In April of 2013, I took a posting in Hawaii that greatly changed the course of my personal and professional life. I had applied to the position on a whim, with no idea of whether I was qualified, or if I would even be interviewed for the job, but I felt I had achieved all I could in my current role and I was ready for a new challenge.

The Leadership team at site when they offered my the position, gave me 24 hours to decide whether I was going to accept it or not. Strangely (or not so strangely), my family was not as excited as I was about the opportunity to live and work in Hawaii. The site wanted me to report in April to have some overlap with the departing Deputy Director of Operations, which meant that I would initially be at site without the rest of my family. My wife and kids would come to Hawaii once school was out for the summer, and I would live in temporary housing as a “bachelor” for a time.

And since Hawaii is hella expensive, we wouldn’t be able to live on my salary alone (believe it or not, I was effectively taking a pay cut in locality pay by being reassigned out of the DC area), which meant that my wife was going to have to get a job in Hawaii as well. She could probably write her own book about changing jobs and careers, and maybe she will! I had to get her a cell phone with an 808 area code phone number, so she could be taken seriously by hiring managers for Healthcare positions at Oahu’s hospitals. My daughter applied to and was accepted as a transfer student from York College to the University of Hawaii (she didn’t want to be that far away from the rest of the family), and my son would have to complete his Senior year of High School as the “New Kid”, which is never a fun thing to be.

I was appointed to be the Director of the Customer Relations organization at site, my first assignment that required being approved by the Board of Directors. Once I was confirmed, I met with the Senior Leadership at Headquarters and they gave me three main directives:

- Get out of the Compliance business.
- Improve the working relationships with the other customer facing organizations in the region.
- Get out of the Compliance business.

For some reason (which later became very apparent to me), the small team of folks working in the Customer Relations directorate at site had become responsible for doing all the compliance auditing and reporting for all of the intelligence being produced on site. I can’t provide all the details, but basically once a quarter, a report had to be submitted to our overseers (Congress) that all the intelligence reports being produced at site adhered to the laws, Executive Orders, policies, procedures, and most importantly, the US Constitution. This responsibility was not within our organizational charter, it belonged with the organizations doing the reporting, and my bosses at Headquarters were adamant that I develop an plan to transition the responsibility to the appropriate organizations.

Now, I was by no means a compliance “expert”. As an engineer, I knew the mechanics of it, how the sources of data elements were tagged, processed and stored, but not the auditing and reporting functions on those data elements to any great degree. But as I said earlier, I was gaining a small team of people who had that knowledge, plus I had the site Intelligence Analysis Advisor dual-hatted as my Deputy, so I knew I could quickly get up to speed and get "into" the Compliance business enough to develop the plan to get out of it.

I didn’t get the chance.

For shortly after I arrived, a contractor who shall not be named, absconded with hundreds of highly classified procedural and design documents for the US Intelligence apparatus and handed them over to the media (and our adversaries), creating the biggest intelligence scandal since the Iran Contra affair, and the biggest intelligence crisis since 9/11.

Compliance was at the heart of the scandal. The documents outlined all these powerful capabilities that the Intelligence Community had developed, many in the wake of 9/11, that allowed us to “connect the dots” and find the origin of terrorist threats from individual and non-state bad actors. To be more explicit, the US Signals Intelligence (SIGINT) system prior to 9/11 was highly tuned to report on adversarial foreign Governments, not loosely affiliated terrorist cells, or rogue individuals. This was the primary finding in the 9/11 Commission Report, and now a decade after the fact, people were beginning to question if those new methods and capabilities were still necessary, or even effective.

What was also present in the documents, but not initially reported on, were all the measures that were in place to make sure that someone couldn’t unilaterally task the SIGINT system to spy on their neighbor, their girlfriend, the President, etc. Or to find some piece of data that wasn’t in response to an authorized intelligence need. Grandma’s long lost coconut cookie recipe was not an intelligence need. Grandma’s long lost bomb-making recipe? Maybe…

The point that was initially lost in all the sensationalist reporting done by the media is while the new capabilities were being developed, the appropriate checks and balances were also being put in place to make sure that the powerful new capabilities could not be abused.

I will not elaborate on the contractor’s motives or rationale for doing what he did. Some will call him a hero, some will call him a villain. I will stay away from such judgements and focus solely on how the Intelligence Community was forced to respond, and how many of the changes that were made were a long time in coming. I will say that the rank and file employees of the Intelligence Community were unfairly vilified by his storytelling, as if they routinely break the law and violate people’s privacy rights, when as far as I can tell, he’s the only one who “allegedly” broke the law.

Needless to say, our site was in the crosshairs for scrutiny by the FBI, our Board of Directors, local authorities, Congress, the Inspector General, the Office of General Counsel, you get the idea. Morale understandably tanked, and I’ll address the post-crisis “problem after next” in a future chapter.

