DoD News Briefing [...]Tuesday, September 19, 2000 1:30 p.m. EDT
Presenter: Rear Adm. Craig R. Quigley, DASD PAQuigley: George?
Q: I'd like to get straight on the time line of former Deputy Secretary Deutch and his use of his home computer for classified information from the Pentagon as distinguished from that he put on his home computer from the CIA. According to congressional documents, the CIA notified the Pentagon in June of '98 that there was a problem with Deutch putting his secrets from the Pentagon on his home computer. And I understand that Secretary Cohen wasn't aware of it, or didn't initiate any action till February of 2000. Why the big gap, and when did the IG formally launch an investigation, and were any of this stuff that Deutch put on his home computer from the Pentagon penetrable? In other words, could a bad guy get into his system and extract secrets?
Quigley: There were a couple of memos from June and July of 1998 where the CIA had indicated to us -- they had asked for our assistance at that point in their ongoing investigation, to have -- assist in any sort of interaction between Dr. Deutch's use of computers, personal computers while he was the director of Central Intelligence, and if there was an overlap during any of his time while he was undersecretary or deputy secretary here at DOD. During those initial conversations in June and July of 1998, we were apprised that at some point in time, when CIA was completed with its IG investigation, we would probably want to do a damage assessment of our own, based on --
Q: (inaudible) -- who's telling you that at this point?
Quigley: This is the CIA IG.
Q: Telling you -- suggesting that you do your damage assessment?
Quigley: Right. Suggesting that when they provide us the findings of their investigation that we will probably want to do a damage assessment of our own, based on the findings that they had gotten to date.
Time has passed now, and we received the full-blown findings of the CIA IG in February of this year, along with the journal that had been kept, a running journal, by Dr. Deutch, over a period of time, and that provided us an opportunity then to take a look in a very comprehensive way at what CIA's investigators had been working so hard on for this, roughly, year and a half.
When Secretary Cohen received that information in February of this year, the results of the CIA investigation, he immediately turned around and tasked our own people here within DOD to take further action, and that takes two parts. On the one hand, he tasked our IG to take a look at the physical handling of the computers -- the hard drives, the floppy drives, the hardware, if you will -- on which Dr. Deutch would have used information -- processed e-mails, done work, what have you; track them down, try to find out where they had been, how they had moved, over time. On this side, he had tasked then our assistant secretary for Command, Control, Communication and Intelligence to take a look at the products that would have been on that hardware -- the actual information they contained.
And what did we find? Again, basing -- with a running start from the very professional work being done by the CIA's investigation -- what did we find? Do we have a sense of possible compromise? If so, what would be the damage assessment from that compromise? -- and then tasked, further, the general counsel to bring both parts of that effort together and, ultimately, to forward it to him, to Secretary Cohen, when both parts of the work had been completed.
That is where we are today. We're getting closer to completion, although I don't have a date certain to give you. But the general counsel is in the process of pulling together both of those parts and will then forward it up to Secretary Cohen.
Q: Well, let me just follow on that. The red flag was waved by the CIA in June of '98, and there was no action for 18 months. What -- that seems, for a place that puts out memos every day about breaches of security, that seems to me that there was a reluctance on the part of the IG to investigate this, or a reluctance on the part of the top executives of the Defense Department. How can you go from a warning in June of '98 to doing nothing until February of 2000?
Quigley: We saw very little value of reinventing the wheel. The CIA had already started down this road, had asked for our assistance to provide them information that was relevant to their investigation, from DOD records and files. Rather than largely duplicating their effort, we felt that the best course of action was to let that professional investigation proceed, like I say. And eventually we received the comprehensive package in February of this year and immediately Secretary Cohen turned that around and took the actions that I just described.
Q: Was there any reluctance by the IG, or acting IG, Mancuso or Deputy Secretary Hamre to investigate one of its own after the CIA had sounded its warning?
Quigley: No. I think the record does not support that at all.
Q: How about the other question about penetrability? Any evidence that somebody could get into Deutch's home computer and get defense secret information from it?
