A former spy chief thinks it’s time to rethink privacy and security

Best listening experience is on Chrome, Firefox or Safari. Subscribe to Federal Drive’s daily audio interviews on Apple Podcasts or PodcastOne.

“We are fast approaching the time in which technology will enable a continuous sensing of all of the world’s activity – 24 hours a day, seven days a week, 365 days a year.” That’s how former National Geospatial-Intelligence Agency Director Robert Cardillo opened a recent chapter in the CIA’s quarterly journal, “National Security Intelligence and Ethics.”  The 35-year intelligence community veteran is among those who say advances in digital technologies require re-thinking of privacy itself. To discuss his views at length, Cardillo joined Justin Doubleday on “Inside the IC.”

Interview transcript:

Justin Doubleday: I was wondering if you could just take me into the motivations for writing this article. And why do you think it’s important in particular for the intelligence community to be considering these issues?

Robert Cardillo: Well, first of all, thanks for having me, Justin, I enjoy interacting and discussing critical issues about our community. But as the article points out, I’m very interested in how our community interacts with those that we serve. And even though that we don’t serve, you know, the public directly, I feel strongly that they really are our indirect customer, the end user, if you will, of enhanced and improved decisions by those that are in positions of authority to create improved security or improved awareness or improved society writ large.

So the reason I drafted this article was it was a summation of my career in two ways. One, I was kind of born into the imagery business, we now call geospatial, as a photographic interpreter and imagery analyst back in the day when the government was literally a monopolistic owner of that space. We could do things that no one else could do, we had access to the space that no one else had. And so much of our advantage in those days was through unique technology and unique budgets, etc. And my experience in my government career was I lived through, not that that completely dissipated, but the drawing down of ‘Hey, it’s only a government game’ and the rise of commercial technology and capabilities. And then when I was when I was in the White House working for DNI [James] Clapper in 2010 to 2014, we experienced the results of the of the Snowden releases.

And now he was focused on signals intelligence, and predominantly the work of the National Security Agency. But I can imagine a day, as I said in the article, about a time when the kind of persistence that we’ve either come to live with or not live, we’re trying to figure out to live with, with our phones, and with our apps, and with GPS technology, I think we’re going to have to have that conversation about sensing. And I purposely didn’t say remote sensing, because I think some of the sensing will be direct, whether you’re on the corner of a major metropolitan area, or walking in front of a business with the CCTV camera, etc., or being sensed from space. And it was my view that I would prefer to have this conversation between the citizens that are proposed to be protected by those capabilities. And how does that align, how does that balance, how does that interact with what also makes us American, which is valuing privacy, individual liberty, etc.

You know, when we go to bed at night, we go to bed at night, you know, put our head down on a pillow with the kind of the sense of security. Oh, good, I’m protected in my home or in my community, etc., from bad actors and forces. And I thank the government writ large for doing that, right. That’s part of the deal I make with the government. And then you wake up in the morning and you go, ‘Well, I’m not sure how much I want that government involved in my life.’ So we’ve got this tension in our society that isn’t new. And I just through the article wanted to kind of maybe lead the discussion before it was a crisis, before we had some ‘aha’ moment in which we were kind of find ourselves in a corner of a debate in Washington. An old mentor of mine told me one time, he said, ‘Look, if you’re explaining in Washington, you’re losing.’ Meaning, if you’re justifying something after the fact, it’s very hard to do it. So the point of the article was, ‘Let’s start the conversation now.’

Justin Doubleday: Sure. And you know, as you point out, the Snowden leaks were eight years ago or over eight years ago now, and this is not an entirely new issue, but it’s one that’s constantly been evolving. What do you think intelligence professionals bring to this debate? Because on the face of it, you would think that a more data out there about a whole range of different activities is probably something that as an intelligence community professional, you’d be pretty happy to see. But on the privacy front, what interest do you think the IC has in that issue? And what kind of perspective do you think professionals like yourself bring to this this privacy debate, which is a very broad debate that’s happening across government and U.S. society and the globe as a whole?

Robert Cardillo: Well, I guess I come to it from a core belief that there’s really one reason why governments, and we’re talking about liberal democracies, lowercase d, in our case, create intelligence services. And in my view is they’re created to really do one thing: to enable better decision making, right? And they do that through myriad ways, right? You provide a bit of data they didn’t know or you contextualize it away, or you frame it, or you assess it, or you project it, or you forecast it. And all those things that the intelligence community does, so that a decision maker can say, ‘Oh, okay, I better understand my choices here. And I’m going to now do A versus B.’ And again, that decision maker sometimes is in a suit, and sometimes in a uniform, and sometimes that uniform’s military or its first responder, etc, there’s many different layers of people that consume. But all of those officials, all of those decision makers are representative of those who send them there in one way, shape, or form. And in our society. That’s the electoral process. And that’s our governance and so they’re there to serve those citizens.

