SELECT COMMITTEE ON INTELLIGENCE UNITED STATES SENATE Post-hearing Questions For Lieutenant General Timothy D. Haugh upon his nomination to be Director of the National Security Agency Page 1 of 7 QUESTIONS FOR THE RECORD From Vice Chairman Rubio General Oversight 1. How will you ensure that the Committee maintains current and full awareness of the National Security Agency’s (NSA’s) activities and intelligence reporting? If confirmed, I will be committed to keeping the congressional intelligence committees fully and currently informed of NSA’s intelligence activities, as it is not appropriate to withhold information that is within the jurisdiction of any congressional committee. I, and my delegates, will provide the information necessary to keep the Committee currently and fully aware, to include following established procedures for briefing the most sensitive matters. 2. Will you commit to us that you will be responsive to Committee requests for briefings and meetings, and ensure that we are notified in a timely manner of significant activities within our jurisdiction? Yes, I commit to being responsive to Committee requests and ensuring timely notifications of significant activities within the Committee’s jurisdiction. 3. If asked by the Committee, will you provide the sourcing behind the NSA’s finished products and assessments? If confirmed, I commit to accommodating the Committee’s need for information in order for the Committee to perform its critical oversight function. 4. If asked by the Committee, will you provide the raw reporting that underpins IC finished products and assessments? If confirmed, I commit to accommodating the Committee’s need for information in order for the Committee to perform its critical oversight function. 5. Do you commit to ensuring that this Committee has access to all intelligence activities under your purview? Page 2 of 7 If confirmed, I commit to keeping the Committee fully and currently informed of all of NSA’s intelligence activities. 6. As the Deputy Commander of U.S. Cyber Command (CYBERCOM), what steps have you taken to grow the Command to be a self-sufficient organization? What more is needed to be done to have an independent organization? As Deputy Commander, I have worked to ensure that CYBERCOM is properly resourced and manned and enabled to operate in conjunction with others under delegations of authority, mission direction, and policy guidance necessary for effectiveness in the domain. I reinforce clear guidance in the planning process to develop options that draw first upon CYBERCOM capabilities and authorities while also working effectively in concert with NSA, the interagency and partners. I have been an advocate across the Department and with the Services to address shortfalls in readiness, manning, and training of the cyber mission forces and am also an advocate for expanded intelligence support to cyber to enhance our mission effectiveness. If confirmed, I will continue to work toward further improvements for CYBERCOM in readiness, training, and capability development, as well as seeking to apply enhanced budget control responsibilities to improve the Department’s efficiency and coherence in its acquisition and cyber investments. The overlapping nature of the intelligence and cyber operating domains with the other warfighting domains is such that I believe the best outcomes for the Nation cannot be achieved separately and independently by any one organization. CYBERCOM can bring the best results for the Nation in close operating relationship with NSA, other mission organizations within the Department, the IC, the interagency, the private sector, and foreign partners. 7. Given the multiple organizations you will be leading, if confirmed, how can you assure us that NSA will receive focused leadership and attention, particularly given your legacy leadership role with CYBERCOM? If confirmed, I will be responsible and accountable for the mission effectiveness of both organizations. Such responsibility and accountability will naturally drive me to Page 3 of 7 give full and proper attention to NSA. My current leadership role with CYBERCOM and my familiarity and knowledge of its leadership, its mission, strengths and weaknesses means that I will be well positioned to comfortably delegate and direct its activities efficiently; enabling time management and focus necessary to NSA’s global enterprise. 