SELECT COMMITTEE ON INTELLIGENCE UNITED STATES SENATE Additional Prehearing Questions for Christopher C. Miller upon his nomination to be the Director of the National Counterterrorism Center 1 Responsibilities of the Director of the National Counterterrorism Center The National Security Intelligence Reform Act of 2004 created the National Counterterrorism Center (NCTC) and the position of Director of NCTC. QUESTION 1: What is your understanding of the unique role of NCTC within the Intelligence Community (IC)? ANSWER: The National Counterterrorism Center (NCTC) plays an important role within the Intelligence Community (IC) in securing the homeland, and is critical to the U.S. Government’s ability to counter terrorism. The Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA) serves as the statutory basis for NCTC’s unique role within the IC, and directs that NCTC, among other functions:  Serve as the primary organization of the U.S. Government for analyzing and integrating all intelligence possessed or acquired by the U.S. Government pertaining to terrorism and counterterrorism (CT), excepting exclusively domestic terrorists and domestic CT;  Conduct strategic operational planning for CT activities, integrating all instruments of national power, including diplomatic, financial, military, intelligence, homeland security, and law enforcement activities within and among agencies;  Ensure agencies have appropriate access to and receive all-source intelligence support necessary to execute CT plans or perform independent alternative analysis; and  Serve as the central and shared knowledge bank on known or suspected terrorists (KSTs) and international terror groups, as well as their goals, strategies, capabilities, and networks of contacts and support. The law also directs the Director of NCTC to advise the Director of National Intelligence (DNI) on the extent to which the CT program recommendations and budget proposals of the departments, agencies, and elements of the U.S. Government conform to the priorities established by the President. NCTC plays a unique, cross-government role in strategic operational planning. 2 As the only federal office to have access to all terrorism-related information—both foreign and domestic—NCTC uses this information to conduct all-source analysis and maintain the database that underpins all government watchlisting. No other CT component of the IC has this scope of statutorily-mandated information access and responsibilities. QUESTION 2: What is your understanding of the specific statutory responsibilities of the Director? ANSWER: My understanding aligns closely with the way past Directors have described their responsibilities in confirmation hearings, as set out in Section 1021 of IRTPA. The law requires the Director to report to the President of the United States when exercising the Center’s whole-of-government strategic operational planning functions, and to the DNI for all other activities and functions. NCTC’s mission, and therefore the mission of its Director, is focused on the prevention, detection, and disruption of acts of terrorism directed against the United States and its interests both at home and abroad. NCTC and its Director are responsible for ensuring that federal departments and agencies are provided with all-source intelligence support to execute assigned CT activities. Under the IRTPA, NCTC is the primary organization in the federal government for analyzing and integrating all intelligence pertaining to terrorism and CT. NCTC’s unique statutory authorities allow its personnel to draw upon both foreign and domestic intelligence to produce integrated analysis. In addition to supporting federal departments and agencies in the Executive Branch, NCTC also supports Congress with information and analysis, and—in close partnership with FBI and DHS—provides terrorism information and analysis to state, local, tribal, and territorial partners. NCTC also provides support to FBI and DHS on purely domestic terrorism issues when assistance is requested. By law, the Center serves as the U.S. Government’s central and shared knowledge bank on known and suspected terrorists and international terror groups as well as their contacts and support networks. In order to accomplish this mission, NCTC designs, operates, and maintains a classified database known as the Terrorism Identities Datamart Environment (TIDE). Following watchlisting guidance developed and approved by the relevant departments and agencies, NCTC provides identifying information on a subset of TIDE identities that includes KSTs to the 3 FBI’s Terrorist Screening Center to support watchlisting and screening by other federal departments and agencies. QUESTION 3: Have you discussed with Director Ratcliffe his expectations of you, if confirmed as Director, and his expectations of NCTC as a whole? If so, please describe these expectations. ANSWER: I met with DNI Ratcliffe, and we discussed, in general, his expectations for me and for NCTC. We share an enormous gratitude for the opportunity serve the Nation, and discussed the solemn obligation of leaders of the IC to provide policy makers the highest quality analysis and assessments in today’s enormously complex and challenging international security environment. First and foremost, we must focus on guaranteeing that the intelligence professionals of the IC are recognized and rewarded, since the foundation of the IC is the extraordinary talent and selfless service of its people. Regarding NCTC specifically, DNI Ratcliffe noted that our struggle against international terrorism remains a critical national security priority and, if confirmed, he would rely on me to provide unbiased assessments and input about ways to enhance the proven capabilities of NCTC to continue to protect the United States from strategic surprise. He also encouraged me to focus on implementing cutting edge technological solutions to transform the watchlisting and intelligence production process. QUESTION 4: How do you view your role as NCTC Director as compared to the Director of CIA’s CTMC? ANSWER: As prescribed in statute and based on my perspective during my time on the National Security Staff, NCTC and the CIA Counterterrorism Mission Center (CTMC) enjoy unique and complementary roles. The Director of CTMC has responsibility to execute CIA’s CT mission on behalf of the Director of CIA including collection and analysis of foreign intelligence, intelligence production, and field operations. CIA’s analysis reflects CIA’s perspective. If confirmed, my role as the Director of NCTC, as prescribed in the IRTPA, would be to integrate and analyze all CT intelligence—foreign and domestic—and to ensure that NCTC’s analysis reflects coordinated perspectives from the broader CT intelligence community. In addition, I understand that NCTC is responsible for ensuring that the right information gets to intelligence consumers so that they can perform their missions. As the CT mission manager within the IC, I would be responsible to ensure that overall coordination, collaboration, and efficient use of 4 resources occurs throughout the community. Finally, the NCTC Director has the unique role of performing strategic operational planning for the whole of the U.S. CT community in support of the President through the National Security Council Staff. NCTC Mission NCTC was designed to serve as the primary organization in the U.S. Government for integrating and analyzing all intelligence pertaining to terrorism and counterterrorism and to conduct strategic operational planning by integrating all instruments of national power. QUESTION 5: What is your assessment of NCTC’s current strengths and weaknesses? ANSWER: If confirmed, I expect to fully assess on an ongoing basis NCTC’s strengths and weaknesses as I work with my leadership team to direct its future course. It’s been my experience that NCTC’s greatest strengths are its dedicated, integrated, diverse workforce and its unique access to terrorism-related data. NCTC’s workforce is drawn from across the IC and broader interagency, which creates a collaborative, inclusive atmosphere of professionals with varying