6

Implications for U.S. Intelligence

The committee believes that concern regarding the future of encryption that triggered the Office of the Director of National Intelligence (ODNI) to request this study is well founded. The future raises significant, if not critical, issues for the Intelligence Community. Regardless of which scenario envisioned by this study (or another one not so envisioned) develops, the committee believes that encryption will change in fundamental ways that will pose challenges across all aspects of intelligence. Simply put, in an increasingly digital world there will be much more data, more and more of which will be encrypted. At the same time, efforts to attack or disrupt encrypted systems—government, personal, and private sector—will also increase. In short, the committee is positing that encryption will be a far more significant factor in the Intelligence Community’s discharge of its mission—even without regard to specific developments in quantum computing.

Encryption is both a necessary capability for U.S. intelligence in protecting various intelligence activities and communications and also a challenge when it comes to collecting intelligence. Offense and defense, or decryption and encryption, are both absolute necessities for successful intelligence operations. This duality also complicates how the Intelligence Community can or should deal with future encryption issues. At a minimum, the future of encryption is an issue for collection, analysis, and security, but more broadly, for the recruiting, retention, operations, and political and intergovernmental relations functions of the Intelligence Community. Most significantly, given the unpredictability of many of the trends discussed in this report, as previously noted, there will be a premium on accurate detection of trends at the earliest possible stage and managing the risks of incorrect assessment. In short, the future will be different in several important ways for the Intelligence Community.

THE DIFFERENT ROLE OF ENCRYPTION IN THE PAST

For a variety of reasons, encryption played a more circumscribed role in the past. One reason is that the United States, and U.S. intelligence, have long been leaders in encryption and related areas, relative to foreign adversaries. As a result, in the absence of significantly increasing technical challenges that threatened to thwart its mission, the Intelligence Community had the luxury of continuing its relative superiority in this area. But now, with more adversary nations (especially China) seeking and making advances in encryption and as academic researchers (especially in Europe) continue to invest in cryptography and advance the theory and practice of encryption, especially of applied cryptography, the committee believes that the advantage that the Intelligence Community enjoyed in this area will diminish if not disappear.

Another factor is the sheer increase in the number of adversaries to which the Intelligence Community must pay attention. Since 1991, U.S. national security has not had the luxury of dealing primarily with one dominant threat, as was the case during the Cold War. Multiple concerns demand equal attention as the most compelling or potentially most threatening. As DNI James Clapper noted in his Worldwide Threat Assessments in 2012 and 2013, “it is virtually impossible to rank—in terms of long term importance—the numerous, potential threats to U.S. national security … it is the multiplicity & interconnectedness of potential threats … that constitute our biggest challenge.”

Recognition of the variety of threats was a major factor in the creation and adoption of the National Intelligence Priorities Framework (NIPF) in 2003. The NIPF is driven by a prioritized list of issues, as determined by the members of the National Security Council. The committee assumes that there is no NIPF issue for the “future of encryption” per se. This issue likely falls within two broader issues that have also been noted by DNI Avril Haines in her 2021 Annual Threat Assessment of the U.S. Intelligence Community: cyber and emerging technology. The committee further assumes that cyber is already in the top priority tier and that emerging Technology is either in that top tier or one close to it.

Thus, with a greater number of adversaries generally, a wider range of threats to national security, increasing uses of encryption in all manner of communication and information storage, and ever more sophisticated adversaries using encryption (for both offense and defense), the Intelligence Community will need to deal with the issue of encryption in a more direct and profound way. As explained below, this raises broad questions of whether the Intelligence Community is most effectively positioned to undertake that task, and how the substantive activities of the Intelligence Community might have to adapt to a future world in which encryption is a more problematic challenge.

EFFECTIVE STRUCTURES TO ADDRESS ENCRYPTION

An initial question for Intelligence Community leaders is how best to handle the issue of the future of encryption. At a high level, the committee also notes that although policy makers may appreciate in broad terms that encryption is an important, serious, and complex issue, few of them will have the technical expertise to understand the issue in any depth. Therefore, it is incumbent upon the Intelligence Community to make clear to policy makers what is at stake, what is the nature of the near-term and longer-term threat, what are the opportunities, and what are U.S. options to deal successfully with the full array of encryption issues. On an operational level, major responsibilities will likely fall to the National Security Agency and also U.S. Cyber Command, but neither of these is an all-source analytic agency. Fully addressing encryption topics would therefore require participation by analysts from the Central Intelligence Agency and the Defense Intelligence Agency (DIA), and perhaps the Department of State’s Bureau of Intelligence and Research (INR), which are the three all-source analytic agencies.

Three further issues arise. The first issue is whether or not there currently exists within the Intelligence Community the requisite talent and capability to deal with the full range of policy and technical matters that relate to encryption. Past efforts at establishing expertise databases have not been overly successful. If the requisite talent is not on hand, then it will have to be recruited. Here, the Intelligence Community faces the issue of competition with the private sector, which can offer much more lucrative salaries, stock options, and potentially career opportunities. The U.S. government as a whole, and the Intelligence Community in particular may have to adjust personnel policies and expectations to accommodate individuals who do not plan to spend their entire careers in government, or who go in and out of government jobs. This may be especially challenging for intelligence, given security requirements.

