government response to some of the largest hacks in history.  The phrase ‘time and place of our choosing’ as a definition of response has grown old and some Americans are weary of a government that isn’t responding in a more public way to the beating it sees the US taking in cyberspace.

So, I asked Inglis whether there should be red lines in cyber.

“Red lines are both good and bad,” he answered.  “They are clear and crisp, and everybody knows what they are. The downside is that because of that, an adversary knows exactly how far they can go. It means that you set up a somewhat permissive environment. Red lines also don’t have context; sometimes there is a reason that a defender would make the ransomware payment. As a matter of policy, the U.S. government does not pay ransomware, but I imagine there will be a situation at some point where a hospital is against the Russian state and actual life and safety is at risk. If there is no other way to get the material back, in order to get back in the business of saving lives, they would want to rethink if a red line is a red line in that particular situation. I think the right thing to do here is not to establish hard thresholds of things with scripted responses, but outline what we are prepared to defend and what principles we will exercise in defense of those things. We commit to defending the private sector when it is held at risk by a nation state in cyberspace as much as in the kinetic space and make that clear to adversaries. I think that would be more helpful in changing decision calculus and creating a useful ambiguity about when and where we will come in.”

Inglis said he’s also thinking a lot about present and future resilience.  It’s a worthwhile focus, given that the White House estimates that nearly half a million public and private sector cybersecurity jobs are currently unfilled. 

“That is a massive problem,” said Inglis. “However, the more insidious problem is that the 320 million people in the United States who use the internet who have no idea how to properly take their place on the front lines of this issue. There is an awareness issue that requires us not to make Python programmers out of them but to make sure they understand the nature of this space.”

Everyone has heard the old saying that time is money, but in Inglis’ case, time is security so I asked him point blank whether he thought government was moving has quickly as it should on the cyber problem.

“Government is moving at speed; the question is if it is at the necessary speed. I don’t think anyone is moving at the necessary speed. Some are moving at light speed, but at the end of the day, we need an integrated, collaborative approach. While we won’t have unity of command, I think there needs to be a universally felt sense of urgency so that we will all get our heads in the game.”

Congress, are you listening?  Oh, and by the way, that poster in Inglis’ office? It reads, ‘Hours Since the Last Surprise.”

“As a startup with maybe too few resources at the start and who often didn’t understand how all the wickets are run, we have our occasional surprise,” said Inglis.  “When we encounter those surprises and go to someone with the deep and sharp expertise to help us navigate that, we get what we need. However, we are not a full functioning, full featured, fully capable organization yet. We’re trying to build somebody else’s airplane while we’re free falling from our own. We have a parachute, and we can land safely, but it is a bit of a challenge at times.”

Find out more about why experts like former NSA Director General Keith Alexander (Ret.), Mandiant CEO Kevin Mandia and others have joined The Cyber Initiatives Group, powered by The Cipher Brief

Read more expert national security insights, perspective and analysis in The Cipher Brief

The post Chris Inglis and the Gathering Cyber Storm appeared first on The Cipher Brief.

A Roadmap for AI in the Intelligence Community

(Editor’s Note: This article was first published by our friends at Just Security and is the fourth in a series that is diving into the foundational barriers to the broad integration of AI in the IC – culture, budget, acquisition, risk, and oversight.  This article considers a new IC approach to risk management.)

OPINION — I have written previously that the Intelligence Community (IC) must rapidly advance its artificial intelligence (AI) capabilities to keep pace with our nation’s adversaries and continue to provide policymakers with accurate, timely, and exquisite insights. The good news is that there is strong bipartisan support for doing so. The not-so-good news is that the IC is not well-postured to move quickly and take the risks required to continue to outpace China and other strategic competitors over the next decade.

In addition to the practical budget and acquisition hurdles facing the IC, there is a strong cultural resistance to taking risks when not absolutely necessary. This is understandable given the life-and-death nature of intelligence work and the U.S. government’s imperative to wisely execute national security funds and activities. However, some risks related to innovative and cutting-edge technologies like AI are in fact necessary, and the risk of inaction – the costs of not pursuing AI capabilities – is greater than the risk of action.

The Need for a Risk Framework

For each incredible new invention, there are hundreds of brilliant ideas that have failed. To entrepreneurs and innovators, “failure” is not a bad word. Rather, failed ideas are often critical steps in the learning process that ultimately lead to a successful product; without those prior failed attempts, that final product might never be created. As former President of India A.P.J. Abdul Kalam once said, “FAIL” should really stand for “First Attempt In Learning.”

The U.S. government, however, is not Silicon Valley; it does not consider failure a useful part of any process, especially when it comes to national security activities and taxpayer dollars. Indeed, no one in the U.S. government wants to incur additional costs or delay or lose taxpayer dollars. But there is rarely a distinction made within the government between big failures, which may have a lasting, devastating, and even life-threatening impact, and small failures, which may be mere stumbling blocks with acceptable levels of impact that result in helpful course corrections.

---

The Cipher Brief hosts private briefings with the world’s most experienced national and global security experts.  Become a member today.

---

As a subcommittee report of the House Permanent Select Committee on Intelligence (HPSCI) notes “[p]rogram failures are often met with harsh penalties and very public rebukes from Congress which often fails to appreciate that not all failures are the same. Especially with cutting-edge research in technologies … early failures are a near certainty …. In fact, failing fast and adapting quickly is a critical part of innovation.” There is a vital difference between an innovative project that fails and a failure to innovate. The former teaches us something we did not know before, while the latter is a national security risk.

Faced with congressional hearings, inspector general reports, performance evaluation downgrades, negative reputational effects, and even personal liability, IC officers are understandably risk-averse and prefer not to introduce any new risk. That is, of course, neither realistic nor the standard the IC meets today. The IC is constantly managing a multitude of operational risks – that its officers, sources, or methods will be exposed, that it will miss (or misinterpret) indications of an attack, or that it will otherwise fail to produce the intelligence policymakers need at the right time and place. Yet in the face of such serious risks, the IC proactively and aggressively pursues its mission. It recognizes that it must find effective ways to understand, mitigate, and make decisions around risk, and therefore it takes action to make sure potential ramifications are clear, appropriate, and accepted before any failure occurs. In short, the IC has long known that its operations cannot be paralyzed by a zero-risk tolerance that is neither desirable nor attainable. This recognition must also be applied to the ways in which the IC acquires, develops, and uses new technology.

This is particularly important in the context of AI. While AI has made amazing progress in recent years, the underlying technology, the algorithms and their application, are still evolving and the resulting capabilities, by design, will continue to learn and adapt. AI holds enormous promise to transform a variety of IC missions and tasks, but how and when these changes may occur is difficult to forecast and AI’s constant innovation will introduce uncertainty and mistakes. There will be unexpected breakthroughs, as well as failures in areas that initially seemed promising.

The IC must rethink its willingness to take risks in a field where change and failure is embraced as part of the key to future success. The IC must experiment and iterate its progress over time and shift from a culture that punishes even reasonable risk to one that embraces, mitigates, and owns it. This can only be done with a systematic, repeatable, and consistent approach to making risk-conscious decisions.

Today there is no cross-IC mechanism for thinking about risk, let alone for taking it. When considering new activities or approaches, each IC element manages risk through its own lens and mechanisms, if at all. Several individual IC elements have created internal risk assessment frameworks to help officers understand the risks of both action and inaction, and to navigate the decisions they are empowered to make depending upon the circumstances. These frameworks increase confidence that if an activity goes wrong, supervisors all the way up the chain will provide backing as long as the risk was reasonable, well-considered and understood, and the right leaders approved it. And while risk assessments are often not precise instruments of measurement – they reflect the quality of the data, the varied expertise of those conducting the assessments, and the subjective interpretation of the results – regularized and systematic risk assessments are nevertheless a key part of effective risk management and facilitate decision-making at all levels.

---

Go beyond the headlines with expert perspectives on today’s news with The Cipher Brief’s Daily Open-Source Podcast.  Listen here or wherever you listen to podcasts.

---

Creating these individual frameworks is commendable and leading-edge for government agencies, but more must be done holistically across the IC. Irregular and inconsistent risk assessments among IC elements will not provide the comfort and certainty needed to drive an IC-wide cultural shift to taking risk. At the same time, the unique nature of the IC, comprised of 18 different elements, each with similar and overlapping, but not identical, missions, roles, authorities, threats and vulnerabilities, does not lend itself to a one-size-fits-all approach.

For this reason, the IC needs a flexible but common strategic framework for considering risk that can apply across the community, with each element having the ability to tailor that framework to its own mission space. Such an approach is not unlike how the community is managed in many areas today – with overarching IC-wide policy that is locally interpreted and implemented to fit the specific needs of each IC element. When it comes to risk, creating an umbrella IC-wide framework will significantly improve the workforce’s ability to understand acceptable risks and tradeoffs, produce comprehensible and comparable risk determinations across the IC, and provide policymakers the ability to anticipate and mitigate failure and unintended escalation.

