Keith Alexander Now Being Vetted By Everybody For Everything After Leaving The Protective Shelter Of The NSA

from the missing-the-old-'No-Such-Accountability'-already dept

Former NSA head Keith Alexander continues to draw the sort of attention he probably hoped he had left behind by resigning his post. His questionable business venture -- a private banking security firm seemingly dependent on patents and methods polished during his tenure at the NSA -- has drawn pointed questions from legislators and a second glance from the internal ethics apparatus of the intelligence agency.

Alexander apparently thought it would be fine for him to use the talents of the NSA's current Chief Technology Officer, Patrick Dowd, for his new private venture. You see, Alexander didn't want the country to lose a bright spy mind, but didn't really want his own IronNet Security firm to go without Dowd's talents either. So he compromised. The country could have Dowd full-time as long as he could spend 20 hours a week securing banks with Chief Keith.

Due to the extra level of scrutiny being directed at everything NSA-related, the agency decided to take another look at the this unholy unethical alliance. It didn't necessarily not like what it saw, but it wasn't absolutely enthralled with it either. But there will be no official statement forthcoming. Alexander has called the whole thing off.

On Tuesday, Alexander said: "While we understand we did everything right, I think there's still enough issues out there that create problems for Dr. Dowd, for NSA, for my company," that it was best for him to terminate the deal.

"Everything right" is apparently the equivalent of basically every other current and former intelligence official interviewed stating, "we've never heard of such a thing," and "pretty much a conflict of interest," etc.

In other news, Alexander's recently disclosed ("disclosed" pronounced "forced out of the NSA's clutches by journalist Jason Leopold's lawsuit") financial statements are gathering a bit more attention as well.

As I noted here, there were some questionable aspects about Alexander's investments, some of which related to government contractors, but nothing that screamed financial impropriety. The conclusion I reached was that the most surprising aspect was the NSA's adamant refusal to release these mostly innocuous declarations. There just wasn't much "there" there, from what I could see.

(The fact that the agency claimed the release of these financial disclosure statements could harm "national interests" was enjoyably ridiculous, but it's also the standard response when asked to open up about anything. Just because "security" is your middle name doesn't mean everything in your possession is instrumental to protecting the nation against terrorist activity.)

Shane Harris at Foreign Policy has done some deeper digging into Alexander's financial statements and excavated some rather strange investment patterns. Harris notes that there's very little in the way of discernible rationale for Alexander's purchases and sales. There's also no indication that any of these trades were very beneficial for Alexander's bottom line. And there's some weird dabbling in some markets where being the head of the NSA would possibly provide more insight than is available to other investors.

The financial disclosure documents, which were released to investigative journalist Jason Leopold and published this month by Vice News, reveal nothing explicitly about why Alexander sold the shares when he did. On Jan. 7, 2008, Alexander sold previously purchased shares in the Potash Corp. of Saskatchewan, a Canadian firm that mines potash, a mineral typically used in fertilizer. The potash market is largely controlled by companies in Canada, as well as in Belarus and Russia. And China was, and is, one of the biggest consumers of the substance, using it to expand the country's agricultural sector and produce higher crop yields.

"It's a market that's really odd, involving collusion, where companies essentially coordinate on prices and output," said Craig Pirrong, a finance professor and commodities expert at the University of Houston's Bauer College of Business. "Strange things happen in the potash market. It's a closed market. Whenever you have Russians and Chinese being big players, a lot of stuff goes on in the shadows."

The same day that Alexander moved his Potash Corp. shares, he also divested himself of his holdings in China-based Aluminum Corp., a state-owned entity that is the second-largest producer of aluminum in the world.

Alexander bought and sold shares in both companies, but never during price peaks or collapses. Instead, his divestments seem to be motivated not by profitability, but by the government's increasing interest in combating Chinese state-sanctioned hacking.

In the spring of 2008, shortly after Alexander sold his positions, senior U.S. officials began to speak on the record for the first time about the threat of cyber-espionage posed by Russia and especially China. Public attention to the intelligence threat was higher than it had been in recent memory. The optics of the NSA director owning stock in a company that his own agency believed may have been receiving stolen information from the Chinese government would have been embarrassing, to say the least.

Those embarrassing optics have been dulled by the passage of time. Withholding these yearly, mandatory disclosures for "national security" reasons has sheltered Keith Alexander from any embarrassing external questions over the last half-decade of investments.

Government agencies are supposed to be on the lookout for not only conflicts of interest, but the "appearance of impropriety." Alexander's investments (and his post-NSA ventures) both sport the outward trappings of impropriety. But everything being questioned now was previously signed off on by NSA officials as being above board. Now, even the NSA is second-guessing itself -- not because it's striving for a higher ethical standard -- but because the standard-operating-procedure of "hide everything" no longer works as well as it used to.