experiences and expertise. Additionally, NCTC’s strong relationship with IC counterparts and its position as the only IC entity with access to all foreign and domestic terrorism data streams allows this unique workforce the ability to provide comprehensive, coordinated all-source analysis. I would also note that NCTC does not engage in, or direct, operations, and I see this as a strength that allows NCTC a neutral perspective for CT analysis and strategic operational planning for the IC. One area in which the government can always do better is management and full exploitation of the data to which it has access. To fulfill its mission, I believe NCTC must continue to invest in technology-based tools to power more comprehensive data analysis, increase the speed of information sharing and collaboration, and automate production workflows. Such new technology and data analytic tools will also enhance IC efficiencies and offsets for competing priorities. Finally, I believe that as the public face of the United States’ CT efforts, I can 5 assist in providing the American people information about our ongoing campaign against those international terrorist groups with whom we are at war. I think it is important that the American people are aware of the dramatic successes we have had in diminishing these terrorist groups due to the remarkable dedication of CT professionals. QUESTION 6: What do you believe are the greatest challenges facing NCTC? ANSWER: From my perspective, NCTC’s greatest challenge is maintaining the ability to innovate and adapt as quickly as our adversaries. Terrorists continue to make technological advances in fields like encrypted communications and use of social media that make it more difficult to “connect the dots” in identifying and enhancing our understanding of terrorist communication and networks. I believe one way to stay ahead is to maintain a diverse and skilled workforce including data scientists and making smart and strategic decisions on sourcing new technology. I understand NCTC is taking steps to further ensure its readiness to meet these challenges as the Administration assesses the renewed importance of allocating resources to address great power competition. If confirmed, I look forward to working with NCTC staff to advance the Center’s ability to meet its “no fail” mission. QUESTION 7: Please explain your vision for NCTC, including your views on its current and future priorities and what the organization should look like five years from now. ANSWER: In my view, NCTC has made significant progress in fulfilling the vision set out by the 9/11 Commission and Congress in 2004. To ensure NCTC preserves the progress it has made, and to position NCTC for the complex, evolving, and diverse threats we face, it must continue to prioritize its people, its partnerships, information sharing, and data management. If confirmed, I will seek to build on the successes of my predecessors in each of these foundational areas to evolve and improve the Center’s capacity to accomplish mission objectives. NCTC’s ability to succeed in its mission goals correlates directly to its ability to continue recruiting and retaining the best and the brightest. If confirmed, I will continue to focus on recruiting qualified individuals, from within both the IC and the private sector. I will also ensure the NCTC management team seeks new ways 6 to help our workforce grow, develop, and continue contributing to our nation’s CT efforts. Next, I’ve been impressed with the robust partnerships NCTC has with foreign partners as well as state, local, tribal, territorial and private sector partners. If we are to sustain gains made over the past 16 years reducing the threat of terrorism to the United States and our interests, we must not lose sight of the importance of CT partner relationships, both at home and abroad. NCTC alone cannot eradicate terrorist threats, and if confirmed, I would seek to build on the success of my predecessors by seeking additional ways to deepen relationships and collaborate with key CT partners and stakeholders. Although NCTC has matured greatly and largely embraced its position as a recognized leader in our nation’s CT efforts, we in the CT community continue to face new and difficult challenges. In today’s information age, complex data management and technical challenges make information analysis and sharing increasingly difficult. The collection, use, and management of new types and greater quantities of data remains a challenge across the federal government - and NCTC is no exception. NCTC’s watchlisting, screening, and all-source analytic efforts rely on modern, cutting-edge tools and clear, consistent data management policies to keep pace with the evolving terrorist threats of today. If confirmed, I would work to ensure NCTC retains a cadre of highly-skilled, technology-focused professionals like data scientists, who can help bring valuable knowledge about the challenges of rapidly evolving technology and its impact on our ability to analyze and manage CT data. More broadly, it is important to note that the terrorism threat we face has evolved significantly since NCTC’s establishment. Today, the reduced capacity of many prominent terrorist groups and resurgence of threats from prominent state actors is causing many in national security circles to reexamine national security priorities. If confirmed, I will ensure that NCTC serves as an honest broker in responsibly coordinating the CT enterprise’s shift to support a national security strategy that focuses on meeting the challenges of state competitors while maintaining the ability to protect the American homeland and people from terrorist threats. If the threat of terrorism to the United States and our interests at home and abroad remains elevated over the next five years, I envision NCTC will further solidify its position as the leader and integrator of the national CT effort, with sustained focus 7 on achievements in recruiting and retaining personnel, developing partnerships, and the “big data” arena that could be applied across other mission areas. NCTC would also play a well-established and central coordinating role in ensuring that the efforts of the CT enterprise support and are informed by broader national security and foreign policy aims. Having said that, the status quo is not the only option. The war against Islamist fundamentalist terrorist groups, which NCTC was structured to lead since its creation, is indeed a generational struggle – but it is not a multi-generational one. I believe we are nearing the end of that generation. My goal is to finish that fight and help NCTC translate the remarkable tradecraft, process improvements, and coordination procedures into a model for countering other transnational security threats. If the United States is truly successful in eliminating terrorist threats to the American way of life over the next five years, NCTC must evolve to fit the size and scale of its new and enduring CT mission. If confirmed, I intend to assess our progress against the threat landscape, and foster a robust and substantive discussion about how to apply lessons learned to the new threats we face today. QUESTION 8: What specific benchmarks should be used to assess NCTC’s performance? ANSWER: NCTC is assessed on its most important metric every single day, and the “score card” is binary: success is preventing strategic surprise by terrorist groups and not allowing terrorist attacks to affect our way of life. Recognizing we fight a thoughtful and adaptive enemy that is constantly seeking ways to gain advantage, NCTC should also be assessed on its ability to posture the U.S. Government to respond effectively to attacks with the full weight and power of the United States. I understand that in its role as the CT mission manager, NCTC uses several benchmarks to assess progress for the IC and these can, at least in part, be applied to measure NCTC’s progress and complement internal Center benchmarks. Some of these benchmarks include evaluating the IC’s progress against high priority CT intelligence gaps and customer satisfaction with overall CT intelligence. NCTC hosts