Critical Elements of a Risk Framework

A common IC AI risk framework should inform and help prioritize decisions from acquisition or development, to deployment, to performance in a consistent way across the IC. To start, the IC should create common AI risk management principles, like its existing principles of transparency and AI ethics, that include clear and consistent definitions, thresholds, and standards. These principles should drive a repeatable risk assessment process that each IC element can tailor to its individual needs, and should promote policy, governance, and technological approaches that are aligned to risk management.

The successful implementation of this risk framework requires a multi-disciplinary approach involving leaders from across the organization, experts from all relevant functional areas, and managers who can ensure vigilance in implementation. A whole-of-activity methodology that includes technologists, collectors, analysts, innovators, security officers, acquisition officers, lawyers and more, is critical to ensuring a full 360-degree understanding of the opportunities, issues, risks, and potential consequences associated with a particular action, and to enabling the best-informed decision.

Given the many players involved, each IC element must strengthen internal processes to manage the potential disconnects that can lead to unintended risks and to create a culture that instills in every officer a responsibility to proactively consider risk at each stage of the activity. Internal governance should include an interdisciplinary Risk Management Council (RMC) made up of senior leaders from across the organization. The RMC should establish clear and consistent thresholds for when a risk assessment is required, recommended, or not needed given that resource constraints likely will not allow all of the broad and diverse AI activities within organizations to be assessed. These thresholds should be consistent with the IC risk management principles so that as IC elements work together on projects across the community, officers have similar understandings and expectations.

The risk framework itself should provide a common taxonomy and process to:

• Understand and identify potential failures, including the source, timeline, and range of effects.
• Analyze failures and risks by identifying internal vulnerabilities or predisposing conditions that could increase the likelihood of adverse impact.
• Evaluate the likelihood of failure, taking into consideration risks and vulnerabilities.
• Assess the severity of the potential impact, to include potential harm to organizational operations, assets, individuals, other organizations, or the nation.
• Consider whether the ultimate risk may be sufficiently mitigated or whether it should be transferred, avoided, or accepted.

AI-related risks may include, among other things, technology failure, biased data, adversarial attacks, supply chain compromises, human error, cost overruns, legal compliance challenges, or oversight issues.

An initial risk level is determined by considering the likelihood of a failure against the severity of the potential impact. For example, is there is a low, moderate, or high likelihood of supply chain compromise? Would such a compromise affect only one discrete system or are there system-wide implications? These calculations will result in an initial risk level. Then potential mitigation measures, such as additional policies, training, or security measures, are applied to lower the initial risk level to an adjusted risk level. For example, physically or logically segmenting an organization’s systems so that a compromise only touches one system would significantly decrease the risk level associated with that particular technology. The higher the likelihood of supply chain compromise, the lower the severity of its impact must be to offset the risk, and vice versa. Organizations should apply the Swiss Cheese Model of more than one preventative or mitigative action for a more effective layered defense. Organizations then must consider the adjusted risk level in relation to their tolerance for risk; how much risk (and potential consequence) is acceptable in pursuit of value? This requires defining the IC’s risk tolerance levels, within which IC elements may again define their own levels based upon their unique missions.

Understanding and considering the risk of action is an important step forward for the IC, but it is not the last step. Sometimes overlooked in risk assessment practices is the consideration of the risk of inaction. To fully evaluate potential options, decision-makers must consider whether the overall risk of doing something is outweighed by the risks of not doing it. If the IC does not pursue particular AI capabilities, what is the opportunity cost of that inaction? Any final determination about whether to take action must consider whether declining to act would cause greater risk of significant harm. While the answer will not always be yes, in the case of AI and emerging technology, it is a very realistic possibility.

And, finally, a risk framework only works if people know about it. Broad communication – about the existence of the framework, how to apply it, and expectations for doing so – is vital. We cannot hold people accountable for appropriately managing risk if we do not clearly and consistently communicate and help people use the structure and mechanisms for doing so.

Buy-in To Enhance Confidence

An IC-wide AI risk framework will help IC officers understand risks and determine when and how to take advantage of innovative emerging technologies like AI, increasing comfort with uncertainty and risk-taking in the pursuit of new capabilities. Such a risk framework will have even greater impact if it is accepted – explicitly or implicitly – by the IC’s congressional overseers. The final article in this series will delve more deeply into needed changes to further improve the crucial relationship between the IC and its congressional overseers. It will also provide a link to a full report that provides more detail on each aspect of the series, including a draft IC AI Risk Framework.

Although Congress is not formally bound by such a framework, given the significant accountability measures that often flow from these overseers, a meeting of the minds between the IC and its congressional overseers is critical. Indeed, these overseers should have awareness of and an informal ability to provide feedback into the framework as it is being developed. This level of transparency and partnership would lead to at least two important benefits: first, increased confidence in the framework by all; and second, better insight into IC decision-making for IC overseers.

Ultimately, such a mutual understanding would encourage exactly what the IC needs to truly take advantage of next-generation technology like AI: a culture of experimentation, innovation, and creativity that sees reasonable risk and failure as necessary steps to game-changing outcomes.

Read also AI and the IC: The Tangled Web of Budget and Acquisition

Read also Artificial Intelligence in the IC: Culture is Critical

Read also AI and the IC: The Challenges Ahead

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The post A Roadmap for AI in the IC appeared first on The Cipher Brief.

EXPERT OPINION — More than 200 U.S. officers have been hunted around the globe and targeted by an adversary using a mysterious weapon that causes permanent brain injury. It’s time to get serious about fighting back.

The Authors:

Paul Kolbe served for 25 years in the CIA’s Directorate of Operations. He is currently Director of the Intelligence Project at Harvard Kennedy School’s Belfer Center for Science and International Affairs.

Marc Polymeropoulos worked for the CIA for 26 years. He is author of “Clarity in Crisis: Leadership Lessons from the CIA.

John Sipher worked for the CIA’s clandestine service for 28 years. He is now a nonresident senior fellow at the Atlantic Council and a co-founder of Spycraft Entertainment.

Prior to 9/11, al Qaida declared war on the United States, bombed the USS Cole, and blew up U.S. embassies in Nairobi and Dar es Salam. Despite heavy casualties, America viewed successive al Qaida terrorist attacks as somehow unique, not representative of a larger threat or state of war. We went about our business and failed to take hard action against al Qaida despite clear warning. Our failure to respond forcefully led to 9/11 and the two decades of war that followed.

Fast forward to today.  Since 2016, more than 200 U.S. officials have reportedly suffered from a mysterious series of symptoms which have caused long-lasting, debilitating injuries. Suffering from searing headaches, vertigo, vision impairment, and nausea, many victims have been formally diagnosed with traumatic brain injuries (TBI) at the Walter Reed National Military Medical Center and other leading hospitals. Family members and young children have suffered as well. Some medical tests can now confirm the markers of brain injury, similar to those suffered by victims of concussive injuries in Iraq and Afghanistan.

These injuries began with a cluster of reports from Cuba in 2016 and have become commonly referred to as Havana Syndrome. Moscow, Vienna, Belgrade, and Hanoi are among more than a dozen cities where U.S. officials reportedly have been attacked and injured. In residences, on the street, in vehicles, and even at secure U.S. facilities, U.S. officers are being hunted. Stunningly, even a close aide to CIA Director Bill Burns was reportedly attacked on a trip to India just this past August.

The CIA, after a period of confusion, delay, and even denial at times, now appears to take these threats very seriously. CIA Director Burns and Deputy Director David Cohen have publicly stated that U.S. officials are being “attacked.” They have improved health care for CIA officers who are hurt. And an agency task force is hard at work trying to obtain additional intelligence on those responsible. We credit Director Burns for his solid leadership.

The cause of these injuries? The National Academy of Sciences has pointed to Directed Energy Weapons – devices which emit microwave pulses which can inflict pain and damage tissue. The United States, Russia, China, and others have all developed Directed Energy Weapons to destroy equipment, counter drones, and control crowds. This is not science fiction.

Directed energy weapons would account for the highly directional and locational nature of these incidents. When victims can “move off the x,” the signature sounds, sensations, and pain that goes with the attacks often stop, though damage has already occurred. The amount of exposure seems to affect the degree of injury. Other technologies could be at play and are being investigated, but microwaves appear to be the most likely vector. Russia has used them before, flooding the U.S. Embassy in Moscow with microwave radiation for decades.

Regardless of form, the weapons being used in these attacks are nothing less than weapons of terror, designed to cause injury to non-combatants. Who would use such a weapon to attack U.S. intelligence officers, diplomats, and military personnel, and to what conceivable end?

