-Caveat Lector- from: http://cryptome.org/nsa-reorg-et.htm Click Here: <A HREF="http://cryptome.org/nsa-reorg-et.htm">NSA External Team Report on Reorganization</A> ----- 17 October 2000 Source: http://www.nsa.gov/releases/nsa_external_team_report.pdf (27 pages; 2.7MB) This is one of two reports released 17 October by the National Security Agency on recommendations for its reorganization (after releasing them to Inside Defense under FOIA request): http://www.nsa.gov/releases/reports.html The second is a 76-page report, "New Enterprise Team (NETeam) Recommendations: The Director's Work Plan for Change," 1 October 1999: http://cryptome.org/nsa-reorg-net.htm ------------------------------------------------------------------------ [27 pages; undated, probably 1999, released 17 October 2000] NATIONAL SECURITY AGENCY CENTRAL SECURITY SERVICE FORT GEORGE G MEADE, MARYLAND 20755-6000 When I arrived at the National Security Agency/Central Security Service (NSA/CSS) over a year ago, I was told by many people within the Intelligence Community -- and by lifelong NSA employees -- that in order to meet the challenges of the new millennium, the Agency must undergo a deep, purposeful transformation. The evolution of technology dictated change within the Agency and was the impetus for self-examination and introspection. More importantly, our customers and Congress, along, with other external groups, were pointing to much inefficiency in the way we manage our assets, our leadership, and our approach to technology. To that end, I commissioned two teams of experts to assess NSA's personnel. culture. organization and processes and to present detailed recommendations for improvement. To ensure that the teams were diverse and well represented, I mandated that one team would comprise Agency employees; the other team would comprise representatives from industry. Both studies have been declassified and are enclosed for your information, Though the teams attacked the study from diverse perspectives and approaches. their conclusions and recommendations were remarkably similar. Both teams agreed that NSA needed to make many difficult, essential changes in order to continue to maintain its place on the cutting edge of technology. Both teams agreed that NSA needed to improve in the following areas: governance, culture, vision/mission/corporate strategy, resource management, communicating with our customers/partners/stakeholders and business planning. I listened to both teams and I have taken important pieces of each report to heart. Some of the recommendations in the reports were adopted immediately; others are still being considered. To gain the momentum for significant change, I initiated a period called. "100 Days of Change," which lasted from 15 November 1999 to 30 March 2000. From the onset, I stated that "100 Days," was just a beginning -- a starting line from which NSA can begin to transform into a first-class, 21st Century agency. We have begun to change our ethos, which is more than changing our culture because we must change the way we think, feel and act. We have begun the difficult tasks of eliminating non-essential activities, introducing disciplined decision-making into our processes, and holding our leadership accountable. We have improved the ways we communicate within the Agency and to the public. Where we need help and new perspectives, we have selected outside talent in key positions. Our goal is an Agency that is more aware of itself and its role in national security, more agile in its ability to respond to challenges and opportunities, and more collaborative with its partners, customers and stakeholders. Transformation is never easy, but for NSA it is compulsory. We have moved out and have created the momentum for change. Further changes will come in the future as we strive to make progress and reach our goals. We are making the needed course corrections to ensure that NSA meets new challenges and is true to its mission in providing and protecting information essential to the national security of our nation. [Signature] MICHAEL V. HAYDEN Lieutenant General, USAF Director, NSA/Chief, CSS Enclosures: As Stated ------------------------------------------------------------------------ EXTERNAL TEAM REPORT A Management Review for the Director, NSA October 22, 1999 _______________________________________________________ List of Acronyms CBJB - Congressional Budget Justification Book CIA - Central Intelligence Agency CINC - Commander-in-Chief CFO - Chief Financial Officer COO - Chief Operating Officer COS - Chief of Staff DCI - Director of Central Intelligence DDCM - Deputy Director for Corporate Management DDI - Deputy Director for Information Assurance DDO - Deputy Director for Operations DDS - Deputy Director for Support Services DoD - Department of Defense EPA - Employee Promotion Assessment ETR - Engineering, Technology and Research IAM - Information Assurance Mission IG - Inspector General InfoSec - Information Security JMRR - Joint Military Readiness Report KAL - Key Agency Leadership NCS - National Cryptologic School NSA - National Security Agency NSAAB - NSA Advisory Board NSRL - National SIGINT Requirements List OPP - Office of Plans and Programs