Filed Under: conflict of interest, conflicts, keith alexander, nsa, patrick dowd, surveillance
Companies: ironnet cybersecurity

Keith Alexander Continues To 'Play To The Edges' Of Propriety; NSA Now Checking Out His Partnership With Agency CTO

from the 'private-sector'-doesn't-mean-'no-rules' dept

The long-delayed release of former NSA head Keith Alexander's financial documents failed to generate much in terms of conflicted interests. There was some investment in companies with government contracts, but nothing stood out as a direct connection between Alexander's investments and his previous day job. All things considered, a rather underwhelming set of disclosures, so, of course, it made perfect sense that they had to be forced out of the NSA's hands with a lawsuit, what with their supposed national security implications and all.

No conflicts of interest within the Alexander financial disclosures, as both James Clapper and Michael Vickers attested with their signatures. The agency's official statements reflect this finding. But now the NSA may have to take another look at the recently-exited Alexander, whose entrance into the private sector has been less than graceful.

First, there were questions raised about Alexander's patents and use of "inside information" (read: "national secrets"). Now, there are unanswered questions about Alexander's use of actual insiders -- namely, NSA CTO Patrick Dowd.

The U.S. National Security Agency has launched an internal review of a senior official’s part-time work for a private venture started by former NSA director Keith Alexander that raises questions over the blurring of lines between government and business.

Under the arrangement, which was confirmed by Alexander and current intelligence officials, NSA's Chief Technical Officer, Patrick Dowd, is allowed to work up to 20 hours a week at IronNet Cybersecurity Inc, the private firm led by Alexander, a retired Army general and his former boss.

Dowd's moonlighting gig was originally OK'd by the agency, which found it to be perfectly fine when the signatures were first applied. Now, the agency is having second thoughts. Or, perhaps, first thoughts, judging from what was actually known about this arrangement when the official OKs were first handed out.

The arrangement was approved by top NSA managers, current and former officials said. It does not appear to break any laws and it could not be determined whether Dowd has actually begun working for Alexander, who retired from the NSA in March.

Keith Alexander has attempted to justify this unusual arrangement by saying that this was the best way for he and Dowd to have their cake and eat it, too.

Dowd, he said, wanted to join IronNet, and the deal was devised as a way to keep Dowd's technological expertise at least partly within the U.S. government, rather than losing him permanently to the private sector.

"I wanted Pat to stay at NSA. He wanted to come on board," Alexander said.

He acknowledged that the hybrid arrangement "is awkward," but added, "I just felt that his leaving the government was the wrong thing for NSA and our nation."

So, instead of choosing either option, Alexander chose both -- something officials find highly irregular.

Current and former U.S. intelligence officials, some of whom requested anonymity to discuss personnel matters, said they could not recall a previous instance in which a high-ranking U.S. intelligence official was allowed to concurrently work for a private-sector firm.

The list of officials finding this situation unusual even includes Stewart Baker.

Stewart Baker, a former NSA general counsel, said that he had never heard of an arrangement under which an NSA executive is allowed to work part time for a private company presumed to be involved in some of the same type of business as the NSA.

But in typical Bakeresque fashion, even something he'd never heard of occurring previously is probably still an acceptable thing to do.

"I agree this is unusual," Baker said, adding, "It’s complex, but probably manageable."

Of course, with "complex" meaning "immediately sets off ethical/conflict of interest alarms" and "manageable" meaning "never underestimate the ability of government officials to justify their own malfeasance."

That the NSA would even bother to double-check this arrangement is a positive sign. It indicates the agency is well aware that its every action is still under close scrutiny and that it will be heavily criticized should it appear to care less deeply about national security and national secrets than its ongoing defense of its own existence would indicate. You can't lock everyone out of FOIA requests, budget discussions, legislation attempts, lawsuits, etc. by loudly yelling "national security" any time someone asks for further details -- not when you're allowing a high-ranking official to take half-days at work in order to put in some more time with his buddy in the cybersecurity business.

Filed Under: keith alexander, moonlighting, nsa, patrick dowd, surveillance
Companies: ironnet cybersecurity

Ex-NSA Boss Defends Patenting His Totally Brand New, Not Developed On Gov't Time, Patent-Pending Cybersecurity Brilliance

from the yeah-that's-believable dept

We recently wrote about Keith Alexander claiming that he's worth as much as $1 million a month (actually, the number is now being lowered to $600k) because he's magically come up with a totally brand new anti-hacking concept that will have many patents. As we noted, this story raised all sorts of questions. First, if he had such a brilliant idea to stop hackers, why didn't he use it back when he was in charge of the NSA and the US Cyber Command? His answer to that was that he magically came up with it after he left office in March. Of course, if that's the case, it's difficult to see how it can be worth many hundreds of thousands of dollars per month because it's a totally untested and totally brand new idea. He can't both be claiming that his years of NSA experience make it worthwhile and that this idea has nothing to do with his work at the NSA -- but he seems to be doing exactly that.

Either way, he's given an interview to the Associated Press in which he tries (and fails) to defend himself concerning the new operation, IronNet Cybersecurity:

"If I retired from the Army as a brain surgeon, wouldn't it be OK for me to go into private practice and make money doing brain surgery?" he asked. "I'm a cyber guy. Can't I go to work and do cyber stuff?"