---

The Cipher Brief hosts private briefings with the world’s most experienced national and global security experts.  Become a member today.

---

CIA Deputy Director Cohen stated at a recent intelligence summit, that the U.S. was closer to identifying the culprit, and Politico has reported that members of the Senate Intelligence Committee are increasingly convinced that Russia or another hostile adversary is behind the attack, although reportedly, no smoking gun has been found.

As former CIA operations officers with extensive experience dealing with both counterterrorism and counterintelligence issues, we have few doubts about who will be named as the culprit. For at least a decade, Russia has conducted itself as in a state of conflict with the West in general and the United States in particular. Russia has launched cyberattacks impacting critical infrastructure and supply chains, assassinated opponents with nuclear poisons and chemical weapons, gunned down people in the streets using criminal proxies, sabotaged a Czech ammunition depot, and mounted a violent coup attempt in Montenegro. It has also bombarded the U.S. embassy in Moscow with microwave radiation and used carcinogenic “spy dust” without regard to health effects. The attacks on U.S. officials would fit this pattern of behavior.

We recognize that it is important to let the intelligence community do its job and its findings must inform policy action. Congress and the administration must work together to formulate a range of possible responses and it is not too early to begin. As Senator Collins and others have stated, these attacks are “an act of war,” and as such, preparation for a future attribution call by the national security establishment is in order. So how could the U.S. respond?

Let’s start with what doesn’t work – sanctions. Sanctions feel good and satisfy an action imperative but they are feckless. Sanctions have not stopped Russia from killing dissidents, halted the Nordstream II pipeline, compelled a pull back from occupied territories, reduced support for tyrants, or hindered oil and gas production. Sanctions have simply forced Russia to develop more creative money laundering and sanction circumvention mechanisms.

So, what would work? For starters, we must understand that the Putin regime considers itself in a state of conflict with the U.S., short of war, but nonetheless deadly real. We are dealing with a state sponsor of terror which conducts operations across the globe to weaken the U.S. abroad, divide it from its allies, and sow discord at home. Our policy must be calibrated to win this conflict, without sparking a shooting war, but at risk of one.

Russia understands reciprocity and strength. When four Russian diplomats were kidnapped by extremists in Beirut in 1985, and one of them was killed, Russia reportedly responded by kidnapping and gruesomely killing a relative of the group’s leader. The surviving diplomats were released immediately. The story may be apocryphal, but it does illustrate the Russian approach. Tempting as it may be for America to retaliate tit for tat, we need not mirror Russia’s actions. Instead, we should play to our greater economic, diplomatic, and military advantages.

We offer five elements to frame a response: enlist U.S. allies, expand forward deterrence, limit the adversary’s reach, choke off money, and bring those accountable to justice.

NATO: With proof of the attacks on U.S. officials, we should activate NATO’s Article Five collective defense clause. The only other time this was enacted was after 9/11. As justification, in addition to the Havana Syndrome attacks, (which also caused Canadian casualties), we would include GRU and FSB assassination operations across Europe, deadly sabotage in the Czech Republic, a coup attempt in Montenegro, persistent cyberattacks, and a litany of other actions that can only be described as irregular warfare directed against NATO members.

---

Go beyond the headlines with expert perspectives on today’s news with The Cipher Brief’s Daily Open-Source Podcast.  Listen here or wherever you listen to podcasts.

---

Forward Presence: A crystal clear signal that we understand the nature of Russian hybrid warfare and are responding would be to enhance our deployed military presence in Poland, the Baltic States, and in the Black Sea region. These units would pose no offensive threat to Russia but would be a clear signal that the U.S. is prepared to counter any Russian shenanigans. We should also significantly ramp up our lethal aid and training to the Ukraine, where the nature of Russian aggression is well known. Weakness in Eastern Europe is an invitation to conflict.

Travel and Presence: We should drastically limit Russian business and tourist travel which is being used as cover for FSB and GRU operations. We would reduce Russian diplomatic presence in each capital to the bare minimum – handfuls not hundreds. American and European counterintelligence experts believe there are more Russian intelligence officers operating from embassies than during the Cold War. Limiting the size of Russia’s espionage infrastructure will complicate the planning and execution of all of its intelligence operations.

Finance: A key tool in counterterrorism operations is the ability to target sources of finance which constitute material support to terrorism. In this case, we would apply that principle to the Russian government, state enterprises, and individuals who provide cover, tools, and sources of funding to Russia’s campaign to undermine the West with violence, terror, and media manipulation. Russia’s dirty money has been used to undermine the west and poison our politics. We should limit the easy access of shady money to western banks.

Criminal Cases: We need bring war crime cases to the International Court of Justice (ICJ) in the Hague. Following a decade of conflict in the Balkans, the ICJ brought to justice 161 indicted Serbian, Croatian, and Bosnian war criminals. This was an astounding success – a manhunt which included American and European law enforcement and intelligence services. Just as in Nuremberg after World War II, these actions to hold war criminals accountable drew a line in the sand.

This is a start.  Successive Democratic and Republican administrations have pursued Russia policies which represent the triumph of hope over experience. We have treated the symptoms of malign Russian actions rather than the underlying pathology. It is now time to finally acknowledge that we are in a long-term hybrid conflict and forget the fantasy of changing Putin’s behavior. Only a new regime in the Kremlin would hold the hope of bringing about a change in actions. Eventually, the Putin regime will wither or collapse, but until it does, we and our allies must do a better job of defending ourselves.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The post Havana and the Global Hunt for U.S. Officers appeared first on The Cipher Brief.

Colder weather is settling in around much of the globe and after a year and a half of managing a global pandemic, energy markets are more complicated than ever.  The U.S. petroleum inventory is at its lowest level since 2015, the UK is experiencing a severe energy crisis, Russia continues to push Germany on the Nordstream II pipeline and winter has already come to China, which has experienced weeks of rolling blackouts. What does all of this mean as both state and non-state cyber actors continue to take aim at energy infrastructure?

The Cipher Brief spoke with energy expert Norm Roule, a top adviser on energy issues, to get a sense of where we’re headed.

Norman T. Roule served for 34-years in the Central Intelligence Agency, managing numerous programs relating to Iran and the Middle East.  He served as the National Intelligence Manager for Iran (NIM-I) at the Office of the Director of National Intelligence from November 2008 until September 2017.  As NIM-I, he was the principal Intelligence Community (IC) official responsible for overseeing all aspects of national intelligence policy and activities related to Iran, to include IC engagement on Iran issues with senior policy makers in the National Security Council and the Department of State.

The Cipher Brief: Give us a brief snapshot of the global energy market today and what you think we will see in the coming months.

Roule: The energy market is working through what will hopefully be the final phase of a perfect storm of market distortions ignited by the pandemic and influenced by shifts in capital markets and climate change initiatives. I say the final phase because most countries are returning to growth and pre-pandemic energy consumption. Most of the drivers of this final phase will likely push prices upward in the near term. A few involve long-known issues that are now coming into play. A few remain unpredictable. Ancillary industries that rely on oil, gas, or distillates as significant feedstocks will either raise prices or shift production to areas with less exposure to hydrocarbons. In short, in the coming weeks, consumers should expend to not only pay more at the gas pump but at the supermarket and mall.  We are likely to see relief in the Spring as the pandemic and supply chain distortions wane, seasonal demands on oil and gas pass, and energy producers ramp up operations to exploit high prices. China’s economy also shows signs of slowing, and financial packages meant to jump-start global economies will run their course.

The Cipher Brief: Energy markets seem more complicated than ever. What are the primary variables at play?

Roule: Global oil consumption is now back to 100 million barrels per day, a statistic last seen when the pandemic hit. Production is up, but the most crucial trend in recent months has been the deep draw on the glut of oil stocks during the pandemic. Producers – especially OPEC – have constrained production to reflect their cautious approach to market stability and their desire to reduce the stockpiles accumulated during the pandemic. As a result, stocks are now lower than before the pandemic. If you exclude the strategic petroleum reserve, the U.S. petroleum inventory is at a level not seen since 2014-2015. Stockpiles at Cushing are at a similar level. U.S. gasoline stocks are around five million barrels below pre-pandemic seasonal averages.

U.S. producers have consolidated, and the industry prioritizes return on equity over expansion, particularly in a political environment that is increasingly hostile to hydrocarbon production. As a result, U.S. oil production is still about 1.7 million barrels a day below pre-pandemic levels. Add to this the push to reduce carbon emissions, gas supply cuts, and some supply chain distortions, and you get a surge in gas prices and a need for oil (and coal) to replace gas in electricity production, as we see in China.

The Cipher Brief: The administration seems to be blaming OPEC plus for high oil prices. What’s happening within the cartel?  How does the cartel see the current energy market?