Now don’t get me wrong. I don’t think the intelligence community should be leading this discussion. I think for two reasons. One, I think we’re a supporter, and I think we’re good at supporting. And two look, I think that there’s probably, there’s just baggage here, and by the way, you can replace baggage, with bias. We all have it, we all carry it with us. And it’s unnatural for humans to have a bias because of where they come from, and how they, you know, the way they learned and, and their life experiences, all that goes into inform it. So I think in our society, the intelligence community should be a supporter of this conversation.

You know, if Robert were in charge, really it should be our elected officials that should be leading this conversation. I realize that it’s harder these days to think about sober minded, you know, rational debates about big policy issues. We seem to be less good at that these days. But anyway, back to your question, I still think it’s the IC’s responsibility to, if not lead the conversation, at least promote it or provoke it in a constructive way. And again, I mean, I’m not I’m not saying things would have been different, you know, at the end of the day, given the Snowden leaks, but I do believe that like post-9/11, right, America had been attacked in a way it hadn’t been since 1941. And obviously, in many ways, it had never been attacked before. The country was reeling, was looking for leadership, was looking for a sense of, ‘Okay, where do we go from here?’

Now, this is hindsight 20/20. So feel free to critique it. But I could imagine in such an environment, I wonder if we couldn’t have gone to the American people in 2001, ‘Look, it’s a really different planet than the one that existed two months ago, given what’s happened, and the threat is quite different than the one that we had prepared for. And we propose a different level of balance between individual liberty, privacy and security. And this means that if we’re going to protect ourselves from the next attack, or from a non-state actor, as we did on 9/11, we’re just going to need different authorities.’ Now, that debate happened. I wasn’t part of it, but that happened in secret. It happened within government circles. And look, I’m not second guessing those people’s decisions or the assumptions they made. I’m just saying that now, we are here in 2022. The digitization of the world has done nothing but accelerate. The constant ability to fully track movement and activity around our planet just goes up almost every day. I think it’s time for a new conversation about that overall balance and I’ll finish with this, maybe because it is hard to have, and risky to have, right, if you’re an elected official, to have this conversation, because probably by definition, you will annoy 42% of our population depending which way you come out on that. It’s probably easier to kick that can and I’m just in the article arguing that maybe we we can’t afford to kick it anymore.

Justin Doubleday: And in the article, you also raised the concept of “geospatial singularity,” kind of what we were talking about earlier, where, where real time Earth observations with analytics are available to anyone. A range of different services that used to be the exclusive realm of intelligence agencies. And I’m wondering how do you think the IC, and in particular, your old agency, NGA, is grappling with this new reality?

Robert Cardillo: So first, I want to again pay tribute to Josef Koller, a friend and colleague, who, at least to my knowledge, coined the phrase with a paper that he had written. And I really like it, one, because it’s kind of very descriptive. It’s a bit of a attention grabbing. ‘Singularity’ sounds a little scary, right? And which I like. So I like the fact that Josef was able to kind of capture both of those things. It’s interesting when you bring in NGA, my home agency, and where I was born and raised and had the privilege to lead from ’14 to ’19. I mean, it’s big organization, so I’m going to be synthesizing kind of the debates as I saw them and understand them. But it’s fundamentally this, NGA is both a member of the intelligence community. So it works for the Director of National Intelligence, but it’s also a Combat Support Agency, which means it’s got responsibilities to the Department of Defense.

And by the way, the National Security Agency has a similar kind of straddle, and so does the National Reconnaissance Office, Defense Intelligence Agency, so the NGA is not unique. But I say that to say that, it’s got its own balance challenge, because it has a mission to advance and improve decisions, as I said at the top but the way NGA has done that, historically, is to illuminate, expose, and document adversarial capabilities, and when it can, infer intentions on top of those capabilities. So such and such a country, North Korea is an easy one to pick, has this in that system, this in that unit and these deployments. And to me, I call that the content that is necessary to join the game. But it’s also the context, meaning it’s the frame of reference, so you can understand those physical capabilities. The real hard part of being a geospatial-intelligence officer isn’t isn’t the ‘what and where’ question. And we can come back to this, computers are getting much better at that, identifying objects and locating those objects. The really hard question, and the one that the decision makers needs most is the ‘why’ question and the ‘what’s next’ question.