PMC - Program Management Council PM - Program Manager SALT - Senior Agency Leadership Team SCE - Service Cryptologic Executive SE - Systems Engineering SES - Senior Executive Service SETA - Scientific Engineering and Technical Assistance SIGINT - Signals Intelligence SIM - Signals Intelligence Mission UCA - Unified Cryptologic Architecture USSID - United States Signals Intelligence Directive ------------------------------------------------------------------------ Introduction Upon assuming command of the National Security Agency (NSA), Lieutenant General Michael V. Hayden, USAF, commissioned two management review teams, one comprised of NSA employees and another composed of five outside experts, named the External Review Team. This external the External Review Team began its work on August 9, 1999 with the stipulation that it would report to the Director, NSA within 60 days. General Hayden was briefed on The External Review Team's findings and recommendations on October 12. This document constitutes the final report of the External Review Team. The five members of the External Review Team consider it a great honor to have been asked to participate in this important work. ne NSA has long been one of America's preeminent governmental institutions whose successes, like those of its sister intelligence agencies, must often go unheralded. However, the need for secrecy, so critical to mission success, can also breed insularity, which is counterproductive to effective management. This report aims at specific suggestions to the Director which will be actionable and which will produce rapid results. There have been a number of significant studies of NSA in selected areas over the past decade. Almost all have been done extremely well and offered good recommendations. But almost none of these recommendations have been implemented in a meaningful manner. A major challenge facing NSA has been to understand why no action has occurred on the many previous excellent recommendations from multiple sources, and what can be done by General Hayden to ensure constructive change moving forward. We have been extremely impressed by the dedication and skill levels of NSA employees at all levels, but recognize from our own experiences in business and in government that individual actions are usually not enough to initiate corporate-wide change. It took new Chief Executive Officers at IBM and AT&T to re-energize those previously distinguished businesses. It is our expectation that General Hayden will fulfill that same role at NSA. The majority of senior level employees with whom we spoke believe that this entire series of managerial issues has come to the fore as a result of the ongoing reduction in resources, i.e. budget cuts, combined with an expanding demand for its excellent work. NSA funding has been reduced dramatically over the last several years. Unanimously, the External Review Team believes that the managerial issues would be no different should prior funding levels be restored. Money alone is not the answer. The NSA mission is a cornerstone of many other aspects of American intelligence work. NSA is too critical to the well-being of our society today, and tomorrow, for the Agency to be allowed to function in a sub-optimal fashion. The House Permanent Select Committee on Intelligence has, correctly in our opinion, directed NSA to "change your culture and method of operations." The only question is how this might best be accomplished. Tasking and Methodology The External Review Team was specifically tasked to review prior studies and reports (including the recent Clapper Brief) and evaluate Congressional language as it relates to NSA reform. We were asked to assess NSA's personnel, culture, organization and processes, to document our findings and to present detailed recommendations for improvement. The Director placed no constraints on the scope of this study. However, Congress, the Secretary of Defense and the DCI expect "significant change" in how the Agency does business. Our methodology was to research governing and historical documents and to review prior studies and investigations. We interviewed over one hundred people (both within and without NSA), including Agency seniors, mid-level and working staff, Congressional staffers and various NSA management teams (including the Senior Agency Leadership Team [SALT]). The External Review Team met weekly to receive corporate briefings, hold meetings with senior level personnel and update the Director on the study's progress. After collecting and analyzing all the data, The External Review Team formally briefed General Hayden and prepared this report. Findings We determined many good features of the Agency throughout the report. We agreed that at least the following aspects of the Agency were positive: * Stakeholders consider the Agency to be critical to national security * The Agency has certain world-class competencies * The leadership and staff care deeply about their institution * The institution cares about its people * The Agency has responded well in the past to national crisis. However, we enumerated many issues throughout this report. We agreed there are at least ten significant areas of concern: * Poorly