Roule: OPEC’s role in oil markets remains deeply significant. The cartel produces 40 percent of the world’s oil, but 60 percent of the world’s total traded exports. That inevitably gives it an important voice. It is also clear that OPEC+ leaders remain confident in their strategy to maintain market stability and benefit from prices that are not so high that they ignite demand destruction. OPEC discipline during this turbulent period has been quite good, especially given that it is far from a monolith of views and capabilities. For example, the UAE would likely support additional production. Moscow makes positive noises about its willingness to increase production, but it follows Riyadh’s lead for the revenue and political advantage it derives from the current market.  

Riyadh remains the architect of OPEC’s approach. Kuwait and Baghdad seem comfortable with this strategy. Production restraint is made easier because about half of OPEC’s members reportedly are unable to meet production quotas due to technical problems, mismanagement, or a lack of capital investment. This list includes Angola, Gabon, Equatorial Guinea, Nigeria, Libya, and Venezuela.  

OPEC decision-making likely rests on a handful of variables, some predictable, others not. The cartel has done well in its assessments of global recovery and pandemic impact. But questions remain on aviation recovery. Likewise, even their best analysts have a tough time predicting the impact of speculators, weather trends, and the future of sanctions on Iran and Venezuela. Riyadh and Abu Dhabi will do what they can to avoid the financial and political consequences of inflation and any energy-instigated recession.

The strains in US-Saudi relations appear to have undermined Riyadh’s sympathy for Washington’s challenges. The Saudis are tired of being a political target within the U.S. They also seem to believe that while the U.S. touts itself as being interested in only renewable energy sources, it has no problem criticizing the Kingdom when high gas prices become a political issue. Last, we should recall that it was only in May 2020 that a group of Republican Senators publicly called on Saudi Arabia, demanding that it stabilize the energy market. From Riyadh’s perspective, it has done precisely that.

The Cipher Brief: Are the Gulf oil producers serious about renewable energy? 

Roule: Absolutely. Regional leaders certainly understand the consequences of climate change for their people. In recent years, the region has experienced some of the highest temperatures on record, causing concern that, if unchecked, the trend could make portions of the Middle East unlivable.

But their approach is different from ours and as we all know, Gulf economies rely heavily on revenues from hydrocarbons. To varying degrees, all the Gulf states are trying to diversify their economies. But they also want to avoid a situation in which they are stuck with stranded strategic assets. In the West, our climate narrative tends to focus on ending the use of hydrocarbons. As with Norway, Gulf producers claim that they will use the resources from their oil revenues to fund the transition to a new energy economy.

---

Join The Cipher Brief for Members Only expert conversations on issues related to economic and global security.  Become a member for just $10 a month and then join us for a Members Only Brief with Norm Roule on Thursday, November 18 at 1:30p.  Members receive invitations via email.

---

Their focus tends to be a balance between a reduction of emissions and reduction of hydrocarbon use. Recent weeks have seen multiple significant events in the Gulf in which they tried to highlight their decision to expend resources and political bandwidth on green technologies, hydrogen production, and carbon capture solutions. We will also see increasing efforts to plant trees and to rely on natural gas instead of oil for power generation. They also claim they will try to end gas flaring and reduce methane emissions. I don’t think these efforts will satisfy Western environmental activists who demand an end to oil use, but the trend is undeniable.

The Cipher Brief: What is happening with U.S. oil and gas producers?  How are they responding to changing conditions?

Roule: Much has changed in the last two years. First, the sector underwent significant consolidation. The larger publicly-held companies must satisfy investors and financial institutions with a steady return on equity over the growth. Washington has cooled on its support for the industry. The decision to kill the Keystone Pipeline and limit drilling on federal property has contributed to industry reluctance on expansion. Last, some investors are pushing for companies to devote more attention to renewable energy sources.  During the pandemic, this reduced capital investment to about half of average expenditure, thus producing our current limited production capacity. U.S. rig count has significantly improved over the past year, but not on a scale that would return U.S. production to pre-pandemic levels. In the near term, smaller privately-held firms are likely to spend the resources to expand production with public firms following once they get a sense of what 2022 will bring.

The results speak for themselves. At the beginning of the pandemic, the U.S. produced around 12.8 million barrels of oil per day (BPD). By May 2020, production declined to 9.7 million BPD, and with recovery is now approximately 11.3 million BPD.  We are once again a net importer, bringing in about 1.3 million BPD in October.

We have seen a broader recovery in gas production, particularly in Texas. But a lack of production, low stockpiles, and unprecedented demand from abroad means consumers will face high bills if winter is severe or the risk of short supplies. Beyond heating, gas-fired power plants produce more than 50% of New England’s electricity, for example, so that any price spike will play out elsewhere in the economy.

The Cipher Brief: Is there a policy response to this situation?

Roule: I think policymakers globally are praying for a mild winter. But beyond this, policy options are few in the near term. A release from the strategic petroleum reserve (SPR) is conceivable. Still, we should remember the SPR was established for national emergencies and not a piggy bank to manage gas prices in an election year. Domestic producers will take a while to ramp up production, but policymakers will find this tough to seek in the current political environment. The administration could ban oil and gas exports or allow Congress to pass legislation enabling the federal government to sue OPEC for its cartel activities. Either step would invite predictable and unwelcome diplomatic consequences. 

Although the American public demands cheap energy, it isn’t enthusiastic about supporting the infrastructure needed to achieve this, even if the power is produced elsewhere.  Let me cite a couple of recent examples:

• Maine voters just rejected the construction of a billion-dollar electric line that would have delivered Canadian hydro-power electricity to New England.

• The administration is wrestling with a decision as to whether it should shut a pipeline that carries crude oil from Canada to refineries across Wisconsin, Michigan, and the Great Lakes region. 

If the administration hopes to convince OPEC members to increase production, it will improve relations with Gulf Arabs. It might be possible to convince Saudi Arabia, Kuwait, and the UAE to lift production to cover the exports of OPEC members unable to meet their production quotas. In an extreme situation, the administration might consider a temporary oil export waiver to Iran as a sign of goodwill. I think the political blowback on the latter rules it out, but the possibility is there. 

The Cipher Brief: The United Kingdom seems to be working its way through a severe energy crisis. How did this happen, and what are its policymakers doing in response?

Roule: The United Kingdom’s energy challenge is significant. As with other countries, it faces consequences of production limitation and the need to turn to more climate-friendly energy sources.

A few basics.  Gas produces about 40% of the country’s electricity and heats many of its homes. Once London could rely on the North Sea for its gas; it now imports about half of its gas requirements.  Norway is its primary gas source, but it also depends on gas producers in the U.S., Russia, Qatar, Belgium, and the Netherlands. To add to its woes, the U.K.’s storage capacity would survive only a short period of peak consumption. In 2017, London closed a massive Rough, which accounted for 70% of the country’s entire gas storage system. At the time, London believed it could rely on the global LNG market for reliable and cheap gas. Unfortunately, most LNG tankers head to Asia, a trend that can only increase as power-hungry Asian countries wean themselves from coal and oil.

The exploitation of new energy sources in the U.K. is no less contentious than in the U.S. A good illustration of this would be the tussle over the development of the Cambo oil and gas field in the waters near Scotland. Opposed by environmentalists who cite the inevitable carbon emissions the project and its oil would produce, the project offers to ease London’s energy woes and provide around a thousand jobs. The Johnson government has yet to indicate whether it will approve the project.

London’s options are few and leaving the country reliant on market conditions means risking shortages. For this reason, it has reportedly asked Qatar to agree to become the “supplier of last resort” in case global suppliers are unavailable. 

---

Go beyond the headlines with expert perspectives on today’s news with The Cipher Brief’s Daily Open-Source Podcast.  Listen here or wherever you listen to podcasts.

---

The Cipher Brief: What’s the Russian angle to the energy story?

Roule: Upfront, I think we should worry whether Russia will perceive the energy crisis as offering an opportunity for aggression. What if Moscow decides its gas hold over Europe allows it to invade Ukraine without penalty? Or as a means of pushing German regulators to accelerate their approval of the Nordstream II pipeline?

Moscow insists that it is meeting contractual obligations and that its exports have increased in the past year. At the same time, there are routine reports that Russia’s gas supplies to Europe have not only not met requirements, but that gas flow reversed in the Yamal-Europe pipeline. Russia also maintains eight gas storage sites in Europe to help manage supply during high-demand periods. Gas levels at these sites are currently low. Critics claim Gazprom diverted production to Russian domestic storage and that exports in October fell to the lowest level since 2014. When pressed, Moscow explains shortages saying that it must fill its winter supply stocks and expects to send Europe additional gas this week. 

But if the current energy dynamic seems to be in Russia’s interest, Moscow’s long-term prospects are dim. A global shift to renewable energy sources forces Moscow to reckon with the prospect of holding a massive oil infrastructure of little commercial value. If so, future historians may look at the recent Glasgow climate summit as a significant step in accelerating Russia’s decline, possibly a new era of aggression as it seeks to accumulate power ahead of this decline or a more competitive race for market share against OPEC members.