Quigley: Well, that's one of the elements that the assistant secretary for C3I is looking at as part of their effort in this -- is the possibility of compromise.
I don't want to go into the findings. I have tried to be complete on the process that's ongoing, but I'm not ready to get into the findings yet until they've been presented to Secretary Cohen.
Q: Is there any evidence that that could have been done, or are you not ready to say?
Quigley: I'm not ready to say. That's going to be part of the findings.
Barbara?
Q: Can I follow up on two points? I don't understand what would have been duplicated when the CIA, if I remember correctly, was investigating Dr. Deutch's activities while he was DCI. What would have been duplicated if you had been investigating his activities while he was deputy and undersecretary?
Quigley: Part of their efforts -- and again, when they had asked for our cooperation in June and July of 1998 -- was to provide access to relevant records over here, in DoD, where there had been an overlap. That would have been the very information upon which we would have focused an effort of our own. We were not going to take a look at activities in his capacity as head of CIA. Our activities would have been focusing on the time spent here in DoD, and that was the exact area that the CIA investigators asked for our help to facilitate their own investigation. So it would have been a near carbon copy of the effort.
Q: So that included his computers? They investigated what was actually on his computers that he used while he was at DOD?
Quigley: Yes, yes.
Q: But you know, in that period, Hamre had warned that there was hackers that were penetrating your uttermost secrets, and he sounded the alarm about it, and yet you did nothing and just waited on CIA. It doesn't compute for me.
Quigley: I'm not sure how we could have advanced the time line, George. Again, we would have been -- you would have been doing the exact same process that the CIA investigators were already well into by that point. I'm just not clear what value that a second, overlapping investigation would have brought to the effort.
Q: Well, the CIA has its IG, you have your IG, and your IG didn't do anything.
Quigley: Well, we did. I mean, the -- our folks here in the Pentagon were asked to help and assist in the CIA investigation, and they did that for a period of considerable time, to provide the information that I described. But for us to have initiated something at that point would just -- would have been duplicative.
Barbara?
Q: Well, let me just go back over something, then. I mean, during that whole 18 months you knew there was a problem, and yet Deutch maintained his industrial security clearances in this building. And if I remember correctly, it was on that very point that the secretary was quite annoyed in February and said he wanted to know, I believe, you know, why this had gone on for so long. And that's one of the reasons he put his own investigation into place. So it still doesn't really answer the question which Cohen raised, which was you waited 18 months to pull his DOD clearances knowing that there was a problem.
Quigley: Well, you're talking about the industrial clearances here. And there is a very specific process that needs to be followed in removing those clearances except in clear evidence of grave danger to the national security of the United States. And at that point we simply did not see that. And so in February of this year, when Dr. Deutch voluntarily relinquished his industrial clearances, that followed the August 1999 recision of his special compartmented information -- SCI -- clearance by the director of Central Intelligence and DoD rescinding his Washington Headquarters Services clearance as well, which left only the industrial one. And again, he voluntarily rescinded that in February of this year.
Q: Do you have any answer yet, though, to Cohen's own questions when this came up as to why this went on for so long in this building before something was done? I mean, I do believe --
Quigley: What -- what went on?
Q: This whole period of DoD not addressing it. I think I do remember in February he raised that very point himself. When he was asked, he said this should have been dealt with sooner.
Quigley: I don't recall that. I'd have to go back and check the record.
George?
Q: So you're very clear that there was no resistance by the IG into digging into this situation.
Quigley: Crystal clear.
Q: Would you concede that there was a double standard in the fact that they put Mr. Lee in jail on the first suspicion of espionage, and here's a deputy secretary of Defense with secrets on his home computer and nothing happens at all?
Quigley: No, sir. I do not concede that at all. The allegation against Wen Ho Lee was that it was a conscious effort on his part to compromise classified information. The allegations against Dr. Deutch from the beginning have been lax handling. There's a world of difference, in my mind. I do not equate the two.
Q: You said that the Pentagon did not want to start the investigation earlier because it would duplicate what the CIA was doing. But you started the investigation in February 2000, which is still an investigation that would duplicate what the CIA is doing. So what would have been the difference, whether you started 18 months earlier or whether you start in February?