communicated mission and lack of vision * Broken decision making process which is demonstrated by a lack of accountability and empowerment * Poor financial management * Broken personnel system * Broken requirements process; timeliness, responsiveness, constraints, and other key parameters are not being properly considered * Inadequate business management, program management, and system engineering * Poor stakeholder relations, particularly with Congress * Inward looking culture * Risk of technology obsolescence, gap with commercial practice * Dissatisfaction with senior leadership (even within senior leadership). The most serious issues are leadership, accountability, and empowerment, as evidenced by great dissatisfaction with decisionmaking within the Agency. Business Model - Organization The present NSA organization has been in place, generally in its current form, for some period. It works well enough to do some of the missions and get some intelligence product out the door, but we question whether this form best complements leadership, the creation of plans, the flow of money and the need for responsibility, accountability and empowerment throughout the workforce. An organization should allow the leadership to operate the Agency efficiently and dynamically. It should facilitate rapid response to change, yet permit leaders to know and be able to tell stakeholders just where things stand at all times. What follows is the description of a new organization without reference to specific individuals who currently occupy positions of similar responsibility. We prefer to outline a pure, functional organization with responsibilities and relationships. Fundamentally, NSA should be organized to best perform its two operational missions (the production of signals intelligence and providing information and infrastructure assurance), and to create and use the technology required to perform these two missions. All other NSA functions, which traditionally have reported high up the Agency structure, (often to the Director), now would be identified as staff functions and would report as Director's staff or to one of several operational staff elements. This key change removes Agency support leadership from an operational decision-making role. By placing control and responsibility for on-going Agency activities into the hands of the operations and technology organizations, authority and responsibility for performance are driven down as far as possible, placing programmatic and budgetary decisions as close to the intelligence problem as possible. The job of the Director is to lead the Agency. All authority and power derive from the Director, who reserves all decisions not formally delegated to others. In practice, the Director will actually run the day-to-day operational affairs of the agency through a COO, a new position we have created. Freed of moment-to-moment operational responsibility, the Director may develop high-quality relationships with such essential external partners as the Secretary of Defense, the DCI, Congress and Congressional Staff, military, Commander-in-Chiefs (CINC), the Secretary of State, the law enforcement community and others as appropriate. We believe that much of the future success of NSA is tied to high-quality working relationships with Intelligence Community partners and all NSA stakeholders (see the chapter Stakeholder Relations). We have been persuaded that the CIA-NSA relationship is an essential element of a successful Global Network strategy. We are certain that the support and trust of the Congress must be regained and carefully nurtured. It is imperative therefore, that the Director takes the lead in establishing and maintaining personal relationships with these partners and that he have a high-level office to support him in this critical function. Recommended Organization [Original poor; redrawn by Cryptome] The Director makes decisions with the advice of the Key Agency Leadership (KAL) team, which replaces the current SALT. Members of the KAL, the Director, the Deputy Director, the COO (representing the operations and engineering organizations), the CFO, the Director's COS, the Chief Council, the Inspector General (IG), and the Deputy COO for Military Affairs. Others may be invited to meetings to present or elaborate on issues, but will not sit as members. From the composition of the KAL, it should be clear that all members attend to advise the Director. The KAL is not a voting body. KAL meetings exist to debate and frame issues on cryptologic policy, Agency mission, and items of corporate importance for Director decision. The KAL should meet regularly as required. An outside board called the NSA Advisory Board (NSAAB) will also advise the Director. Comprising ten people or less, the board includes two each of luminaries from the Intelligence Community, corporate non-government executives, technologists and retired Service Cryptologic Executive (SCE) and/or geographic CINCs. The NSAAB will take a very active role to help the Director, and will take a direct hand 'in identifying and grooming future Agency leadership. Specifically the NSAAB should: * (U) Evaluate the performance of the Director's leadership team by