The Cipher Brief: What about China?

Roule: No major country has endured such energy problems in recent months as China. After weeks of rolling blackouts, China looks well on its way to solving its coal problems that partially contributed to this situation. That won’t delight environmentalists, but it should ease China’s electricity problems and ensure its citizens stay warm this winter. Winter arrived early, and Beijing is about to see its first snow of the season. China’s efforts will be put to the test in a winter that many expect to be colder than 2020.

Longer-term, China still must work through the causes of this crisis. If the global economy continues to surge demand for Chinese products, its energy requirements will grow. Weather problems cut wind production; floods shut mines. We shouldn’t be surprised if such problems continue. Inevitably, China can only meet its climate goals by shifting from coal to natural gas, raising prices for other consumers.

The Cipher Brief: Let’s shift to North Africa.  Algeria recently closed a long-established pipeline that transited Morocco to deliver gas to Spain.  Will this impact Europe’s already tight gas situation? What’s the story here? 

Roule: Over the past year, Algerian relations with Morocco have steadily deteriorated.  In addition to their traditional disagreement over the status of Western Sahara and the Polisario, Algiers criticized Morocco’s renewed ties with Israel and accused Rabat of supporting an opposition group that Algeria claims ignited forest fires. Algiers closed its airspace to Moroccan flights and accused Morocco of killing several Algerian citizens in the Sahara region.

Here’s how it touches the energy picture. On 31 October, Algiers closed an 800-mile pipeline that carried Algerian gas to Spain via Morocco and the Strait of Gibraltar.  The closure cost Morocco a portion of the gas it used from the pipeline. Morocco used this gas to produce about a tenth of its electricity. Rabat claims it can use other energy sources for this purpose. However, Spain has little gas and derives a significant portion of its electricity from that which it must import. Algiers claims it will make up the loss through a secondary pipeline, but the loss of gas will compound the energy problems of Spain and Europe in general.

The Cipher Brief: Any other issues on the horizon we should consider?

Roule: A growing number of aging refineries in the West will be closed in the coming years.  However, Asia is the new center for refinery construction. This expansion will draw even more crude to the region for processing with the inherent impact on local economies and global consumers.

The Cipher Brief: Last, let’s touch on wild cards. What are the grey swans that might impact markets in 2022?

Roule: With low stockpiles and supplies, the energy topography is ill-prepared to sudden shocks to its production or distribution architecture. Yet, it faces three threats that have grown in the last decade.

First, we have climate change issues.  Increasingly harsh weather events have shut down large portions of the production and refinery sectors in the United States and Mexico, sometimes taking weeks to restore normal production. Second, we have the universe of cyber threats.  State and non-state cyber actors routinely probe or attack every aspect of the energy industry. Last, we have new geopolitical pressures.  Tensions are rising with China as well as Iran and its proxies. Three of the world’s six most significant shipping channels are in the Middle East and a fourth in Asia.

Join us for a Members Only Brief with Norm Roule on Thursday, November 18 at 1:30p.  Cipher Brief Members receive invitations via email.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The post Winter is Coming: Global Energy Markets and the Impact on National Security appeared first on The Cipher Brief.

A Roadmap for AI in the Intelligence Community

(Editor’s Note: This article was first published by our friends at Just Security and is the fourth in a series that is diving into the foundational barriers to the broad integration of AI in the IC – culture, budget, acquisition, risk, and oversight.  This article considers a new IC approach to risk management.)

OPINION — I have written previously that the Intelligence Community (IC) must rapidly advance its artificial intelligence (AI) capabilities to keep pace with our nation’s adversaries and continue to provide policymakers with accurate, timely, and exquisite insights. The good news is that there is strong bipartisan support for doing so. The not-so-good news is that the IC is not well-postured to move quickly and take the risks required to continue to outpace China and other strategic competitors over the next decade.

In addition to the practical budget and acquisition hurdles facing the IC, there is a strong cultural resistance to taking risks when not absolutely necessary. This is understandable given the life-and-death nature of intelligence work and the U.S. government’s imperative to wisely execute national security funds and activities. However, some risks related to innovative and cutting-edge technologies like AI are in fact necessary, and the risk of inaction – the costs of not pursuing AI capabilities – is greater than the risk of action.

The Need for a Risk Framework

For each incredible new invention, there are hundreds of brilliant ideas that have failed. To entrepreneurs and innovators, “failure” is not a bad word. Rather, failed ideas are often critical steps in the learning process that ultimately lead to a successful product; without those prior failed attempts, that final product might never be created. As former President of India A.P.J. Abdul Kalam once said, “FAIL” should really stand for “First Attempt In Learning.”

The U.S. government, however, is not Silicon Valley; it does not consider failure a useful part of any process, especially when it comes to national security activities and taxpayer dollars. Indeed, no one in the U.S. government wants to incur additional costs or delay or lose taxpayer dollars. But there is rarely a distinction made within the government between big failures, which may have a lasting, devastating, and even life-threatening impact, and small failures, which may be mere stumbling blocks with acceptable levels of impact that result in helpful course corrections.

---

The Cipher Brief hosts private briefings with the world’s most experienced national and global security experts.  Become a member today.

---

As a subcommittee report of the House Permanent Select Committee on Intelligence (HPSCI) notes “[p]rogram failures are often met with harsh penalties and very public rebukes from Congress which often fails to appreciate that not all failures are the same. Especially with cutting-edge research in technologies … early failures are a near certainty …. In fact, failing fast and adapting quickly is a critical part of innovation.” There is a vital difference between an innovative project that fails and a failure to innovate. The former teaches us something we did not know before, while the latter is a national security risk.

Faced with congressional hearings, inspector general reports, performance evaluation downgrades, negative reputational effects, and even personal liability, IC officers are understandably risk-averse and prefer not to introduce any new risk. That is, of course, neither realistic nor the standard the IC meets today. The IC is constantly managing a multitude of operational risks – that its officers, sources, or methods will be exposed, that it will miss (or misinterpret) indications of an attack, or that it will otherwise fail to produce the intelligence policymakers need at the right time and place. Yet in the face of such serious risks, the IC proactively and aggressively pursues its mission. It recognizes that it must find effective ways to understand, mitigate, and make decisions around risk, and therefore it takes action to make sure potential ramifications are clear, appropriate, and accepted before any failure occurs. In short, the IC has long known that its operations cannot be paralyzed by a zero-risk tolerance that is neither desirable nor attainable. This recognition must also be applied to the ways in which the IC acquires, develops, and uses new technology.

This is particularly important in the context of AI. While AI has made amazing progress in recent years, the underlying technology, the algorithms and their application, are still evolving and the resulting capabilities, by design, will continue to learn and adapt. AI holds enormous promise to transform a variety of IC missions and tasks, but how and when these changes may occur is difficult to forecast and AI’s constant innovation will introduce uncertainty and mistakes. There will be unexpected breakthroughs, as well as failures in areas that initially seemed promising.

The IC must rethink its willingness to take risks in a field where change and failure is embraced as part of the key to future success. The IC must experiment and iterate its progress over time and shift from a culture that punishes even reasonable risk to one that embraces, mitigates, and owns it. This can only be done with a systematic, repeatable, and consistent approach to making risk-conscious decisions.

Today there is no cross-IC mechanism for thinking about risk, let alone for taking it. When considering new activities or approaches, each IC element manages risk through its own lens and mechanisms, if at all. Several individual IC elements have created internal risk assessment frameworks to help officers understand the risks of both action and inaction, and to navigate the decisions they are empowered to make depending upon the circumstances. These frameworks increase confidence that if an activity goes wrong, supervisors all the way up the chain will provide backing as long as the risk was reasonable, well-considered and understood, and the right leaders approved it. And while risk assessments are often not precise instruments of measurement – they reflect the quality of the data, the varied expertise of those conducting the assessments, and the subjective interpretation of the results – regularized and systematic risk assessments are nevertheless a key part of effective risk management and facilitate decision-making at all levels.

---

Go beyond the headlines with expert perspectives on today’s news with The Cipher Brief’s Daily Open-Source Podcast.  Listen here or wherever you listen to podcasts.

---

Creating these individual frameworks is commendable and leading-edge for government agencies, but more must be done holistically across the IC. Irregular and inconsistent risk assessments among IC elements will not provide the comfort and certainty needed to drive an IC-wide cultural shift to taking risk. At the same time, the unique nature of the IC, comprised of 18 different elements, each with similar and overlapping, but not identical, missions, roles, authorities, threats and vulnerabilities, does not lend itself to a one-size-fits-all approach.