An additional directly related matter is the highly dynamic nature of research and developments in the encryption field. For example, although government analysts may be able to monitor academic research in encryption,

they may have a much harder time understanding the motivations and plans of commercial entities that integrate encryption into products and ensure the wide proliferation of encryption technologies. It is difficult to keep abreast of these developments, especially for government officials who have full-time jobs away from academia and industry. This further suggests that it may be necessary to refresh the workforce that deals with matters related to encryption on a periodic basis.

Alternatively, the Intelligence Community should consider keeping in touch with, and perhaps contracting with individuals whose knowledge and skills can be beneficial. It is important to keep in mind that security clearances should not be major impediments here. These outside experts are sharing their knowledge and expertise with the Intelligence Community. (Specific situations involving sensitive interests in specific technologies or cases where an association with a person is sensitive can be handled on an individual basis.)

The second issue is the question of how these intelligence efforts regarding encryption across several agencies can be coordinated to ensure the sharing of information about the encryption issue, threats, developments, and opportunities.

The third issue is that the various capabilities discussed in this study—whether to create successful encryption or to defeat encryption—require strong technical capabilities in terms of both technology and people. However, decisions about the use of encryption or efforts to defeat encryption will likely be made by people who do not have and—in general—do not need these same technical skills. These people will be policy makers, who bring a variety of skills and backgrounds to their jobs and to the decisions they make. (As an analogy, consider President Harry Truman’s decision to use the atomic bomb. Truman was not a physicist, and he could be given only a rather rudimentary understanding of what the use of the bomb would entail, as none had ever been dropped on a city.) Therefore, it will be imperative that the technological explanations of encryption decisions are made in such a way that non-technical people can understand them and make appropriate decisions. This can sometimes be problematic as there will be a “communications gap” between the technologists and the policy makers. It is incumbent on both groups to try to understand one another but the greater burden will lie with the technologists to ensure that policy makers have a firm and comprehensible basis for their decisions.

It would also be useful for the Intelligence Community to conduct an assessment of current capabilities—collection, analysis, and security—to deal with the encryption issue, as well as a projection of what will be needed in the future.

HOW THE INTELLIGENCE COMMUNITY MAY NEED TO ADAPT TO THE FUTURE WORLD OF ENCRYPTION

The complexities of the future of encryption not only raise organizational issues but also pose challenges to the way the Intelligence Community conducts its mission in practice. Those challenges stem principally from the fact that each of the scenarios described above posits a more fragmented world. A fragmented world suggests a greater multiplicity of hardware and software and perhaps even national Internets that are to some extent separated from the more unified Internet of today. This will increase the range of places and actors that have to be watched and will also likely increase the likelihood of less capable—or more buggy—software. All of this will increase the collection and analysis burden. This can be a threat if some of this software is used within the U.S. government but also an opportunity in terms of gaining access to others’ systems if they are using these tools.

A fragmented world also has possible political implications for U.S. intelligence. It can suggest a loosening of alliances or a decline in cooperation among intelligence partners in specific areas, such as signals intelligence or encryption. Democratic governments may come under popular pressure to take on more nationalistic approaches to some issues—as was the case with New Zealand in the 1980s when their anti-nuclear policy led to their “suspension” within the Five Eyes intelligence alliance. Demands for greater privacy or uneasiness about some aspects of international cooperation could be such drivers. The reactions within Europe to the disclosures by Edward Snowden are an example.

Fragmentation involves more than nation states and is a current problem, across both government and private sectors. The United States has gone from a focus on one dominant threat—the Soviet Union—to multiple threats. In military terms, this is still limited to a finite number of nation-states. However, in the realm of cyber and emerging

technology, the United States is already dealing with many states and with many non-state actors, either working independently or in league with nation-states. The ubiquity of computer technology and the very low barriers to entry make this multiple threat very real. Although only a few nations may be able to defeat the most sophisticated defenses, experience has shown that many defenses are “chaotic” and subject to attack by numerous unsophisticated actors. It is also possible that the United States may have to deal with hostile non-state “cyber” alliances that will be difficult to discern and to assess. This is a level of multiple threats much greater and more complex than has been the case in the past, again raising issues within U.S. intelligence of responsibilities and coordination.

This report posits that while the availability of a large-scale quantum computer sufficient to attack current public-key encryption is uncertain in a 20-year time frame, other developments in the realms of scientific advances and the integration of encryption into systems are likely to alter the encryption challenges and opportunities facing the U.S. government. The Intelligence Community will be responsible for keeping abreast of these developments, some of which will undoubtedly not occur in the open. This, again, raises issues about collection and analytic capabilities.

Last, the Intelligence Community will continue to be responsible for warning against major cyber intrusions, whether against government systems or in the private sector. The committee sees no reason to expect a decrease in these attacks, which in turn will affect perceptions of and perhaps support for U.S. intelligence.