experts at the end of each fiscal year to identify and develop CT 8 priority intelligence gaps, which are topics that deserve particular analytic attention during the course of the year, and measures IC progress to fill these gaps. NCTC also annually surveys a broad range of customers from five customer segments— DoD/Warfighter, Homeland Security, Law Enforcement, Policy and nonDepartmental Intelligence—to determine its satisfaction with CT intelligence support. These metrics combined with internal performance assessments of NCTC’s support to key customer needs in counterterrorism intelligence, terrorism identities intelligence, and situational awareness services and readership and feedback analytics from NCTC products online through its “Current” portal, also provide a useful “scorecards” for the Center. QUESTION 9: What is your assessment of how well NCTC is fulfilling its mission as mandated by the IRTPA to serve as the “primary organization” in the U.S. Government for analyzing and integrating all intelligence possessed or acquired by the U.S. Government pertaining to terrorism and counterterrorism, excepting intelligence pertaining exclusively to domestic terrorists and domestic counterterrorism? ANSWER: NCTC has made significant progress in fulfilling the vision set out by the 9/11 Commission and Congress in 2004, and I believe that NCTC has become a recognized leader in the CT community. NCTC’s role as the “primary organization” in the U.S. Government for analyzing and integrating international and transnational terrorism information, and its corresponding responsibility to ensure that agencies have appropriate all-source intelligence support, are central to the CT enterprise’s ability to protect the homeland. NCTC has come a long way in integrating CT intelligence through strong partnerships, vision, and determination. That said, work to fulfill a mission so immense and significant is never done and there is always room for innovation, creativity, and greater efficiency and effectiveness. If confirmed, ensuring NCTC is best equipped to fulfill this mission will be among my chief priorities. Mission Manager QUESTION 10: As NCTC Director you will also serve as the CT Mission Manager. 9 a. What changes in authorities or resources do you believe should be made to make the CT enterprise more effective and efficient? ANSWER: I am not immediately aware of any need for major changes with regard to resources or authorities. If confirmed, I would conduct a more detailed assessment of priorities, policy, and resource allocation across the enterprise, and report back with any findings. b. What more do you believe needs to be done to reduce duplication in analysis between NCTC, CTMC, and other members of the CT community? ANSWER: If confirmed, in my role as the CT mission manager, I would be responsible for ensuring that overall coordination, collaboration, and efficient use of resources occurs throughout the community. I would continue the efforts started by Director Maguire and Acting Director Travers to diligently assess duplication of effort in analysis and production and, as needed, identify ways to best harness the unique contributions of each member of the CT community in intelligence analysis and production. Directorate of Strategic Operational Planning QUESTION 11: The Directorate of Strategic Operational Planning often operates as an extension of the National Security Council. What are your views on DSOP’s contributions to the NSC and the CT enterprise? ANSWER: The Directorate of Strategic Operational Planning (DSOP) is a national treasure and one of the most innovative and capable organizations in the U.S. Government. In many ways, DSOP is an internal “think tank” and “consulting firm” for the CT enterprise. I had the distinct privilege of working directly with the Directorate of Strategic Operational Planning (DSOP) during my tenure on the National Security Council (NSC) Staff in 2018 and 2019, specifically in crafting the President’s “National Strategy for Counterterrorism,” and I saw first-hand the value-add that the relatively small office had to my office at the NSC and individual agencies within the CT Enterprise. They embody the “secret sauce” of NCTC by serving as an analytical, non-partisan, unbiased forum for solving the most intractable problems in the national security realm. DSOP’s authorities and mission are unique within the national security community. The collection of ODNI cadre and detailees from across the IC and Policy community provide an 10 important service in drafting and coordinating interagency strategies and proposals for NSC consideration, directly supporting agencies in identifying and addressing implementation challenges to those strategies, and serving as honest brokers in conducting substantive and budget assessments of the CT enterprise. Staffing QUESTION 12: NCTC operates a joint manning model, taking in detailees from across the IC. Do you believe this model is still the best way to staff the Center? ANSWER: I strongly believe that NCTC’s staffing model helps drive its success. NCTC depends on the talent and expertise of officers from across the IC to accomplish its critical mission. Interagency officers facilitate the Center’s ability to tie in seamlessly with CT partners, whether in a crisis, or in day to day coordination and operations. The regular rotation of talented, dedicated, CTfocused staff provides a regular influx of fresh perspective and opportunities for enhanced coordination with detailees’ home agencies. That said, I understand that in recent years, detailee numbers at NCTC have steadily declined, and this pattern is likely to continue as agencies increase staffing to competing priorities. While I remain committed to a robust detailee presence at NCTC, if confirmed, I will make it a priority to re-evaluate NCTC’s manning model to ensure that the Center is well postured to accomplish its mission. State and Local Governments QUESTION 13: What is the role of NCTC in producing and disseminating intelligence for state, local, and tribal partners? ANSWER: IRTPA established NCTC to ensure that agencies receive all-source intelligence support needed to execute their CT plans and that such agencies have access to and receive intelligence needed to accomplish their assigned activities. IRTPA also stipulates NCTC, in coordination with FBI and DHS, will produce and disseminate terrorism and CT intelligence for state, local, tribal, territorial and private sector partners (SLTTP). NCTC’s primary activities in identifying, producing, and disseminating relevant intelligence to these consumers are conducted through the Joint Counterterrorism 11 Assessment Team (JCAT), an organization staffed by NCTC, DHS, and FBI and located at NCTC. JCAT’s mission is to improve information sharing by producing clear, relevant federally-coordinated threat information on significant international terrorism or terrorism-related events that have the potential to enhance local or regional public safety conditions in the United States. JCAT Fellows ensure terrorism-related information intended for SLTTP entities is presented in a usable format that is, to the extent possible, unclassified, to facilitate further dissemination. They also conduct outreach in coordination with Domestic Representatives placed across the United States and who serve as the front-line liaisons for NCTC through multi-faceted engagements with SLTTP partners. In FY2019, for example, NCTC’s Domestic Representatives delivered more than 500 tailored briefings on a wide range of terrorism topics to thousands of SLTTP partners with roles in CT. Separately, NCTC’s Operations Center produces two situational awareness products for domestic first responders, international partners, and the private sector—the Unclassified//For Official Use Only (U//FOUO) Counterterrorism Weekly and the Unclassified Counterterrorism Digest. These products compile international and domestic news to provide a common threat picture of counterterrorism events from around the globe. The Center’s Directorate of Intelligence also produces products at the FOUO and unclassified levels for state, local, and tribal partners, including the semi-annual magazine “Alliance” and for private sector partners, “The Beacon.” QUESTION 14: How is that role different than that of the FBI and the Department of Homeland Security? ANSWER: The FBI and DHS have independent statutory missions to provide terrorism information directly to state, local, and tribal governments. In compliance with its statutory charter, the IRTPA, and the National Security Act of 1947, NCTC supports FBI and DHS in carrying out their missions. NCTC has access to the full range of U.S. Government CT intelligence to inform products for state, local, tribal, territorial and private sector customers, in support of FBI and DHS. As the primary organization in the U.S. Government for analyzing and integrating all intelligence possessed or acquired by our federal departments and agencies in regard to terrorism and counterterrorism, NCTC is uniquely qualified to ensure DHS and FBI have access to and receive all-source intelligence support to execute their missions. 