For this reason, the IC needs a flexible but common strategic framework for considering risk that can apply across the community, with each element having the ability to tailor that framework to its own mission space. Such an approach is not unlike how the community is managed in many areas today – with overarching IC-wide policy that is locally interpreted and implemented to fit the specific needs of each IC element. When it comes to risk, creating an umbrella IC-wide framework will significantly improve the workforce’s ability to understand acceptable risks and tradeoffs, produce comprehensible and comparable risk determinations across the IC, and provide policymakers the ability to anticipate and mitigate failure and unintended escalation.

Critical Elements of a Risk Framework

A common IC AI risk framework should inform and help prioritize decisions from acquisition or development, to deployment, to performance in a consistent way across the IC. To start, the IC should create common AI risk management principles, like its existing principles of transparency and AI ethics, that include clear and consistent definitions, thresholds, and standards. These principles should drive a repeatable risk assessment process that each IC element can tailor to its individual needs, and should promote policy, governance, and technological approaches that are aligned to risk management.

The successful implementation of this risk framework requires a multi-disciplinary approach involving leaders from across the organization, experts from all relevant functional areas, and managers who can ensure vigilance in implementation. A whole-of-activity methodology that includes technologists, collectors, analysts, innovators, security officers, acquisition officers, lawyers and more, is critical to ensuring a full 360-degree understanding of the opportunities, issues, risks, and potential consequences associated with a particular action, and to enabling the best-informed decision.

Given the many players involved, each IC element must strengthen internal processes to manage the potential disconnects that can lead to unintended risks and to create a culture that instills in every officer a responsibility to proactively consider risk at each stage of the activity. Internal governance should include an interdisciplinary Risk Management Council (RMC) made up of senior leaders from across the organization. The RMC should establish clear and consistent thresholds for when a risk assessment is required, recommended, or not needed given that resource constraints likely will not allow all of the broad and diverse AI activities within organizations to be assessed. These thresholds should be consistent with the IC risk management principles so that as IC elements work together on projects across the community, officers have similar understandings and expectations.

The risk framework itself should provide a common taxonomy and process to:

• Understand and identify potential failures, including the source, timeline, and range of effects.
• Analyze failures and risks by identifying internal vulnerabilities or predisposing conditions that could increase the likelihood of adverse impact.
• Evaluate the likelihood of failure, taking into consideration risks and vulnerabilities.
• Assess the severity of the potential impact, to include potential harm to organizational operations, assets, individuals, other organizations, or the nation.
• Consider whether the ultimate risk may be sufficiently mitigated or whether it should be transferred, avoided, or accepted.

AI-related risks may include, among other things, technology failure, biased data, adversarial attacks, supply chain compromises, human error, cost overruns, legal compliance challenges, or oversight issues.

An initial risk level is determined by considering the likelihood of a failure against the severity of the potential impact. For example, is there is a low, moderate, or high likelihood of supply chain compromise? Would such a compromise affect only one discrete system or are there system-wide implications? These calculations will result in an initial risk level. Then potential mitigation measures, such as additional policies, training, or security measures, are applied to lower the initial risk level to an adjusted risk level. For example, physically or logically segmenting an organization’s systems so that a compromise only touches one system would significantly decrease the risk level associated with that particular technology. The higher the likelihood of supply chain compromise, the lower the severity of its impact must be to offset the risk, and vice versa. Organizations should apply the Swiss Cheese Model of more than one preventative or mitigative action for a more effective layered defense. Organizations then must consider the adjusted risk level in relation to their tolerance for risk; how much risk (and potential consequence) is acceptable in pursuit of value? This requires defining the IC’s risk tolerance levels, within which IC elements may again define their own levels based upon their unique missions.

Understanding and considering the risk of action is an important step forward for the IC, but it is not the last step. Sometimes overlooked in risk assessment practices is the consideration of the risk of inaction. To fully evaluate potential options, decision-makers must consider whether the overall risk of doing something is outweighed by the risks of not doing it. If the IC does not pursue particular AI capabilities, what is the opportunity cost of that inaction? Any final determination about whether to take action must consider whether declining to act would cause greater risk of significant harm. While the answer will not always be yes, in the case of AI and emerging technology, it is a very realistic possibility.

And, finally, a risk framework only works if people know about it. Broad communication – about the existence of the framework, how to apply it, and expectations for doing so – is vital. We cannot hold people accountable for appropriately managing risk if we do not clearly and consistently communicate and help people use the structure and mechanisms for doing so.

Buy-in To Enhance Confidence

An IC-wide AI risk framework will help IC officers understand risks and determine when and how to take advantage of innovative emerging technologies like AI, increasing comfort with uncertainty and risk-taking in the pursuit of new capabilities. Such a risk framework will have even greater impact if it is accepted – explicitly or implicitly – by the IC’s congressional overseers. The final article in this series will delve more deeply into needed changes to further improve the crucial relationship between the IC and its congressional overseers. It will also provide a link to a full report that provides more detail on each aspect of the series, including a draft IC AI Risk Framework.

Although Congress is not formally bound by such a framework, given the significant accountability measures that often flow from these overseers, a meeting of the minds between the IC and its congressional overseers is critical. Indeed, these overseers should have awareness of and an informal ability to provide feedback into the framework as it is being developed. This level of transparency and partnership would lead to at least two important benefits: first, increased confidence in the framework by all; and second, better insight into IC decision-making for IC overseers.

Ultimately, such a mutual understanding would encourage exactly what the IC needs to truly take advantage of next-generation technology like AI: a culture of experimentation, innovation, and creativity that sees reasonable risk and failure as necessary steps to game-changing outcomes.

Read also AI and the IC: The Tangled Web of Budget and Acquisition

Read also Artificial Intelligence in the IC: Culture is Critical

Read also AI and the IC: The Challenges Ahead

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The post A Roadmap for AI in the IC appeared first on The Cipher Brief.

Colder weather is settling in around much of the globe and after a year and a half of managing a global pandemic, energy markets are more complicated than ever.  The U.S. petroleum inventory is at its lowest level since 2015, the UK is experiencing a severe energy crisis, Russia continues to push Germany on the Nordstream II pipeline and winter has already come to China, which has experienced weeks of rolling blackouts. What does all of this mean as both state and non-state cyber actors continue to take aim at energy infrastructure?

The Cipher Brief spoke with energy expert Norm Roule, a top adviser on energy issues, to get a sense of where we’re headed.

Norman T. Roule served for 34-years in the Central Intelligence Agency, managing numerous programs relating to Iran and the Middle East.  He served as the National Intelligence Manager for Iran (NIM-I) at the Office of the Director of National Intelligence from November 2008 until September 2017.  As NIM-I, he was the principal Intelligence Community (IC) official responsible for overseeing all aspects of national intelligence policy and activities related to Iran, to include IC engagement on Iran issues with senior policy makers in the National Security Council and the Department of State.

The Cipher Brief: Give us a brief snapshot of the global energy market today and what you think we will see in the coming months.

Roule: The energy market is working through what will hopefully be the final phase of a perfect storm of market distortions ignited by the pandemic and influenced by shifts in capital markets and climate change initiatives. I say the final phase because most countries are returning to growth and pre-pandemic energy consumption. Most of the drivers of this final phase will likely push prices upward in the near term. A few involve long-known issues that are now coming into play. A few remain unpredictable. Ancillary industries that rely on oil, gas, or distillates as significant feedstocks will either raise prices or shift production to areas with less exposure to hydrocarbons. In short, in the coming weeks, consumers should expend to not only pay more at the gas pump but at the supermarket and mall.  We are likely to see relief in the Spring as the pandemic and supply chain distortions wane, seasonal demands on oil and gas pass, and energy producers ramp up operations to exploit high prices. China’s economy also shows signs of slowing, and financial packages meant to jump-start global economies will run their course.

The Cipher Brief: Energy markets seem more complicated than ever. What are the primary variables at play?

Roule: Global oil consumption is now back to 100 million barrels per day, a statistic last seen when the pandemic hit. Production is up, but the most crucial trend in recent months has been the deep draw on the glut of oil stocks during the pandemic. Producers – especially OPEC – have constrained production to reflect their cautious approach to market stability and their desire to reduce the stockpiles accumulated during the pandemic. As a result, stocks are now lower than before the pandemic. If you exclude the strategic petroleum reserve, the U.S. petroleum inventory is at a level not seen since 2014-2015. Stockpiles at Cushing are at a similar level. U.S. gasoline stocks are around five million barrels below pre-pandemic seasonal averages.

U.S. producers have consolidated, and the industry prioritizes return on equity over expansion, particularly in a political environment that is increasingly hostile to hydrocarbon production. As a result, U.S. oil production is still about 1.7 million barrels a day below pre-pandemic levels. Add to this the push to reduce carbon emissions, gas supply cuts, and some supply chain distortions, and you get a surge in gas prices and a need for oil (and coal) to replace gas in electricity production, as we see in China.

