Robert Hanssen. Aldrich Ames. Those are just two of the faces peering out from a mock-up “Wall of Shame” of double agents and leakers that leads down a hallway to the United States government’s senior counterintelligence official’s office. The pictures in the nondescript office building just outside Washington, D.C. serve as a reminder of the danger malicious insiders pose to the United States — and the hard work that goes on behind closed doors to stop them.
Trying to get a handle on insider threat — everything from spies to unwitting insiders to someone who could snap and cause harm to fellow government employees — is just one of the many tasks Bill Evanina, the Director of the National Counterintelligence and Security Center, tackles every day.
Evanina’s work in the Office of the Director of National Intelligence crosses both the security and counterintelligence worlds. That means dealing with background investigations and clearance reform efforts as well as with operations and analytics throughout the Intelligence Community, NATO, and the “Five Eyes” alliance of Britain, the U.S., Australia, Canada, and New Zealand.
It is impossible to look at those pictures of former FBI agent Hanssen and former CIA officer Ames — both convicted of spying for Moscow — without thinking of Russia and the Kremlin’s malign, aggressive actions to try to upend the country it considers its main enemy. From employing double agents to pushing out propaganda to ordering a cyber and influence campaign aimed at interfering in the U.S. election and boosting then-candidate Donald Trump’s chances, Moscow’s activities remain a high priority for anyone in the counterintelligence sphere.
While Evanina is not involved in the FBI or congressional investigations related to the election meddling, his responsibility lies on the macro-strategic level, looking to devise a strategy to combat Russian propaganda and intelligence collection activities in the U.S.
Day-to-day, Evanina juggles a wide array of internal and external issues in a role that stretches broadly across the Intelligence Community, the U.S. government, and the private sector.
It’s a gig the U.S. counterintelligence chief with over 20 years of service with the FBI calls “the best job in America.”
Over a piece of tres leches cake, Evanina recently sat down with The Cipher Brief for a wide-ranging conversation about the most significant counterintelligence and security threats facing the U.S., what he considers the hardest part of his job, and why he hopes the president will appoint him to continue his work as National Counterintelligence Executive.
“When you merge security and CI together, it’s the perfect combination. You can’t have a good counterintelligence program without good security, and vice versa. And I think we drive that mission, and I think a lot of the other agencies in the IC are so mission focused that it helps there’s an organization like us to facilitate multiagency operations,” he said.
From writing the national counterintelligence strategy to warning U.S. citizens about what could happen abroad from a foreign intelligence service, Evanina’s team has a broad mandate.
On the security side, two of the biggest aspects of the portfolio are personnel security — background investigations, adjudications, and reform initiatives — and securing embassies and consulates around the world, working with the State Department on the technical side to try to prevent hostile intelligence services from penetrating those facilities overseas.
On the counterintelligence side, some of the areas the center focuses on are double agent operations, insider threat, and training.
As for what threats top his list of concerns, Evanina said “the big things right now for us are critical infrastructure, supply chain, insider threat.”
“From a critical infrastructure perspective, it’s basically energy, telecommunications, and financial. We need those three things to have an enduring framework and resiliency to maintain our ability to run as a country,” he said. “Russia and China have proven their capabilities to penetrate those and cause havoc, so we have to be able to be in a position to defend our systems, educate the end users in the private sector of what that threat is, and then at the same time figure out a way to neutralize and deter the efforts.”
And, of course, he added, the insider threat issue is forever at the top of the list. “Obviously the insider threat, having a spy in the Intelligence Community, is always going to be up there. And I believe we’ve always had one, and we probably have one now,” he said.
Evanina is laser-focused on trying to figure out how to identify the motivations of those who steal or disclose classified information as a key to combat the issue. “Back in the day, it was ego, it was money, it was reputation. But is it the same thing now?”
“In order for us to get to a point where we can start to prevent more effectively the insider threat, we have to find out motivations. And that also goes to people who have already been convicted, doing interviews and debriefings to understand what motivated them to disclose this information,” he said.
Once the case of former NSA contractor Harold Martin, who stole a huge trove of top secret documents, is adjudicated, for instance, Evanina said they’ll have an opportunity to debrief him and try to find out his motivations, “just like we did with [Army Pvt. Chelsea] Manning, with Hanssen, with Ames.” That’s not always the case — NSA leaker Edward Snowden remains in Russia, out of reach of investigators, for instance.