12 QUESTION 15: What is your understanding of the amount and nature of cooperation among NCTC, FBI, and DHS? ANSWER: I understand that NCTC works closely with DHS and FBI, on a daily basis, to support CT programs and collaborate on a range of terrorism-related intelligence production. For example, NCTC regularly co-authors intelligence assessments with FBI and DHS, particularly on threats to the U.S. Homeland; collaborates with DHS and FBI to develop whole-of-government CT plans, strategies, and assessments; and deploys representatives throughout the United States who work hand-in-hand with DHS and FBI field elements. NCTC’s Operations Center is collocated with FBI’s CT Watch and the JCAT, and it hosts a Homeland desk staffed by specially-trained DHS officers knowledgeable of DHS resources and data. NCTC also integrates DHS and FBI officers into the Center and NCTC officers support DHS and FBI. This colocation of people, resources, and information ensures robust and continuous interaction, communication, and cooperation between NCTC, FBI, and DHS. Lastly, DHS and FBI have senior representatives assigned to NCTC, ensuring close coordination at the most senior levels. QUESTION 16: If confirmed, what priority would you give coordination between these entities? ANSWER: If confirmed, ensuring that NCTC, DHS, and FBI continue to work together to provide state, local, tribal, territorial and private sector partners with timely and accurate information on terrorism would be a top priority. These partners serve on the front lines of our CT efforts in the domestic space, and effective information and intelligence sharing with these partners enhances their ability to recognize and effectively respond to suspected terrorism and violent extremism activities, while simultaneously protecting our privacy and preserving our civil liberties. Strategic Operational Planning QUESTION 17: What unique role does strategic counterterrorism analysis conducted at NCTC play, as compared to the analysis produced by other components of the IC? 13 ANSWER: NCTC serves as the central and shared repository for all CT information within the U.S. Government. As such, it has an ability unique in the federal enterprise to analyze and integrate all sources of intelligence pertaining to terrorism and CT. NCTC coordinates all of its intelligence assessments with other IC partners, enabling its products to serve as a single voice that reflects the opinions of the entire CT community. And lastly, since it is not charged to collect intelligence or execute CT operational activities, NCTC is able to preserve analytic objectivity in its assessments. QUESTION 18: To what extent does the Directorate of Strategic Operational Planning develop interagency plans for counterterrorism operations? ANSWER: The Center’s DSOP develops whole-of-government CT plans to engage in cross-agency collaboration as directed by the NSC to support policy implementation. NCTC plans address a variety of CT objectives to include regional and functional CT issues, such as terrorism prevention and weapons of mass destruction. The strategic operational planning process integrates all phases of the planning cycle—developing a plan, monitoring its implementation, and assessing its effectiveness and resource allocations—and creates communities of interest to coordinate and integrate implementation. DSOP-led plans and strategies generally incorporate all instruments of national power—which may include CT operations—as lines of effort within broader CT strategies and plans. QUESTION 19: To what extent does the Directorate coordinate or integrate the strategic planning of components of the Intelligence Community, the Department of Defense, and other components of the U.S. Government? ANSWER: When DSOP is designated as the lead planning entity by the NSC staff, DSOP staff coordinate with and incorporate the inputs of the intelligence, strategic planning, policy, and other components of U.S. Government departments and agencies. DSOP has engaged and involved more than 20 departments and agencies as it developed strategic operational plans in recent years, including IC elements, the Department of Defense, and organizations such as the Departments of Education and Health and Human Services that are not traditionally viewed as national security entities. DSOP ensures representatives from all departments and agencies provide the 14 elements of national power that are necessary to achieve the objectives for a particular planning effort. Upon approval by the White House, DSOP-led strategies and plans help guide the implementation of departments’ and agencies’ CT plans and efforts. Once in effect, DSOP assesses progress against the goals and objectives of interagency plans as well as the extent to which resources are in place to achieve the effort. QUESTION 20: Please describe your assessment of the challenge presented by this responsibility and what should be done to improve NCTC’s performance of it. ANSWER: My assessment is similar to those of Directors before me in confirmation hearings. Terrorism in all of its forms is becoming increasingly diffuse and complex, making DSOP and its interagency partners’ efforts to develop effective strategies and plans more challenging. The complexity of the threat has also led to a greater number and diversity of CT partners and interagency tools to integrate and coordinate. Since its creation, DSOP has worked with its interagency partners to integrate U.S. Government activities to counter the CT threats we face. DSOP is an honest and willing broker that helps coordinate issues among departments and agencies to integrate all elements of national power in support of our nation’s CT objectives. Based on my experience working closely with DSOP, the brilliance of their architecture, systems, and procedures is that they understand the culture and equities of each organization and are able to integrate competing needs and requirements in a coherent fashion the provides executable, coherent, and measurable solutions. Obviously, the nature of our federated system of intelligence creates healthy competition between departments and agencies. If confirmed, I would look for ways to improve NCTC’s strategic operational performance and work expeditiously to implement solutions. QUESTION 21: What is the role of the Director of NCTC in developing the National Intelligence Priorities Framework (NIPF) with regard to counterterrorism? ANSWER: The Director of NCTC is responsible for overseeing the development and implementation of the NIPF-CT priorities, which informs IC decisions on collection, analysis, and resource allocation. These priorities are updated on a quarterly basis with support from IC elements and integrated into the ODNI’s 15 overall NIPF process. If confirmed, to the maximum extent possible, I would ensure that NIPF-CT priorities provide clear guidance to the IC without conflicting with other IC priorities to ensure the most effective and efficient allocation of our critical, limited resources. QUESTION 22: What is your view of the proper role of Congress in overseeing the