The Cipher Brief: The administration seems to be blaming OPEC plus for high oil prices. What’s happening within the cartel?  How does the cartel see the current energy market?

Roule: OPEC’s role in oil markets remains deeply significant. The cartel produces 40 percent of the world’s oil, but 60 percent of the world’s total traded exports. That inevitably gives it an important voice. It is also clear that OPEC+ leaders remain confident in their strategy to maintain market stability and benefit from prices that are not so high that they ignite demand destruction. OPEC discipline during this turbulent period has been quite good, especially given that it is far from a monolith of views and capabilities. For example, the UAE would likely support additional production. Moscow makes positive noises about its willingness to increase production, but it follows Riyadh’s lead for the revenue and political advantage it derives from the current market.  

Riyadh remains the architect of OPEC’s approach. Kuwait and Baghdad seem comfortable with this strategy. Production restraint is made easier because about half of OPEC’s members reportedly are unable to meet production quotas due to technical problems, mismanagement, or a lack of capital investment. This list includes Angola, Gabon, Equatorial Guinea, Nigeria, Libya, and Venezuela.  

OPEC decision-making likely rests on a handful of variables, some predictable, others not. The cartel has done well in its assessments of global recovery and pandemic impact. But questions remain on aviation recovery. Likewise, even their best analysts have a tough time predicting the impact of speculators, weather trends, and the future of sanctions on Iran and Venezuela. Riyadh and Abu Dhabi will do what they can to avoid the financial and political consequences of inflation and any energy-instigated recession.

The strains in US-Saudi relations appear to have undermined Riyadh’s sympathy for Washington’s challenges. The Saudis are tired of being a political target within the U.S. They also seem to believe that while the U.S. touts itself as being interested in only renewable energy sources, it has no problem criticizing the Kingdom when high gas prices become a political issue. Last, we should recall that it was only in May 2020 that a group of Republican Senators publicly called on Saudi Arabia, demanding that it stabilize the energy market. From Riyadh’s perspective, it has done precisely that.

The Cipher Brief: Are the Gulf oil producers serious about renewable energy? 

Roule: Absolutely. Regional leaders certainly understand the consequences of climate change for their people. In recent years, the region has experienced some of the highest temperatures on record, causing concern that, if unchecked, the trend could make portions of the Middle East unlivable.

But their approach is different from ours and as we all know, Gulf economies rely heavily on revenues from hydrocarbons. To varying degrees, all the Gulf states are trying to diversify their economies. But they also want to avoid a situation in which they are stuck with stranded strategic assets. In the West, our climate narrative tends to focus on ending the use of hydrocarbons. As with Norway, Gulf producers claim that they will use the resources from their oil revenues to fund the transition to a new energy economy.

---

Join The Cipher Brief for Members Only expert conversations on issues related to economic and global security.  Become a member for just $10 a month and then join us for a Members Only Brief with Norm Roule on Thursday, November 18 at 1:30p.  Members receive invitations via email.

---

Their focus tends to be a balance between a reduction of emissions and reduction of hydrocarbon use. Recent weeks have seen multiple significant events in the Gulf in which they tried to highlight their decision to expend resources and political bandwidth on green technologies, hydrogen production, and carbon capture solutions. We will also see increasing efforts to plant trees and to rely on natural gas instead of oil for power generation. They also claim they will try to end gas flaring and reduce methane emissions. I don’t think these efforts will satisfy Western environmental activists who demand an end to oil use, but the trend is undeniable.

The Cipher Brief: What is happening with U.S. oil and gas producers?  How are they responding to changing conditions?

Roule: Much has changed in the last two years. First, the sector underwent significant consolidation. The larger publicly-held companies must satisfy investors and financial institutions with a steady return on equity over the growth. Washington has cooled on its support for the industry. The decision to kill the Keystone Pipeline and limit drilling on federal property has contributed to industry reluctance on expansion. Last, some investors are pushing for companies to devote more attention to renewable energy sources.  During the pandemic, this reduced capital investment to about half of average expenditure, thus producing our current limited production capacity. U.S. rig count has significantly improved over the past year, but not on a scale that would return U.S. production to pre-pandemic levels. In the near term, smaller privately-held firms are likely to spend the resources to expand production with public firms following once they get a sense of what 2022 will bring.

The results speak for themselves. At the beginning of the pandemic, the U.S. produced around 12.8 million barrels of oil per day (BPD). By May 2020, production declined to 9.7 million BPD, and with recovery is now approximately 11.3 million BPD.  We are once again a net importer, bringing in about 1.3 million BPD in October.

We have seen a broader recovery in gas production, particularly in Texas. But a lack of production, low stockpiles, and unprecedented demand from abroad means consumers will face high bills if winter is severe or the risk of short supplies. Beyond heating, gas-fired power plants produce more than 50% of New England’s electricity, for example, so that any price spike will play out elsewhere in the economy.

The Cipher Brief: Is there a policy response to this situation?

Roule: I think policymakers globally are praying for a mild winter. But beyond this, policy options are few in the near term. A release from the strategic petroleum reserve (SPR) is conceivable. Still, we should remember the SPR was established for national emergencies and not a piggy bank to manage gas prices in an election year. Domestic producers will take a while to ramp up production, but policymakers will find this tough to seek in the current political environment. The administration could ban oil and gas exports or allow Congress to pass legislation enabling the federal government to sue OPEC for its cartel activities. Either step would invite predictable and unwelcome diplomatic consequences. 

Although the American public demands cheap energy, it isn’t enthusiastic about supporting the infrastructure needed to achieve this, even if the power is produced elsewhere.  Let me cite a couple of recent examples:

• Maine voters just rejected the construction of a billion-dollar electric line that would have delivered Canadian hydro-power electricity to New England.

• The administration is wrestling with a decision as to whether it should shut a pipeline that carries crude oil from Canada to refineries across Wisconsin, Michigan, and the Great Lakes region. 

If the administration hopes to convince OPEC members to increase production, it will improve relations with Gulf Arabs. It might be possible to convince Saudi Arabia, Kuwait, and the UAE to lift production to cover the exports of OPEC members unable to meet their production quotas. In an extreme situation, the administration might consider a temporary oil export waiver to Iran as a sign of goodwill. I think the political blowback on the latter rules it out, but the possibility is there. 

The Cipher Brief: The United Kingdom seems to be working its way through a severe energy crisis. How did this happen, and what are its policymakers doing in response?

Roule: The United Kingdom’s energy challenge is significant. As with other countries, it faces consequences of production limitation and the need to turn to more climate-friendly energy sources.

A few basics.  Gas produces about 40% of the country’s electricity and heats many of its homes. Once London could rely on the North Sea for its gas; it now imports about half of its gas requirements.  Norway is its primary gas source, but it also depends on gas producers in the U.S., Russia, Qatar, Belgium, and the Netherlands. To add to its woes, the U.K.’s storage capacity would survive only a short period of peak consumption. In 2017, London closed a massive Rough, which accounted for 70% of the country’s entire gas storage system. At the time, London believed it could rely on the global LNG market for reliable and cheap gas. Unfortunately, most LNG tankers head to Asia, a trend that can only increase as power-hungry Asian countries wean themselves from coal and oil.

The exploitation of new energy sources in the U.K. is no less contentious than in the U.S. A good illustration of this would be the tussle over the development of the Cambo oil and gas field in the waters near Scotland. Opposed by environmentalists who cite the inevitable carbon emissions the project and its oil would produce, the project offers to ease London’s energy woes and provide around a thousand jobs. The Johnson government has yet to indicate whether it will approve the project.

London’s options are few and leaving the country reliant on market conditions means risking shortages. For this reason, it has reportedly asked Qatar to agree to become the “supplier of last resort” in case global suppliers are unavailable. 

---

Go beyond the headlines with expert perspectives on today’s news with The Cipher Brief’s Daily Open-Source Podcast.  Listen here or wherever you listen to podcasts.

---

The Cipher Brief: What’s the Russian angle to the energy story?

Roule: Upfront, I think we should worry whether Russia will perceive the energy crisis as offering an opportunity for aggression. What if Moscow decides its gas hold over Europe allows it to invade Ukraine without penalty? Or as a means of pushing German regulators to accelerate their approval of the Nordstream II pipeline?

Moscow insists that it is meeting contractual obligations and that its exports have increased in the past year. At the same time, there are routine reports that Russia’s gas supplies to Europe have not only not met requirements, but that gas flow reversed in the Yamal-Europe pipeline. Russia also maintains eight gas storage sites in Europe to help manage supply during high-demand periods. Gas levels at these sites are currently low. Critics claim Gazprom diverted production to Russian domestic storage and that exports in October fell to the lowest level since 2014. When pressed, Moscow explains shortages saying that it must fill its winter supply stocks and expects to send Europe additional gas this week. 