8. How do you intend to advance NSA’s relationship with other large Intelligence Community agencies, notably the Central Intelligence Agency (CIA), Defense Intelligence Agency (DIA), National Geospatial-Intelligence Agency (NGA), National Reconnaissance Office (NRO), and Federal Bureau of Investigation (FBI)? Interagency collaboration is paramount for NSA’s mission success. If confirmed, I will further assess the current status of NSA’s relationships with each of the noted agencies, and partner with other agency heads to identify further opportunities to improve integration and collaboration across the IC. 9. Do you believe NSA’s defensive cybersecurity mission is appropriately resourced? What changes do you intend to make as to how that mission is executed? NSA devotes an entire directorate to the Agency’s cybersecurity mission to ensure NSA is postured to contribute to the protection of National Security Systems (NSS), the DoD, the Defense Industrial Base (DIB), and other customers of the Agency’s cybersecurity products and services, which includes the dissemination of cyber threat intelligence. If confirmed, I will assess the resource posture and mission execution of NSA’s defensive cybersecurity mission. From Senator Wyden Definition of Signals Intelligence 1. During your hearing, you testified that: “In terms of where the definition of signals intelligence [is] defined, it's defined in National Security Council Intelligence Directives, in E.O. 12333 and in the United States SIGINT systems intelligence directives. They are all very consistent in terms Page 4 of 7 of what comprises SIGINT in terms of communications intelligence, electronic intelligence, and foreign instrumentation signals intelligence. So, I think there is a common definition that is aligned across the executive branch.” Please identify precisely the definition of signals intelligence that you believe applies across the executive branch. The definition of signals intelligence applicable to NSA is found in DoDM S5240.01-A (the SIGINT Annex) that, at Section 1.2, defines SIGINT to include, individually or in combination, communications intelligence (COMINT), electronic intelligence (ELINT), and foreign instrumentation signals intelligence (FISINT). Reverse Targeting 1. During his confirmation process, now former Assistant Attorney General for National Security John Demers was asked about the prohibition on reverse targeting in Section 702 of the Foreign Intelligence Surveillance Act (FISA). He responded: “As I understand it, determining whether a particular known U.S. person has been reverse targeted through the targeting of a Section 702 target necessitates a fact specific inquiry that would involve consideration of a variety of factors. For example, as the Privacy and Civil Liberties Oversight Board noted in its 2014 report, if a Section 702 tasking resulted in substantial reporting by the Intelligence Community regarding a U.S. person, but little reporting about the Section 702 target, that might be an indication that reverse targeting may have occurred.” During his confirmation process, current General Counsel for the Office of the Director of National Intelligence Christopher Fonzone was asked about this formulation. He responded: “My understanding of how IC entities make reversetargeting determinations aligns with the view that Assistant Attorney General Demers expressed during his confirmation process – i.e., that such determinations are fact-specific and necessitate the evaluation of a variety of factors.” Page 5 of 7 Does your understanding of the framework for determining whether reverse targeting has occurred comport with that of Mr. Demers and Mr. Fonzone? If yes, how should NSA implement this process, with regard to targeting under both Section 702 of FISA and E.O. 12333? My understanding of whether reverse targeting has occurred comports with that of Mr. Demers and Mr. Fonzone. Reverse targeting is strictly prohibited at NSA under both Section 702 of FISA and E.O. 12333. NSA reinforces this prohibition on reverse targeting through training, which is mandatory for all analysts with access to SIGINT data. Additionally, my understanding is that the Department of Justice reviews 100% of NSA’s Section 702 targeting requests and reviews Section 702derived serialized reporting containing U.S. person identities. From Senator Lankford Iran’s Capabilities The Iranian regime, the world’s leading state sponsor of terror, continues to pose grave threats to U.S. interests and persons globally. 1. If confirmed, how do you plan to prioritize and tackle Iranian regime threats against the U.S., our interests, and our allies? Threats to our Nation’s security are numerous – Iran continues to attempt to coerce the region with both conventional and cyber weapons. I have seen firsthand that NSA effectively aligns its collection activities with the National Intelligence Priorities Framework, while maintaining agility to respond to changes in priorities, mission requirements, shifts in target technology and crises. I would continue this method of prioritization if confirmed. 2. To fully address these Iranian regime threats, especially those in the cyber realm, do you believe that NSA requires new authorities? Page 6 of 7 If confirmed, I will assess two factors – the first, the full spectrum of Iranian threats and related challenges faced by the IC; the second, how NSA makes use of its current authorities. This will allow for a more comprehensive evaluation on whether additional authorities would be beneficial. Page 7 of 7