activities of the Directorate of Strategic Operational Planning? ANSWER: Congress is obligated to exercise its oversight role over NCTC activities, including those activities undertaken by DSOP. If confirmed, I will work with the Congress to facilitate its oversight function in keeping with any necessary accommodations that NCTC and the Committee agree upon. National Intelligence Manager As the Counterterrorism Mission Manager for the IC, the Director of NCTC identifies intelligence gaps and resource constraints and sets collection and analytic priorities. QUESTION 23: What is your vision of the Director of NCTC in the role of mission manager? ANSWER: My vision of the Director’s role as mission manager aligns closely with that of prior Directors in confirmation hearings. The role of mission manager allows the Director of NCTC to be a proactive leader in the IC and CT community. If confirmed, my top priority would be to ensure that the CT community remains alert to the terrorism threat, especially given the increasingly diversified threat landscape and competing national security concerns. The role of the mission manager is to be an honest broker who can work across the CT enterprise to balance risks, find efficiencies and opportunities for collaboration, and communicate difficult options for senior policymaker decisions. In the IC, there is a tremendous demand placed on our limited national collection platforms, analytic resources, and other capabilities that are shared with other vital national security priorities. This role is important because of its vital role to work across our community, as partners, to ensure we all understand how we are efficiently and effectively using our collective resources. 16 Having well-drafted strategies that are monitored and assessed is important. Our priorities and overall approach for the IC are set by the National Security Strategy, the National Strategy for Counterterrorism, the National Strategy for Countering Weapons of Mass Destruction Terrorism, and the National Intelligence Strategy. To effectively execute these strategies, I will promulgate a Unifying Intelligence Strategy for CT that sets our priority issues and the plan of action for addressing them. This strategy will also support the development of recommendations to the DNI that provide a basis for his resource guidance to the IC. QUESTION 24: What is the role of the Director of NCTC in providing guidance with regard to the allocation of resources among, and within elements of the IC? Please also describe how the Director of NCTC should identify unnecessary or less critical programs and seek to reallocate funding, within resource constraints. ANSWER: Similar to the views expressed by prior Directors in confirmation hearings, I believe the role of the mission manager is to provide resource guidance to the CT community and serve as the principal adviser to the DNI for counterterrorism priorities. To fulfill this role, outlined in the IRTPA, the Director of NCTC is charged to collaborate with CT program managers across the IC to understand resource priorities, shortfalls, and redundancies. The Director must have the ability to identify critical resource investments and be an effective advocate and leader for the CT community within the intelligence planning, programming, budgeting and execution process. If confirmed, I will ensure close collaboration with interagency partners in order to achieve one CT enterprise that protects the country. QUESTION 25: What are the most important counterterrorism gaps or shortfalls across the Intelligence Community? ANSWER: History has proven that terrorism is an adaptive threat, and the U.S. Government’s ability to identify gaps and shortfalls in a timely and efficient manor is vital to our continued success. Along these lines, three issues are particularly concerning: adapting to the rapid pace of technology; managing and efficiently exploiting large volumes of IC data; and improving screening and vetting capabilities. First, while the rapid pace of technology has supported NCTC’s mission, it has also provided our adversaries with new capabilities to use against us. In order to 17 stay ahead of our adversaries, NCTC must find ways to appropriately acquire and adapt new technologies while mitigating the threat of terrorist use of technology. Second, the IC has the benefit of large datasets; however, it must identify solutions to effectively standardize, integrate, and process increasingly large holdings. This “big data” management solution must include innovative approaches to information sharing and access. Data management and integrity is vital to NCTC’s efforts supporting watchlisting and other screening mechanisms and providing our international partners the timely and actionable information they need to keep terrorists from reaching the U.S. Homeland. Additionally, there are myriad challenges related to screening and vetting. For example, the challenge of integrating biometric data, such as fingerprints and facial images, into screening of biographic data. We need to move from a name-based system to a persona-based system of performing identity intelligence. Finally, I have learned that CT is a “team sport” and so many of our capabilities are symbiotic and intertwined that when one element makes a decision, like shifting capabilities or force structure from one area to another, the second and third order effects with other CT entities that depend on that partner can have significant impact. All of these issues require continued focus and serious investments in time and resources, and remain critical for continued IC success against terrorism and keeping the homeland safe. Congressional Oversight QUESTION 26: What do you understand to be the obligation of the Director of NCTC, in support of the DNI, to keep the congressional intelligence committees fully and currently informed about matters relating to compliance with the Constitution and laws? ANSWER: Congressional oversight is an essential part of our constitutional system of checks and balances, and I believe it is critical to the success of ODNI, NCTC, and the IC. Under Section 502 of the National Security Act, the DNI and the heads of 18 departments and agencies involved in intelligence activities are required to keep the congressional intelligence committees fully and currently informed of intelligence activities. Previous DNIs have issued IC-wide directives on the subject of congressional notifications to ensure timely reporting to Congress consistent with Section 502. If confirmed as the Director of NCTC, I would abide by these and other applicable requirements. I would also ensure that I remain responsive to the congressional oversight process, ensure congressional notifications are timely, accurate, and complete, and support the DNI in the same. Professional Experience QUESTION 27: Please describe specifically how your experiences will enable you to serve as the Director of NCTC. ANSWER: I have been directly and viscerally involved in our Nation’s fight against international terrorism since 1998, from the tactical combat level as an Army Special Forces officer to the strategic-policy level as the Special Assistant to the President and Senior Director for CT and Transnational Threats on the National Security Council. I produced and co-wrote, in close partnership with NCTC’s DSOP, the President’s October 2018 “National Strategy for Counterterrorism,” and I am intimately familiar with all of the United States’ CT capabilities and key issues. Additionally, over the course of my career, I have met and developed strong working relationships with the leaders of the CT community domestically and internationally, both in and out of government. During my first career in the Army, I successfully led diverse organizations from 12-2,000 members consisting of U.S. and international military men and women, civilians and contractors. Since retirement from the military in 2014, in addition to my two years leading our government’s CT enterprise at the NSC noted above, I honed my craft as an advisor to the Undersecretaries of Defense for Intelligence & Security and Policy, as