But if the current energy dynamic seems to be in Russia’s interest, Moscow’s long-term prospects are dim. A global shift to renewable energy sources forces Moscow to reckon with the prospect of holding a massive oil infrastructure of little commercial value. If so, future historians may look at the recent Glasgow climate summit as a significant step in accelerating Russia’s decline, possibly a new era of aggression as it seeks to accumulate power ahead of this decline or a more competitive race for market share against OPEC members.

The Cipher Brief: What about China?

Roule: No major country has endured such energy problems in recent months as China. After weeks of rolling blackouts, China looks well on its way to solving its coal problems that partially contributed to this situation. That won’t delight environmentalists, but it should ease China’s electricity problems and ensure its citizens stay warm this winter. Winter arrived early, and Beijing is about to see its first snow of the season. China’s efforts will be put to the test in a winter that many expect to be colder than 2020.

Longer-term, China still must work through the causes of this crisis. If the global economy continues to surge demand for Chinese products, its energy requirements will grow. Weather problems cut wind production; floods shut mines. We shouldn’t be surprised if such problems continue. Inevitably, China can only meet its climate goals by shifting from coal to natural gas, raising prices for other consumers.

The Cipher Brief: Let’s shift to North Africa.  Algeria recently closed a long-established pipeline that transited Morocco to deliver gas to Spain.  Will this impact Europe’s already tight gas situation? What’s the story here? 

Roule: Over the past year, Algerian relations with Morocco have steadily deteriorated.  In addition to their traditional disagreement over the status of Western Sahara and the Polisario, Algiers criticized Morocco’s renewed ties with Israel and accused Rabat of supporting an opposition group that Algeria claims ignited forest fires. Algiers closed its airspace to Moroccan flights and accused Morocco of killing several Algerian citizens in the Sahara region.

Here’s how it touches the energy picture. On 31 October, Algiers closed an 800-mile pipeline that carried Algerian gas to Spain via Morocco and the Strait of Gibraltar.  The closure cost Morocco a portion of the gas it used from the pipeline. Morocco used this gas to produce about a tenth of its electricity. Rabat claims it can use other energy sources for this purpose. However, Spain has little gas and derives a significant portion of its electricity from that which it must import. Algiers claims it will make up the loss through a secondary pipeline, but the loss of gas will compound the energy problems of Spain and Europe in general.

The Cipher Brief: Any other issues on the horizon we should consider?

Roule: A growing number of aging refineries in the West will be closed in the coming years.  However, Asia is the new center for refinery construction. This expansion will draw even more crude to the region for processing with the inherent impact on local economies and global consumers.

The Cipher Brief: Last, let’s touch on wild cards. What are the grey swans that might impact markets in 2022?

Roule: With low stockpiles and supplies, the energy topography is ill-prepared to sudden shocks to its production or distribution architecture. Yet, it faces three threats that have grown in the last decade.

First, we have climate change issues.  Increasingly harsh weather events have shut down large portions of the production and refinery sectors in the United States and Mexico, sometimes taking weeks to restore normal production. Second, we have the universe of cyber threats.  State and non-state cyber actors routinely probe or attack every aspect of the energy industry. Last, we have new geopolitical pressures.  Tensions are rising with China as well as Iran and its proxies. Three of the world’s six most significant shipping channels are in the Middle East and a fourth in Asia.

Join us for a Members Only Brief with Norm Roule on Thursday, November 18 at 1:30p.  Cipher Brief Members receive invitations via email.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The post Winter is Coming: Global Energy Markets and the Impact on National Security appeared first on The Cipher Brief.

This piece was first published by RUSI in London.  The views do not represent those of RUSI.

EXPERT PERSPECTIVE –The international community is coming under increasing pressure to recognise the Taliban and to unfreeze Afghan funds held by the IMF or to risk a humanitarian crisis over the winter and a resurgence of international terrorism.

As Afghanistan heads deeper into winter the desperate need is to avoid a humanitarian crisis. The World Food Programme has launched an appeal to feed up to 23 million people and Médecins sans Frontières have followed suit in the healthcare field. Fortunately, the distribution mechanisms are in place inside Afghanistan; what is needed is for the international community to ensure that UN humanitarian programmes are fully funded. This will require Western capitals to get over the shock of their recent defeat. It goes without saying that hunger and health should not be used as instruments of political leverage.

Meanwhile, it is becoming ever more apparent that the Taliban do not have the skills to administer a country which is far more complex than the Afghanistan of 1996 – when they began their previous and disastrous spell in office. They will need international assistance to stabilise the economy, get people back to work and, in time, continue the gradual infrastructure improvements which have been underway since 2002. China will doubtless be willing to assist in some areas but Beijing has already made clear that it is adopting a cautious, gradualist approach. However, there are emerging indications that the Taliban’s intransigent views are beginning to relax; such as their approval of the polio vaccination scheme and their willingness to work with UN humanitarian agencies.

The Taliban will also need outside help in defeating the threat from the Islamic State’s Khorasan Province (ISK). Already the Taliban are finding it difficult to counter similar asymmetric tactics which they used so successfully against Western forces. This is likely one of the subjects which CIA Director William Burns discussed with the Taliban during his visit on 24 August and where there is a mutual interest.

What can the international community (not just the West) realistically expect from the Taliban, following the militant group’s stunning victory? Maximalist demands will inevitably get short shrift.

---

The Cipher Brief hosts private briefings with the world’s most experienced national and global security experts.  Become a member today.

---

First, the Taliban should form a more inclusive government. According to multiple sources, the Taliban were intending to form such an administration had Ashraf Ghani not fled the country on 15 August. I am sceptical that this was ever their intention but former president Hamid Karzai and former reconciliation chief Abdullah Abdullah may have remained in Kabul on this understanding and Fatima Gailani, a former negotiator, insists this was the Taliban’s intention.

An inclusive government would need to include women and non-Taliban representatives from the Hazara, Uzbek and Tajik communities. It need not comprise the failed politicians and bloodstained warlords of the past, least of all Gulbuddin Hekmatyar and Abdul Rashid Dostum. It is surely time for a new generation of more technocratic Afghans to become involved in government. Some may be persuaded to return from abroad but they will need assurances for their safety.

Second, the international community should insist on female education at all levels be restored and for women to play a fuller role in society. The Taliban will baulk at this but they only need to look at Pakistan where women play an important role in an avowedly Islamic, if not Islamist, society.

Third, all neighbouring countries, as well as the wider world, want Afghanistan to commit to removing all terrorist bases and terrorists from its soil; not just ISK and Al-Qa’ida but also the Eastern Turkistan Islamic Movement, the Pakistani Taliban (TTP), anti-Iranian and anti-Indian groups, and Central Asian militant movements including the Islamic Movement of Uzbekistan.

Fourth, the Taliban should commit to allow people to join their families in exile if they wish and also cease the continuing search for and punishment of those Afghans who served the Afghan government and Western allies since 2001.

---

Go beyond the headlines with expert perspectives on today’s news with The Cipher Brief’s Daily Open-Source Podcast.  Listen here or wherever you listen to podcasts.

---

In an ideal world there would also be a fifth request: to remove Haqqani network members from the Taliban administration. However, that pass was sold when the US negotiator Zalmay Khalilzad engaged with the Haqqanis in Doha – another result of that calamitous dialogue. Furthermore, the current reality is that the Haqqanis control both Kabul and its airport and Sirajuddin Haqqani holds the key position of interior minister.

Instead, the Haqqanis need to be persuaded to prevent Al-Qa’ida regrouping in Afghanistan. Sirajuddin’s father was close to Osama bin Laden and the group retains its Al-Qa’ida connections. Pakistan is already using the Haqqanis to bring the TTP to the negotiating table. It remains to be seen how successful this will be. It is doubtful that the Haqqanis would be willing to take military action against a group from a similar area in the tribal borderlands. However, the Haqqanis could be useful as intermediaries, if not as enforcers.

Meanwhile, the wider Taliban, usually referred to as the ‘Kandaharis’, are increasingly exasperated by the entryist Haqqanis. Although they have worked together, there was never much love lost between the two. The Kandaharis have always distrusted the Haqqanis’ proximity to the Pakistani military. Since the Taliban takeover of Afghanistan, Mullah Abdul-Ghani Baradar, whose willingness to negotiate with the Kabul government in 2008 and 2010 earned him eight years in a Pakistani prison, has been sidelined. There will doubtless be a reckoning

A lasting regret of the US’s careless withdrawal is that Washington did not conclude a broader settlement for Afghanistan involving China, Iran, Russia, India and the Central Asian Republics. From now on it is essential to include all the neighbours in the discussion of recognition and the conditions required. But first the Afghans must be helped to survive the winter.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The post What Stands Between the Taliban and Recognition appeared first on The Cipher Brief.