After all of the investigations and interrogations were complete and everyone had been taken to task for their failings and shortcomings that allowed for this to happen, there was a single ray of light. The Inspector General noted as a finding that the entire IT organization at site, as well as the contractor’s sponsor company, had a mission standdown day. 100% of the personnel were required to attend. They were reminded of all the safeguards and procedures that are in place to prevent the abuse of power, and they were given an opportunity to ask questions to subject matter experts about the various programs, rather than just reading dry procedural documents as part of their annual mandatory training, which deeply explained the HOW, but did not really cover the WHY.

Perhaps the systems had gotten so routine and automated that only a handful of individuals fully grasped how the “Compliance apparatus” functioned to kept the SIGINT system in check. This is an effect of Conway’s Law, which will be explained in great detail in future chapters. The responsibility had been delegated to my new team, and most people took for granted that we were compliant and didn’t truly consider the possibility of an insider threat. Perhaps it was also a generational thing, where newer members of the workforce need a deeper understanding of WHY things are they way they are, and being told WHAT to do and HOW to do it, weren’t good enough anymore.

The premise for the mission standdown was that if the “alleged” perpetrator had a higher level of awareness of what protections there were in place to protect the rights of US citizens, and how seriously everyone takes their responsibility to protect those rights, in other words our Ethos of Compliance, and maybe most importantly, WHY, then perhaps he wouldn’t have resorted to the actions that he did.

Believing that premise, our Headquarters Director said to provide the same level of training to every Intelligence Community member on island, and do it within 30 days. And have the guy in charge of Compliance at site lead it.

That was me. I hadn’t been on site long enough to dodge that bullet.

And since I was alone on the island with no family life, I was able to work the long hours necessary to develop the site’s response to the crisis.

Fortunately, in addition to the people directly assigned to me, there was also an all-star team of experts at the site at that time who had deep knowledge and inside information on how the various Patriot Act programs were created and constantly reviewed, and how much work went into reauthorizing those programs every year. It was far from being a “rubber stamp”.
This All-Star team consisted of fellow directorate heads, people with collectively over 200 years of SIGINT experience, at a site where 70% of the personnel were first tour military and who knew very little about the broader Agency or Intelligence Community. This was a tremendous opportunity for the Leadership and the workforce to interact in a way that they never had before.

So my Deputy and I, along with our Compliance expert who had provided the briefing that resulted in the IG’s only positive finding, developed a panel discussion with those experts that was part presentation and part Q&A. We gave the workforce the opportunity to ask questions about the programs in a safe, judgement-free space and get honest answers. We conducted 32 90-minute sessions over a three week period. We recorded one of the sessions so that it could be viewed on demand throughout the enterprise. We posted all the questions and answers from the sessions (over 200 of them) on an internal Compliance Ethos webpage for easy reference for the workforce. While being aware that internal webpages and repositories were the primary sources of the leaked information, we did not include the WHAT or the HOW in our curated information (as those methods were still highly classified and needed to be protected), but were happy to share the WHY.

After the initial sessions were completed, we continued providing a monthly mandatory session for all newcomers to the site (a practice I believe still continues to this day, I no longer have the access to verify), so that there were no doubts within the site workforce about the lengths we go to in order to protect the rights of US citizens and the rights of our allies, and to uphold the US Constitution. As the site’s Customer Relations senior representative, I also conducted outreach, information and Q&A sessions for the uniformed service members and customers stationed at Pearl Harbor and Hickam AFB, so that we could allay any doubts or fears about the legitimacy and legality of our SIGINT operations.

Back in Washington, all of the existing programs that were exposed to the leaks were brought up for a deep review, and many components were eliminated or vastly reengineered to implement even greater controls and prevent possible abuses. The newly created Director of Compliance was given more responsibility and authority over the the Agency’s auditing and governance programs. A new Civil Liberties, Privacy and Transparency Office was also created to hold the Agency to even greater account for conducting its mission within the parameters of its limited authorities and to rebuild the trust of the public in its ability to do so.

Eventually the sensationalist reporting died down and the very reporters that initially broke the story and created the controversy began to report on how the workforce of the Agency was mischaracterized. The more they learned, the more they were impressed by the integrity, the character, and the ethos of the individuals within the Intelligence Community.

The all-star panel was recognized for our efforts with an award conferred by the Director of Compliance, which returned distinction to the Hawaii site, and which laid a new foundation of a reputation for community involvement and excellence and eventually made the scandal a distant memory.

And I was able to ultimately get out of the Compliance business by ceding my organization’s two remaining civilian billeted positions to dedicated Compliance officials at the Operations and Site Command level. These two individuals would have the full time responsibility to work with the Senior Reporters embedded within each branch to ensure that all reports were audited, conducted with proper authority and in response to a valid Intelligence Need.

And then, shortly thereafter, the Customer Relations Directorate at Headquarters reorganized, and I was left to implement a new business model with no remaining civilian billets. Again, more to come on this later.

​To summarize, the site and the Agency were forced to respond and implement drastic change. There was no ability to go back to doing business the way it was done prior to the Media Leaks. But I hope you notice that not only were changes made to the way the Intelligence Community was to do business internally and externally, those changes were reinforced via numerous means. It was painful to make them at the time, but ultimately the Agency came out of the crisis, as it often does, stronger than before, due to the dedication, resolve, integrity and Ethos of its workforce.