well as a DoD Intelligence Oversight official, working directly on the most sensitive intelligence and special operations activities in the DoD. I currently serve as the Secretary of Defense’s senior official for CT as his Deputy Assistant Secretary of Defense for Special Operations and Combating Terrorism. Simply put, I know the CT business from the ground up. I served as a Special Operations leader in Afghanistan and Iraq for Army Special Forces, DoD special 19 mission units, and paramilitary elements of the U.S. Government. I was a key planner for our initial operations in Afghanistan in 2001, and I participated in those operations that drove the Taliban government from power. I am a proven and capable leader of diverse organizations operating in high pressure environments requiring maturity, vision, and political adeptness. Combined with my tactical and operational experience, I am extremely conversant with CT in the strategic-policypolitical realm. I understand the nature of war and our campaign against terrorists; I have proven success leading large organizations; and I know how to develop and implement policy. I believe all these factors will position me for success as Director of NCTC, should I be confirmed. QUESTION 28: On April 8, 2019, the administration announced the designation of Iran’s Islamic Revolutionary Guard Corps (IRGC), including its Qods Force, as a Foreign Terrorist Organization (FTO). a. What do you see as the pros and cons of designating state entities as FTOs? ANSWER: FTO designations play a critical role in our fight against terrorism and are an effective means of curtailing support for and pressuring groups to cease terrorist activities. b. What do you see as NCTC’s responsibilities related to the designation, in terms of allocating analytical resources to countering IRGC and the inclusion of IRGC personnel and contacts in the Terrorist Identities Datamart Environment (TIDE) database? ANSWER: NCTC provides analytic support to the Department of State and the policy community to inform determinations on whether or not an entity meets the legal threshold for designation under Department of State authorities. In this capacity, NCTC produces and consolidates ICcoordinated assessments on state entities supporting terrorism. NCTC works with IC counterparts to help drive terrorism-related collection requirements for these entities, in addition to requirements levied by country political and military analysts across the IC. Designation as a terrorist organization requires NCTC to allocate sufficient analytic resources to identify and watchlist terrorists and those who provide material support, analyze changing and emerging threats from the 20 organization, and provide IC coordinated assessments—prioritizing threats to the Homeland—using all source intelligence analysis and our unique access to terrorism data. I understand that, since the FTO designation of IRGC, NCTC has performed analysis of Iran’s terrorism-related activities as it had previously with respect to IRGC-Qods Force (IRGC-QF). However, NCTC continues appropriately to defer to IC partners for broader coverage of Iranian activities. c. What are the resource implications to NCTC’s mission to counter non-state terrorists and terrorist organizations arising from an expanded mission that includes state actors? ANSWER: Efforts to detect, monitor, and deter state sponsors of terrorism have long been an important part of the broader CT mission, for NCTC and across the IC. My understanding is that NCTC's mission prioritization is directed through the NIPF. If confirmed, I will ensure that NCTC's resources are appropriately and responsibly allocated consistent with this prioritization. d. How should NCTC work with other elements of the Intelligence Community and FBI responsible for collection and analysis on state actors, including analysts and collectors responsible for counterintelligence threats? ANSWER: In my view, NCTC should continue to closely coordinate with IC elements covering state actors to ensure a logical and mutually understood delineation of responsibility that takes into account the capacity in which a designated group is acting. For example, if a designated state actor were to act as a sponsor, facilitator, or ally to other terrorist groups and proxies, those activities would be of direct concern to NCTC’s mission and responsibilities. e. How should NCTC work with foreign allies and partners with relationships with state actors designated by the United States as FTOs? ANSWER: In my experience in the CT community, our international CT partnerships are vital to achieving shared CT goals. Foreign partnerships are 21 a critical strength and asset in the CT community. I understand that engagements are, and should continue to be, closely coordinated to best effectuate U.S. national security and foreign policy objectives. QUESTION 29: In April 2019, a White House spokesperson stated that the administration was considering the designation of the Muslim Brotherhood as an FTO and that the designation was “working its way through the internal process.” (“Trump Pushes to Designate Muslim Brotherhood a Terrorist Group,” The New York Times, April 30, 2019.) a. Do you support the designation of the Muslim Brotherhood and do you believe the Muslim Brotherhood meets the definition of a terrorist organization? ANSWER: If confirmed, I will ensure that NCTC continues to provide analytic support to the Department of State and the policy community to inform Department of State determinations concerning whether particular organizations satisfy the designation criteria. b. What do you see as the pros and cons of designating political organizations, or networks of political organizations, as FTOs? Do you see distinctions between Muslim Brotherhood and designated FTOs such as HAMAS and Hezbollah? ANSWER: If confirmed, I believe my role would be to ensure that NCTC continues to provide analytic support to the Department of State and the policy community to inform its determination whether particular organizations satisfy the designation criteria and to weigh the national security and foreign policy effects of those determinations. c. What do you see as NCTC’s responsibilities related to the designation of political organizations, in terms of allocating analytical resources to countering them, and the inclusion of their personnel and contacts in TIDE? ANSWER: My understanding is that when organizations are designated, NCTC allocates sufficient analytic resources to identify and watchlist members of those organizations as appropriate, analyze changing and emerging threats from the organization, and provide IC coordinated 22 assessments using all source intelligence analysis and our unique access to consolidated terrorism data. d. How should NCTC work with other elements of the Intelligence Community responsible for collection and analysis on political organizations? ANSWER: One of NCTC’s statutory responsibilities as set forth in the IRTPA is to ensure that U.S. Government departments and agencies have access to and receive intelligence needed to accomplish their assigned activities. I believe NCTC should work closely and collaboratively with IC partners, including by continuing to ensure that its all-source intelligence products are whole of community resources. e. How should NCTC work with foreign allies and partners that recognize political organizations designated by the United States as FTOs? ANSWER: Foreign partnerships are a critical strength and asset on the CT community. I understand that engagements with foreign partners are, and should continue to be, closely coordinated to best effectuate U.S. national security and foreign policy objectives. QUESTION 30: On April 7, 2020, the Department of State designated the Russian Imperial Movement (RIM), a white supremacist terrorist group, and members of RIM’s leadership as Specially Designated Global Terrorists. The October 2018 National Strategy for Counterterrorism refers to other white supremacist and neoNazi groups, specifically the Nordic Resistance Movement and the National Action Group, which was banned by the United