There’s another key problem, according to Evanina — there’s little recognition of the significant harm brought by unauthorized leaks of classified information. “Where people’s lives are endangered, or we’re losing collection capabilities around the world, we have to make that part of the narrative. There’s significant damage being done,” he said.
The widespread problem of leaks, he added, could also have serious ramifications beyond the United States.
“There is a significant threat if we continue down this unfortunate path of unauthorized disclosures, at some point, foreign nations should question whether or not we can protect their secrets and their information. I think that’s a viable question to ask down the road, because if we don’t stop this, it’s going to provide problems. But I think right now we’re in pretty good shape, because we all need each other,” he said.
In his position, Evanina drives counterintelligence and security issues across government and at Five Eyes and NATO, where he represents the U.S. on CI. A few years ago, he’d go over to NATO and hear stories from Baltic states about Russian propaganda — “I’d be like, yeah, yeah, yeah,” Evanina recalled.
“Until now, when we see it and the results of it, in the last year or so — now, your eyes are wide open and I’m like, ‘Hey, I’ve heard about this the last three years in Eastern Europe, and they’ve been living with this for decades. We are just now getting in the game. And we are decades behind,’” he said. “The government, private sector, and most important, the media, is not experienced in this. They don’t know how to differentiate between what’s fake news, what’s not fake news, what’s a botnet. Eastern Europeans know the difference. We have a lot of growing to do as a country.”
The threat Russia poses from its propaganda and intelligence collection activities — and the 2016 cyber and influence campaign was by no means a one-off, with a similar effort attempted in France this year and more meddling anticipated by experts in the future — is something Evanina sees as a particularly stark challenge for the U.S. government and its citizens.
“I don’t know how we solve this issue,” he said. “If it comes out at the end of the day there was no this, that, or whatever, does it make a difference? So the Russians have achieved their mission, Putin has achieved his mission, to say that he was a value in our election. It doesn’t make a difference — he’s already won that. From the Russian perspective, they’re golden. Because they’re bigger than an elephant now, and they had a value in our electoral cycle.”
In his role as NCSC director, Evanina works on broad strategic issues, but perhaps the most critical part of his job is as the public face of the organization. “I set the commander’s intent, I drive our vision and mission statements, and I have an amazing staff that does all of the rest of the hard work every day,” he said. “It’s a really big mission and I just get to be the guy who’s driving the bus.”
As for the hardest part of the job? It’s the politics, according to Evanina.
“Being able to navigate the Intelligence Community and the rest of the executive branch, the private sector, the White House, Congress — the whole political navigation of all of that is probably the hardest part of my job. Keeping everybody, I’m not going to say happy, but at least neutral. I work for the DNI, all my money comes from Congress, and my authorities are either vested in congressional legislation or executive orders from the White House. So I’m subservient to a lot of different people, and sometimes they don’t all have the same agendas,” he said.
Earlier this year, Evanina found himself in the running for acting FBI director following Trump’s firing of James Comey. It was, he said, a “humbling experience for me.”
“It was a proud moment to say that I’ve done all the right things in my career, and I’ve worked hard, and my reputation and what I’ve accomplished availed me to be in that conversation,” he said. “That was very humbling. I’m thankful for that and it was a great honor, and I think the FBI ended up getting a great director. That was just great to be part of the process, and also it helped cement and confirm some of the bona fides of NCSC and what we do here.”
As for what’s next, Evanina’s job requires Senate confirmation — a mandate that was only imposed by Congress in 2015, after he was appointed to the role. Currently, he’s been extended in the post for one more year, unless someone else is nominated and confirmed. The White House has not yet nominated him, but he hopes to stay on board after three years in the job so far.
“It may be me, it may be someone else — hopefully it’s me,” Evanina said. “I got an extension from my FBI joint duty, I’m eligible to retire as well, so I’m waiting for the administration and Director Coats to make the determination where they want to go. Hopefully, it will be me.”
Mackenzie Weinger is a national security reporter at The Cipher Brief. Follow her on Twitter @mweinger.