regularly reviewing measures of effectiveness * (U) Evaluate and recommend next-generation leadership by becoming exposed to lower-level NSA activities and successes * (U) Market the Agency's message in circles outside NSA * (U) Monitor technology by regularly comparing NSA technology with that from the outside. This NSAAB should be quite vigorous and active. Members should be recruited for their boldness and enthusiasm, and should be well compensated for the significant amount of work they will do. Board members will contribute about one month per year, spread across the year. The Deputy Director, a true deputy, not responsible for Agency operations, backs up the Director. This senior cryptologic officer would be responsible for Agency strategic planning, using resources throughout the Agency for support. The Deputy Director would assist in corporate issue resolution and external relations, and would work selected cryptologic issues as appropriate. The Deputy Director would act on the Director's behalf and would serve as the Director's emissary when so directed. The Director's COS would control the Director's schedule and assist in the paper flow. The COS would determine, through trial and error, what the Director wishes to see and hear, which issues and decisions should be considered important, and how often and in what forms meetings are to be held, so that the COS may schedule the Director's time wisely. The COS is responsible for preparing issues for KAL meetings. The COS may act on behalf of the Director when so formally directed. The COS should assist the Director in communicating with the workforce through regular written "DirectorGrams" and live messages. The CFO is a new position to take responsibility for the management of the flow of money required for the Agency's business. The CFO will manage the NSA budget process, guarantee the fiduciary integrity of NSA, conduct internal audits and ensure the professional training of the Agency financial corps. The CFO will create targets and benchmarks for Agency financial performance and coordinate activities internally and with the DCI, DoD and Office of Management and Budget as appropriate. In sum, the CFO will restore confidence that NSA is managing its money wisely in the execution of its mission. Financial displays generated by the CFO will make it readily clear how much money is required for the NSA mission, and how much more money would be required to take on a larger mission. The CFO position would be good for an outsider. The Legal Department will function as it does now. It will closely advise the Director and operating elements on critical legal issues and interpretations as the Agency moves into the new mission areas. Its role should be to facilitate the execution of Agency business. The legal staff must be current on administration legal policy, international law and related disciplines. Stakeholder Relations will perform the very important external relations and image management tasks (See the chapter Stakeholder Relations). We recommend more openness and familiarity with stakeholders by the Agency. NSA should modify its "withholding evidence" image. Improved public relations can help overcome the "Super Secret NSA" image that is no longer useful to Agency needs. The IG duties remain the same with one addition. We recommend the IG monitor NSA progress in achieving the recommendations set forth by this panel. The Director and the entire staff as denoted above, should be collocated in one hallway on one floor of the building. Our creation of a COO may be the most significant change to the traditional NSA organization. We are emphatic that the very significant issues of "SIGINT/INFOSEC equities" and "operations requirements versus technology development" be managed correctly. From a sources and methods perspective, we are eager to see the SIGINT Mission work very closely with the Information Assurance Mission, since they are rapidly becoming two sides of the same coin. At the same time, the technology required to support both operations is converging, especially in the Global Network arena. We feel therefore, that close coordination among these organizations is mandatory, and too important to be left to the vagaries of the coordination process. We elect then, to recommend the subordination of the two operations organizations and the one technology organization under the COO, who would be responsible for all Agency operations and technology development, and the support systems and administration they require. We do not encourage any merging of operations and technology development organizations. We believe that a natural tension should exist between the operations that require technology, and the technology developers who crave requirements. We believe that both applied and pure technology should be developed. Applied technology tied closely to operations by requirements and funding, and pure technology much more free of specific operational requirements, with the independent funding, to explore the realm of the possible in order to help both the technology and operations organizations anticipate future technological developments and leaps. If both operational requirements and