Kingdom in 2016. a. What is your view of the threat posed by white supremacist and neo-Nazi groups to the United States, to U.S. interests overseas, and to U.S. allies? ANSWER: Violence committed by racially or ethnically motivated violent extremists (RMVEs) is a concerning terrorism threat faced by the United States and many of our allies. Regrettably, this isn’t anything new. RMVEs have posed both a direct threat to US citizens overseas, such as those present during the 2019 Yom Kippur attack against a synagogue in Halle, Germany, though thankfully no U.S. citizens were injured, and to partners more 23 generally such as the lone RMVE actor attack last year in Christchurch, New Zealand. The FBI and DHS deserve credit for recognizing the increased threat posed by these groups and proactively shifting resources towards RMVEs and violence prevention prior to the horrendous attack in El Paso, Texas. I am confident that our domestic agencies at all levels are well postured to address this threat. I also know that the experts at NCTC will provide support to their efforts and provide unbiased, professional analysis and assessments. b. What is your view of the appropriate level of NCTC resource allocation toward white supremacist and neo-Nazi organizations and individuals? ANSWER: RMVE is a significant concern for the Administration, as reflected in the National Counterterrorism Strategy, and I understand that the FBI considers RMVE a national threat priority. While NCTC is not a lead agency for countering domestic terrorism, if confirmed, I would ensure that the support NCTC provides to FBI and DHS is commensurate with the threat to the homeland posed by RMVE actors and in line with the President’s overall national intelligence and counterterrorism priorities. QUESTION 31: The IRTPA, in describing the primary missions of NCTC, excludes “intelligence pertaining exclusively to domestic terrorists and domestic counterterrorism.” a. How should NCTC interpret this exception to its primary mission? What indicia of a transnational nexus should be sufficient for NCTC to deem a terrorist threat as part of its primary mission? ANSWER: Generally speaking, under the IRTPA, NCTC’s role concerning domestic terrorism is one of support to the FBI and DHS, as the primary agencies responsible for protecting the homeland against domestic terrorist threats, and includes ensuring that U.S. Government agencies have access to and receive all-source intelligence support needed to execute their counterterrorism plans or perform independent, alternative analysis. With its unique access to all terrorism-related information, and in 24 partnership with its IC counterparts, I believe NCTC is well poised to identify the transnational nature of terrorist threats where they exist. While the nature and degree of a nexus to transnational terrorism may fluctuate based on the particular circumstances, I believe NCTC’s analysts are equipped with the training, experience, and support necessary to make those analytic judgments and provide the appropriate support. b. In the absence of intelligence indicating a transnational nexus, what role should NCTC play in searching for such a nexus or in otherwise supporting law enforcement investigations into domestic terrorist threats? ANSWER: I believe NCTC is uniquely equipped to assist its IC and law enforcement partners in identifying potential nexuses to transnational terrorism. This includes NCTC’s responsibility to ensure that U.S. Government agencies have access to and receive all-source intelligence support needed to execute their CT plans or perform independent, alternative analysis. Where no nexus to transnational terrorism is identified, it is my understanding that NCTC would defer to FBI and DHS, as the primary agencies charged with combating domestic terrorism, for their determination that a particular event is an act domestic terrorism. QUESTION 32: IRTPA includes among NCTC’s primary missions “[t]o serve as the central and shared knowledge bank on known and suspected terrorists and international terror groups, as well as their goals, strategies, capabilities, and networks of contacts and support.” a. As counterterrorism data becomes more voluminous, what new policies and technological approaches and investments are necessary to manage TIDE? Are new privacy policies necessary to keep up with the expansion of TIDE? ANSWER: As I understand it, NCTC’s technological modernization efforts over the past few years have focused on enhancing the correlation, exploitation, and sharing of CT knowledge. This includes technological modernization in identity resolution and the advanced use of biometrics to support the U.S. Government’s screening architecture and provide support to CT partners focused on securing US borders and pursuing threats to their source. If confirmed, I will continue to advocate strongly for technological advancements. 25 As NCTC identifies new ways to ingest data into TIDE, I believe it is important for NCTC to continuing to work closely with the community and with Civil Liberty and Privacy officers to identify any policy or privacy issues that may arise from new processes, the use of machine learning, or the application of new technologies. For example, I understand that NCTC policies seek to align the technological advances of TIDE while improving the Center’s ability to provide enhanced oversight on how the data is used. This ensures that TIDE users have reliable access to more relevant data in the near term, under appropriate privacy policies. b. Should U.S. persons or persons in the United States who are not known or suspected terrorists be included in TIDE? If so, what standards and guidelines should apply? ANSWER: As the U.S. Government’s classified repository for identity information relating to terrorism, TIDE includes individuals with connections to terrorism who do not meet the definition of a KST, including some U.S. persons. These identities can provide valuable analytic and investigatory leads, but we must ensure that U.S. person information in TIDE is handled appropriately. U.S. person information in TIDE is clearly identified and NCTC works closely with its Civil Liberties and Privacy Officer and General Counsel in this regard. NCTC is dedicated to the proper handling and protection of this information, and has a well-established, robust compliance program that includes mandatory annual training on the proper handling and protection of information; NCTC’s legal authorities for the access, use, and retention of U.S. person information; and NCTC’s agreements with its data providers. If confirmed, I will endeavor to advance a compliance mindset within NCTC by ensuring these activities continue and are properly staffed, that new IT systems and advanced analytic techniques account for proper data handling and information protection from the design phase forward and that all TIDE users treat U.S. person information with the same stringent protections as required by Center policy. QUESTION 33: If you or other NCTC personnel were to make a public statement 26 that was inaccurate, do you commit to correcting the public record? ANSWER: Yes. If I become aware of inaccurate information that I or other NCTC personnel convey in a public statement, I would take the appropriate steps to correct the record. If I were not able to make a public correction due to requirements to protect classified information and sensitive intelligence sources and methods, I would inform the Committee of the inaccuracy in a classified setting. QUESTION 34: Do you believe that NCTC is appropriately organized and staffed to counter the current and emerging terrorist threat? If not, what do you think needs to be changed to better address the threat? ANSWER: In May, the Acting DNI announced several changes at NCTC to increase efficiency and expand support and burden sharing with IC partners. These changes include the creation of a surge-capable workforce that postures NCTC to address the increasingly diverse terrorist threat picture. I am confident that these changes will enable NCTC to be even more effective in its mission to protect and serve the American