And at least today, computers are not so good at those. Who knows where we’ll go with, you know, computer evolutions and the move to true AI. But one of the debates at NGA has to do with, I won’t call it a divide, but the tension between those two I was very supportive of pushing as much as we possibly could, on the ‘what and where’ to computer assisted, I called it “augmentation and automation.” I tried to stay away from “artificial intelligence” just because it’s just such a loaded term. And it means so many different things to different people. But things like computer vision is pretty straightforward. And you know, object identification. I mean, computers just are getting better and better at it. I wanted to take the NGA analysts and not eliminate them but elevate them. So take them above those questions. Let the computer do the “what and where.” You do the “why and what’s next” and look, like I said it’s a big organization. Some people that resonated with them, kind of motivated them to move to those higher level questions. Some felt threatened by the computer. “Wait a minute, they’re going to come in and do my job, then what are you gonna do with me?” And I kept telling them, “Those other two questions are what I’m going to do with you.” But I won’t kid you, there was a tension.

And to be frank, with respect to my article, that is not a big debate at NGA, okay, for two reasons. One, NGA has got a mission to do. And they do it. And two, they are prohibited from applying their capabilities against the U.S. So it’s just, hey, we don’t we don’t do that. And we don’t. Now we can support activities in the US, for example, floods, fires, etc. But there’s a very meticulous legal process by which we go through to support the FBI or FEMA or California Fire, whoever it is, to make sure that we can’t and don’t do anything against American citizens. So for that reason, NGA, there isn’t an active debate inside there. But people shouldn’t worry about that. They’re, quite frankly, there shouldn’t be. It’s very clean there. But now that I’m in the commercial world, you know, and working with both, satellite providers and data analytics companies and computer vision applications, they can and should and do wrestle with it quite often. Because frankly, look, that’s going to be a different terms of use, right, then the Starbucks and Home Depot, if you sign on to that service. And I think there’s a lot to be learned from the kind of communications and signals analogies, both good and bad. But again, if I had a single intent, it was like, let’s get on with the debate, even if we’re not quite sure how to have it yet.

Justin Doubleday: Yeah, that’s an interesting point, because beyond just pure political dysfunction, one of the big things holding back some sort of big push to reform privacy laws is commercial companies who are able to use this data and whose value is derived from gathering all of this data from us. So you brought it up, now that you’ve been out for two years and working with geospatial companies and the like, what are the debates within those companies? How far do you think they’re willing to go and allowing for not allowing for but backing privacy debate? And where do they draw the red lines In your view?

Robert Cardillo: You get a little nervous when an intelligence officer begins his answer with “it depends,” but it does depend. So I’m going to talk you through a couple of depends. You know, in my new world, I work with some, I’m just going to call them “traditional defense intelligence or defense industrial partners.” And the audience, you can think of them, the big primes, the big movers, the big industrial giants that, quite frankly, have served this nation very well, with their capabilities and their services. For good and for bad, I have found them to be very government-like, when I came out. Now, I don’t think that should be a surprise, because quite frankly, the government kind of created them, right? They kind of said, ‘Look, we need somebody to build a whole lot of airplanes really fast, or tanks, or rockets or whatnot, they need to have all these protections, they need to have all these capabilities.’ And so the bureaucracy that the government had just kind of went over to the those kind of corporate giants.

And then you’ve got kind of a middle tier of companies, they’re not startups, they’re not fresh out of MIT or Stanford. But they haven’t yet scaled in a way that provides their service broadly across the community. So perhaps they’re an Air Force partner or a Space Force or a Defense Intelligence Agency partner. But it’s relatively bespoke. And so it’s a pretty narrow piece. And then the third category is some startups and some new companies that, at least it’s been my experience, are having much more of the debate. And you know, one case in point, I chair the board of called Planet Federal, so planet is a small satellite company that provides remote sensing services around the planet and has for a number of years. They have a subsidiary that does their federal business. And that’s where I sit. I guess what I found interesting in my experience at Planet is there’s one part of their history and their ethos, and they recently went public, so they’re now a publicly traded company, but they went public as a public benefit corporation, which is a very particular way to be a public company. And you still have all the fiduciary responsibilities to your shareholders to maximize return on investment, but you also are obliged to adhere to some high level goals for broader public benefit. And it’s not a new construct, but it’s becoming more in vogue these days because I think people are wanting to have the debate.