pure science driven technologies can be encouraged, then bringing together the operations organizations and the technology organization at the COO level will suffice. The COO is responsible for NSA operations. The COO could come from outside NSA, but should have strong Intelligence Community experience. Operational planning and funding is performed by a function of the COO staff in coordination with the CFO. Operations Planning and Programming will help build the operations and technology funding plan for the COO by imparting an Agency strategic perspective to mission and technology needs. Agency support functions will be outsourced wherever possible. The current Deputy Director for Services (DDS) and DDCM organizations are abolished and functionally re-subordinated under the COO. Agency support to military operations and responsibility to the SCEs are advocated and managed by the Deputy COO for Military Affairs. This very important charter responsibility is placed close to operations, where it may have the most direct day-to-day influence. However, by placing the Deputy COO for Military Affairs on the Director's KAL, proper military voice is heard at the strategic planning and policy formulation level. The National Cryptologic School (NCS) had a reputation as a superlative trainer of cryptologists and crypto-technologists. To regain that reputation, the NCS should be revitalized as a first class institution for training in unique cryptologic skills. The NCS should be kept current, especially in the technology-oriented disciplines, by the use of outside educators. We place the NCS under the COO administration and support function so that it may be attentive to operations and technology needs. The COO executes operations through the three organizations (two operations and one technology) that we have referred to previously. The operations organizations are called the Signals Intelligence Mission (SIM) and the Information Assurance Mission (IAM), which are similar to the now-abolished Directorates of Operation and Information Security. The technology organization is called Engineering, Technology and Research (ETR). The new organizations are sufficiently different from their predecessors to warrant a change of names. More importantly though, is the need to divorce paradigms and loyalties from the past, and re-form bonds to new entities. The new organizations are linked intimately to mission and development both functionally and financially. Since all three implementing organizations report to the COO, leadership in SIM, IAM and ETR focuses downward, concentrating on getting the tools and running the missions that define the Agency's place in the Intelligence Community. The SIM will organize to follow access opportunities. We believe that intelligence targets will continue to be increasingly transnational in nature, and that alignment to geographical locations and entities is obsolete. Organizing into three offices, Global Response, Tailored Access and Global Network, would seem to offer the best means to apportion investment to mission, commensurate with the changing nature of the targets. Tracking technical changes in target content and responding quickly to maximize productivity may be made easier when SIM leadership has the authority and responsibility to make such changes internally, answering to the COO for those decisions. We observe, certainly a slowness, and perhaps a reluctance, to move from legacy targets to newer targets. Whatever the attractiveness of known targets and technologies, leadership must decide smartly when to move to more difficult but potentially more lucrative targets. Toward that end, we encourage SIM leadership to increase significantly the investment in Global Network at the expense of investments in Global Response and Tailored Access. Within SIM it is perfectly reasonable to assume that some functions and talents might be best used in a matrix across the offices. We leave decisions at that level up to the new SIM leadership. The Important point is that decisions affecting operations be made in operations, by people willing to step up to the authority and responsibility. Organizationally, the IAM remains largely unchanged from the current DDI. Changes in cash flow management that may affect IAM organization are discussed in the chapter Business Model - Resources Management. The ETR office will change significantly in this new organization. ETR will become the home organization for all engineering and technology people. SIM and IAM will not "own" any engineers. Where and when SIM and IAM require engineering skills, they will be supplied from an engineering matrix managed by ETR. ETR will not deny SIM and IAM access to engineers and technologists. The change in affiliation is to better control the career field, provide training on the latest technology, maximize cross-pollination of ideas and promote the awareness of programs and developments within ETR. These changes should facilitate better make/buy decisions and avoid the needless duplication of technology or solutions. ETR will supply all information technology products and services for mission-support and administrative-support. We believe that the traditional