Quigley: The difference was the receipt of the formal, comprehensive package, Toby, from the CIA investigators, which showed us clearly exactly what their findings had been and allowed us a running start, if you will, on our own efforts. So you're way down the road based on the receipt of their professional efforts for the period of several months.
Q: And what is the reason why, when their IG had completed his report in August 1999, that you did not receive the formal documents until February? What is the reason for -- the reason that you didn't get them sooner?
Quigley: I'm not sure, but I think one of the contributing reasons was the great sensitivities and highly classified nature of a lot of the materials that the CIA investigators had found. Just because an individual has a clearance or an authorization to -- clearance and access within the scope of one individual's employment within the federal government does not automatically equate that to another element of the federal government.
And I think that we certainly wanted to proceed very cautiously here and make sure that we were all kind of working from the same set of assumptions and not to perhaps further compromise any highly sensitive and classified material during that same time frame. Ultimately that was resolved in the package being turned over in February of this year by the CIA to us, but again, in a very tightly controlled manner, limited number of copies, because of the highly sensitive and classified nature it contained -- information.
Q: So are you saying that the CIA did not want to turn over that information to you until you had a group of people that could receive it?
Quigley: I think that one of the contributing things was their very appropriate caution to make sure that the proper controls were in place for turning over their product to the Department of Defense.
Q: But I am reading you correctly, that you're saying that the CIA held up turning over the documents to the Pentagon?
Quigley: I'm not necessarily calling that a bad thing. (Light laughter.)
Q: Right.
Quigley: I'm saying that I think that they were appropriately cautious before handing over such a highly sensitive volume of information to another agency to proceed on an investigation of its own.
Q: Well, just to follow that, didn't their caution, as you describe it, mean that if there were weaknesses in security in this building that they had found out about, that no one was addressing those weaknesses during the entire 18 months? If nobody was -- either saw their report or was briefed on what they were finding as they were investigating, then any kind of weaknesses in security in this building were going unaddressed during that time. Is that right?
Quigley: Yeah, but that's a wonderful thing to have in hindsight, Dale. We may -- we may wish that were the case today. I don't think that was the case at the time.
There's always a great deal of enthusiasm to speed things up. Generally, that's not an advantage. It's generally an advantage to take your time and resist the pressure to speed things up, to make sure that you don't do more harm than good by either overlooking something that's a very important element of the work you're trying to uncover, making sure that the information that is shared is shared in an appropriate way. I mentioned the classification and the highly sensitive nature of a lot of the equipment. And you're talking about a tremendous amount of material here. So I think a little extra time was certainly appropriate.
George?
Q: Can you think of a precedent when a chief executive -- in this case, the number two executive of the Defense Department -- is suspected, wittingly or unwittingly, by the CIA of breaching security, and you subcontracted the investigation -- the Department of Defense subcontracted the investigation of one of its own to the CIA? I can't think of any precedent where the Department of Defense would subcontract an investigation of a security breach in its own tent to the CIA. I mean, I -- can you think of a precedent for that being done?
Quigley: No, I wouldn't characterize it the way that you have just done. The CIA --
Q: (Off mike) -- the CIA.
Quigley: Yeah, the CIA's efforts were focused on his time as the director of Central Intelligence --
Q: Right.
Quigley: -- as they should have been. Where there was an overlap into his previous service here at the Pentagon, they asked for our cooperation, and we gave that.
Q: Why would there have been an overlap? I don't understand.
Quigley: If you're the director of Central Intelligence, there are legitimate needs for you have to access to DoD classified information as well. And if there were documents or e-mails or any other form of record that would contribute to the CIA's investigation, they did not have possession of those materials, necessarily, unless they were found on the computers.
But if there was information here that would be relevant to their work, that's what they asked us to assist them -- and we agreed. We had --
Q: I'm saying something different, though, Craig. What I'm saying is that the CIA of course would come to you for any help you could give them in relation to their own investigation of what Dr. Deutch or did not do while he was at the CIA.
My question is, why would you subcontract the investigation of what Dr. Deutch did on his computer in the way of breaching security while he was at DOD as the number-two executive?