The "brain surgery" analogy is not even close to be analogous. This is more like he was the administrator of an army hospital who has now retired and says, despite never having personally done a brain surgery, he's now invented a miraculous new way to do brain surgeries so powerful people have only dreamed of them before. Naturally, most people should be skeptical of such claims.

And, of course, most actual cybersecurity folks I know don't consider Alexander to really be a "cyber guy." He's not. Yes, he managed various groups that could hack into systems, but that doesn't make him any sort of expert on cybersecurity. Just the fact that he's diving into the murky waters of "behavioral modeling" as his anti-hacking technique should raise some flags. It's an area that has been talked about a lot, but solutions haven't been any good at all.

Is it possible that Alexander has broken through on an idea that has stumped many people who actually do spend all their time hacking away at systems, looking for security holes and how to fix them? Sure. It's possible, but it's improbable. And the claims by themselves should require significant proof before they're taken seriously. As we've said for years, ideas are one thing. Execution is another, and Alexander has shown no evidence that his solution is actually any good. So why are companies paying him upwards of six figures a month? Good question. It seems unlikely that they truly believe he has found the holy anti-hacking grail. It seems more likely that they like his government connections.

Filed Under: behavior modeling, cybersecurity, hacking, keith alexander, nsa, patents
Companies: ironnet cybersecurity

Keith Alexander: I'm Worth $1 Million Per Month Because I'm Patenting A Way To Stop Hackers (Which I Didn't Tell The NSA)

from the say-what-now? dept

The Keith Alexander story just keeps getting more and more bizarre. Almost immediately after retiring from the top position at the NSA, where he oversaw the total failure of the NSA's supposed "100% auditing" system, allowing Ed Snowden (and who knows how many others) to escape with all sorts of documents, Alexander announced that he had set up a cybersecurity firm -- with the ridiculously Hollywood-ish name of IronNet Cybersecurity. A month ago, it was revealed that he's going around asking banks to pay him $1 million per month for his "expertise." That caused a few to wonder if he's selling classified info, because really, what else could he offer?

Alexander has a new answer: Patents! Yes, Keith Alexander is claiming that he has an amazing new anti-hacker technique that is brilliant and wonderful and deserving of at least nine patents. According to Shane Harris over at Foreign Policy:

Alexander said he'll file at least nine patents, and possibly more, for a system to detect so-called advanced persistent threats, or hackers who clandestinely burrow into a computer network in order to steal secrets or damage the network itself. It was those kinds of hackers who Alexander, when he was running the NSA, said were responsible for "the greatest transfer of wealth in American history" because they were routinely stealing trade secrets and competitive information from U.S. companies and giving it to their competitors, often in China.

Of course, this leads to all sorts of questions. If Alexander had such a brilliant, patentable solution for stopping hackers, why didn't he, you know, use it while he was at the NSA. His response? He and an unnamed "partner" just came up with it in the last couple months after leaving office:

Asked why he didn't share this new approach with the federal government when he was in charge of protecting its most important computer systems, Alexander said the key insight about using behavior models came from one of his business partners, whom he also declined to name, and that it takes an approach that the government hadn't considered. It's these methods that Alexander said he will seek to patent.

The report also notes that Alexander is a named inventor on seven patent applications filed while he was at the NSA (the US government keeps those), but that these new ones are totally separate.

Now, it is entirely possible that Alexander and his partner magically came up with some new way to deal with cybersecurity -- though I'm skeptical. Cybersecurity work involves an awful lot of trial and error in the real world, and Alexander is insisting already that his "fundamentally new approach" will "jump" ahead of existing technology. That's a bold claim for someone who hasn't ever actually done work in the commercial field. One thing that we've pointed out for years, is that people who have no experience in actually building a technology business almost always overvalue the idea, and undervalue the execution. It certainly looks like Alexander is doing exactly that. He thinks that based on the idea alone -- which is totally unproven -- he's worth $1 million per month. He claims three companies have already paid up, though he doesn't say who (or how much they're really paying). It seems likely that any actual payments are more because of Alexander's connections, rather than his brilliant "idea."

Harris spoke to another expert who notes that the approach Alexander is talking about (behavioral modeling) is one that's been talked about and tried for years without success. In other words, it's a perfect example of where ideas sound good, but execution matters. And yet, Alexander insists that his ideas alone -- which haven't been proven yet (and on which he hasn't even filed these supposed patents) -- are so amazing that they will change the nature of cybersecurity?

When Harris asks for more detail about the solution, Alexander wouldn't tell him any more "given the sensitive nature of the work." Except, of course, if he's filing patents on it, the details are supposed to be revealed the public in fairly short order (18 months at most). And, really, if the solution is so great, they should be getting it out there and testing it. Security by obscurity is not the best proving ground. Actually having your solution tested is.

Filed Under: behavior modeling, cybersecurity, hackers, keith alexander, nsa, patents, surveillance
Companies: ironnet cybersecurity