And especially a company like Planet, which they can actually see the whole globe once a day. Now, they see it at pretty gross resolutions, so people shouldn’t be worried about them tracking license plates, etc. But you shouldn’t think of any of that sensing capability in isolation. Because this was especially true in the intelligence community, there was almost never an answer that was worthwhile that came from a single source. It’s multiple sources coming together to tell a story. And again, speaking about my experience with Planet, they’re well aware that, okay, it would be difficult for us to imagine abuse of our imaging, just given its resolution and periodicity in the spectral range. However, we could imagine if somebody were to combine our imagery with some sort of mobile device tracking element, and watching that over time to develop patterns of activity and inferring information, and if it was an authoritarian government, could they use that information in a way to control the population that doesn’t comport with our values? That’s the debate that happens within Planet and they go through those use cases, and they put language into their contracts that talk about international law, and the adherence to and respect for civil liberties, etc.

Now, none of those are airtight, of course, right. The world is a messy place. But I use them as an example that I certainly see and experience more of those debates that, quite frankly, are at the commercial world. And let’s face it, again, I wasn’t involved in this, but if you recall one of the shooting events in California, and the alleged perpetrator had an iPhone, and I remember the FBI wanted to get into the iPhone, but the perpetrator put a code on it, the four-digit or six- digit code. And I remember that battle between FBI and Apple, and Apple said, “No.” I don’t recall how it ended up turning out whether a court ordered it to turn it over or not. And by the way, I don’t work for Apple, so this is not a commercial, but I’m sympathetic with the point of view. Because remember what I said earlier that I was willing to hit “Yes” on Starbucks, because I trusted them. Obviously, if I’m gonna buy an Apple product or service at some level, I’m gonna have to trust them to keep my data. In this case, remember, I talked about well, “What happens when the government shows up?” Well, guess what the government showed up and said, I want into that data. And I guess that’s another good example of let’s not wait for that to happen in extremis. The ticking time bomb scenario, or, you know, we’re trying to solve a crime here. Let’s let’s posit those potential outcomes now, so that we least we can have at least a more civilized debate before emotions are high, and tensions are strong.

Justin Doubleday: Yeah. And as you point out, these decisions are being made for us by by companies, regardless of whether we acknowledge it or know it or not. But what do you hope happens here in the near term, to drive this debate forward? What are you looking out for?

Robert Cardillo: If I can dream for a minute, I will. And I would love something, open hearings at the congressional level. I’m not sure it should be the intelligence committees because what I said earlier about kind of that baggage that comes. I think they should be present at these hearings. And maybe they’re not even hearings, maybe the more like town halls, and I’m going to be a little theatrical here. I don’t think they should be in Washington. We should go to Des Moines, we should go to Peoria, we should go to Gainesville, Florida, wherever, like I said because, again, you’re going to think I’ve got rose colored contacts on here. Ultimately, I believe that the strength of our government is critically tied to the confidence from the governed, meaning, that level of confidence that those those of us that are putting our head down at night, you know, “Yep, I’m good, I feel safe, I feel secure, I feel, etc.” You know, it’s a monstrous topic, I get it. And so I appreciate why people want to avoid it or easy to say, “We’ll do it next year.” But what I’d like to see is to have it elevated. And I like the idea of congressional engagement because direct representation of the people and they don’t really have a dog in the fight with respect to running the IC. I mean, they oversee it, they fund it, they appropriate it, etc, etc. But they don’t run it. And so you’d have some distance there, too.

Now, if I kind of come back to reality and go, “Well, that’s probably not going to happen in today’s political environment.” We got a lot of things going on and whatnot. I do think that there are some government officials that could take this on, take on as in, you know, lead this discussion or debate. Perhaps it can come from Justice in the sense that this is a this is an equation between the liberty, privacy and security. They deal with this a lot. Again, I imagine the Director of National Intelligence or his or her, in this case, her representative kind of being on the wing of that discussion, not being up front. And I think somebody from the Pentagon should be involved too, because there’s so much interplay between security and intelligence, which is fully appropriate. But even of late we’ve seen the, I’ll say, the fraying of the edges around, what are we defending? You know, I mean, is it just nation states? Are their internal threats that need to be deal with? Are there fringe elements, you know, from either side of the political spectrum, etc? And by the way, the government can do these things through some third parties, you know, there’s think tanks that can host these, with the right officials, you have federally funded research and development companies, such as you know, Mitre and Aerospace [Corp.] that can help do that. So I do think there’s ways to do that probably at the executive level, where you could bring maybe a hybrid approach.