intelligence cycle events of tasking, collection, processing, exploitation and dissemination comprise a critical path that requires careful balance among, its elements. We often hear people ask why we should collect data that cannot be transported, processed or analyzed due to some inadequacy in the chain. Perhaps by assigning responsibility to one organization for the collection devices, selection-and-filtering processors and the wideband-communications backbone required to move the data, improved balance can be built into new programs and systems from the design stage forward. We expect ETR to be the Agency's program management and program acquisition center of excellence. As such, ETR should be well placed to provide the correct level of information-technology support for all Agency programs and administration. To support the Agency's operational mission, we believe that both pure and applied research programs are necessary; ETR is the organization to develop and manage those programs. The requirements of SIM and IAM should drive the applied research program. ETR should listen to the immediate and near-term needs of the operations organizations, take their funding and do applied technology developments accordingly. In the area of pure research however, ETR should take the pulse of the global technology market and forecast which technologies should be pursued. Using Agency corporate funding tied to Agency strategic goals rather than specific operations requirements, ETR should invest in next-generation and beyond technology possibilities in anticipation of future NSA needs. Finally, we place in ETR the key responsibility to perform system engineering and integration within and across all NSA programs to ensure efficiency and to avoid unnecessary duplication. This responsibility marks a major shift in thinking from the way NSA programs usually are formed and managed. ETR must understand operational needs and receive sufficient funding for the development from operations. Then ETR will derive and allocate technical requirements to program systems and subsystems. Programs must be architected. Trade analyses must be performed and decisions made whether to bad program components or buy them from outside suppliers. All elements must be configuration controlled. The development of all portions of the program must be coordinated throughout the program life and managed to cost and performance and delivered in a finished, usable form on schedule. To do this at the level required, ETR must develop a cadre of professional program managers (PM) trained to deliver systems. In practice, the organizations under the COO work closely together to execute the mission of the Agency. Jointly they plan programs to address intelligence requirements, ask for and receive NSA and outside funding, develop technology, tools and other capabilities, execute operational missions, acquire, process and analyze data, and finally, produce and disseminate intelligence product to customers. They act in consonance with Agency strategy and goals and within Agency funding mandates, but are empowered to prepare for and execute the Agency's operational mission with only general oversight. There are many organizational layers not addressed here. We do not intend to make recommendations to the finest detail of structure. It would not be appropriate to preempt the prerogatives of the leadership selected for the key positions that we chose to describe. Rather we have attempted to define an organization that retains the best of traditional Agency structure, but it is clearly focused on the future, while streamlining and introducing some modern business structure and practices. Specifically, we recommend the following action: The Director should implement the organization discussed above ----- Aloha, He'Ping, Om, Shalom, Salaam. Em Hotep, Peace Be, All My Relations. Omnia Bona Bonis, Adieu, Adios, Aloha. Amen. Roads End <A HREF="http://www.ctrl.org/">www.ctrl.org</A> DECLARATION & DISCLAIMER ========== CTRL is a discussion & informational exchange list. Proselytizing propagandic screeds are unwelcomed. Substance�not soap-boxing�please! These are sordid matters and 'conspiracy theory'�with its many half-truths, mis- directions and outright frauds�is used politically by different groups with major and minor effects spread throughout the spectrum of time and thought. That being said, CTRLgives no endorsement to the validity of posts, and always suggests to readers; be wary of what you read. CTRL gives no credence to Holocaust denial and nazi's need not apply. Let us please be civil and as always, Caveat Lector. ======================================================================== Archives Available at: http://peach.ease.lsoft.com/archives/ctrl.html <A HREF="http://peach.ease.lsoft.com/archives/ctrl.html">Archives of [EMAIL PROTECTED]</A> http:[EMAIL PROTECTED]/ <A HREF="http:[EMAIL PROTECTED]/">ctrl</A> ======================================================================== To subscribe to Conspiracy Theory Research List[CTRL] send email: SUBSCRIBE CTRL [to:] [EMAIL PROTECTED] To UNsubscribe to Conspiracy Theory Research List[CTRL] send email: SIGNOFF CTRL [to:] [EMAIL PROTECTED] Om