people. If confirmed, I will monitor the Center’s progress to ensure that the Center remains appropriately organized and staffed to achieve its mission. If I see any cause for concern with regards to NCTC’s organizational structure or staffing resources, I will prioritize addressing those concerns and work with Congress as appropriate to do so. QUESTION 35: How do you envision synchronizing NCTC’s efforts with other counterterrorism-focused organizations in the Intelligence Community to reduce unnecessary duplication of efforts and to enhance the US Government’s ability to fight terrorism? ANSWER: In an environment of competing priorities and resource constraints, minimizing any redundancy—analytic or otherwise—is critical, and NCTC is wellpositioned to identify redundancy in terrorism analysis across the IC and to work with the ODNI and the broader IC to reduce such instances. In an effort to reduce duplication in analysis and promote collaboration, I understand NCTC recently implemented a daily, interagency review of planned CT production with key partners and initiated a recurring, IC-wide CT production coordination meeting. If confirmed, I will evaluate the effectiveness of these 27 efforts and look for additional ways to reduce analytic duplication. QUESTION 36: How do you view NCTC’s role and mission with respect to warning of and countering domestic terrorism? ANSWER: My understanding is that generally speaking, under the IRTPA, NCTC’s role concerning domestic terrorism is one of support, and includes ensuring that primary federal agencies and state, local, and tribal partners have access to and receive all-source intelligence support needed to execute their CT plans or perform independent, alternative analysis. In addition, the IRTPA further provides that NCTC may, at the direction of the President, and consistent with applicable law and guidelines, receive “intelligence pertaining exclusively to domestic counterterrorism from any Federal, State, or local government or other source necessary to fulfill its responsibilities and retain and disseminate such intelligence.” It is my understanding that per the IRTPA, NCTC can support the White House by providing strategic operational CT plans for the whole of government across agency boundaries, both inside and outside the United States. QUESTION 37: What are your priorities for the Directorate of Strategic Operational Planning in terms of improving the US Government’s efforts to combat terrorism? ANSWER: If confirmed, my first priority for the DSOP would be to leverage their work on the 2018 National Strategy for Counterterrorism and its 2019 Strategic Implementation Plan to ensure proper governance of the CT Enterprise in an era of shifting national priorities. I believe that the Strategy is the manifestation of the maturation of our CT enterprise. It represents the “lessons learned" gained through 19 years of hard experience, and aligns our government’s functions and priorities in a coherent manner. We must also continue to focus on terrorist efforts to develop or procure WMD, and constantly refresh our collection strategies and plans. It is important that as priorities shift, resources are reallocated in a transparent and efficient manner. This will require DSOP’s unique interagency authorities to gather data, conduct assessments, and convene interagency bodies to track and analyze resource reallocations. I will also assess our global campaign against Al Qaida and ISIS to guarantee that we are sequencing our collection and operations to guarantee maximum effectiveness and efficiency and update our measures of effectiveness. Finally, I would expect DSOP to continue to play a role in strategy and planning for novel and cross-cutting issues such as Identity 28 Intelligence and the use of battlefield evidence to support domestic and international prosecutions of terrorism suspects. QUESTION 38: How will you ensure that NCTC recruits the best and brightest officers to the organization, and how will you seek to retain those officers? ANSWER: Having the right people with unique knowledge, skills, and backgrounds is critical to fulfilling NCTC’s mission. While NCTC is lucky to draw thousands of qualified applicants through the external hiring process, drawing detailees from other departments and agencies has become more challenging as agencies shift staff to address competing priorities. If confirmed, I will focus on attracting and retaining detailees by building strong relationships with my interagency partners and conveying the value of building a robust, interagency CT workforce at NCTC. NCTC also has a robust recruitment and training program that brings entry-level employees into the organization to expand the knowledge, skills, and abilities of its workforce and address the evolving terrorist threat. Many of these employees have gone on to perform admirably on external rotations throughout the government and on foreign deployments; experiences that provide value to both the Center and to the employees themselves. Lastly, NCTC regularly seeks input from staff on ways to address the needs of its workforce and encourages staff to “lead from where they are” to make positive changes in their teams and at the Center. QUESTION 39: Based on your professional experience, how important are our foreign partners in advancing U.S. counter-terrorism objectives? To what extent should other national security objectives be considered in forming, maintaining, and growing such partnerships? If confirmed, how do you plan to approach U.S. partners on these problems? ANSWER: My experience fighting in Afghanistan and Iraq and supporting partners worldwide validated for me Churchill’s aphorism, “There is only one thing worse than fighting with allies, and that is fighting without them.” Foreign partner relationships are crucial to our shared success against terrorism. Working with global partners and allies, I believe the CT community has made tremendous progress in our ability to detect and disrupt multi-actor, sophisticated terrorist attacks. NCTC must work closely with foreign CT partners to improve information sharing and to assist in capacity building. 29 In my experience, throughout the CT community, our international counterterrorism partnerships are vital to achieving our counterterrorism goals. To this end, we should remain committed to helping partners develop the capacity and willpower to pursue our shared objectives. In particular, our efforts can help professionalize the military, intelligence, law enforcement, and judicial systems of key partners so they are able to effectively counter terrorists. We expect significant contributions from our foreign partners so that they appropriately share the burden of the CT effort. To get ahead of the terrorism problem, we must continue to empower stakeholders to build prevention architectures to thwart the appeal of terrorism. In concert with our partners, we will apply sustained pressure to disrupt, degrade, and prevent the reconstitution of terrorist networks. If confirmed, this will be one of my major emphasis areas. 30 Additional Pre-Hearing Question from Sen. Wyden Question: On May 25, 2020, then-acting DNI Grenell announced changes to NCTC. The public announcement highlighted changes to the Directorate of Strategic Operational Planning and the Directorate of Terrorist Identities, “aligning resources and eliminating certain redundancies,” “consolidating support and enabling functions,” and the building of a “surge-capable workforce.” Please provide your views on these changes and any other changes made by the thenacting DNI with which you may be familiar. Response: As I understand it, ODNI has conducted several studies of its enterprise to identify efficiencies and cost savings at the request of Congress and Intelligence Community partners. The changes to NCTC that then-acting DNI Grenell announced on May 25 reflect the conclusions of those studies. I understand that these changes are designed to enhance integration with the broader ODNI, expand NCTC support to IC partners, and increase internal efficiencies to be good stewards of U.S. Government resources.