Quigley: I understand --
Q: In other words, it would seem to me that you would have to get right on that, order the IG of your own department to say, "What happened here, what damages have been done, and is it something that we have to plug immediately, and could the bad guys have found out," rather than wait for the CIA to tumble in with its own report on -- "Oh, by the way, we looked into your problem, too." Why didn't you investigate your own problem as soon as you heard about it?
Quigley: Well, again, go back to the memos I referred to in June and July of 1998, where the CIA was giving us a heads-up --
Q: Right.
Quigley: -- that when we had a chance to assess their investigative work, they felt that we would want to do an investigation of our own, more finely focused, if you will. But that was based -- okay, we accept that at face value. But we did not have access at that point, in June and July of 1998, that the CIA investigators had. We wanted to --
Q: (Off mike) -- computer and say, "Hey, Doctor, while you were at DoD" --
Quigley: We were not in possession of his home computer. CIA was in possession of his home computer.
Q: But you could send an IG guy to co-investigate it.
Quigley: Well, you've got dueling investigations again, and we just didn't feel --
Q: It's your department, Craig.
Quigley: Well, yeah, but there's no reason to do it twice. The CIA has a very professional inspector general that knows how to do this. We had confidence that they were able to find out the information during that period of time. We had no computers to check.
Q: Well, it seems to me that the CIA would have to take care of its worries about its own CIA, and DOD would have to have a parallel look at what it has to worry about within its own department. It doesn't compute to me that you say, "Well, we'll just wait for the CIA report," and let the damage that might have been done to DOD be untilled by the inspector general.
Quigley: Well, this was all about a potential compromise of classified information on computers that we did not have in our possession. It's not clear to me how we would have proceeded without reinventing a lot of the effort that CIA investigators were doing at the very same time frame.
Barbara?
Q: In hindsight now, are you satisfied with the procedure you have outlined? Is this now, in fact, standard procedure in a security investigation that crosses -- that goes across agencies? Is this the way you handle it with everybody, no matter how low level they are?
Quigley: I don't think there is such a thing as a standard procedure. I think you have to take a look at the process and what you know each and every time and make a human value judgement as to the best way ahead. I don't think anyone would subscribe that there is a single best way to proceed in all cases.
Q: To what extent, then, was part of this because of the very extraordinary sensitivity of the information Dr. Deutch had access to and was dealing with? Did that play a role in how this was handled?
Quigley: I don't understand your question.
Q: Was part of the reason you handled it the way you did was because, I believe you have said, there was some extraordinary sensitivity of the information he had access to?
Quigley: No, I don't think that was an element of our approach. Our approach was focused on the period of time that he served in the Defense Department, using as a starting point the CIA investigation that we received in February of this year.
Pam?
Q: I want to be clear on something. The CIA is investigating for his time when he was at the CIA, and not for his time at DOD at all. And DOD has now picked it up and is going back to look at Deutch when he was USD A&T and then when he was DEPSECDEF. Is that right?
Quigley: Yes, although there is some overlap.
Q: And the overlap is only because CIA sometimes deals with DOD intelligence.
Quigley: For instance, Dr. Deutch, remember, remained a member of the Defense Science Board after he had left the Pentagon. So in that capacity, I mean, he would have a need to retain access to some of the Pentagon programs that the Defense Science Board would be looking at.
Q: Okay. So I guess this is back on George's question, which is you have two distinct time periods. So it wouldn't have been dueling investigations. It seems to me they'd be separate investigations, because one is him as CIA chief and one is him as USD A&T. And with regard to your point on -- that DOD didn't have possession of the computers, correct me if I'm wrong, but what I remember is that Deutch had DOD computers and they were then transferred to his own personal use when he left DOD.
Quigley: I believe at least one went with him to CIA.
Q: So DOD doesn't retain any kind of ex officio control of those computers? It can't come and say, These were DOD property and by our good graces you have them, and we -- give us them back?
Quigley: I don't think that's an action we would have taken in the midst of a CIA investigation into the same computers. It doesn't make sense.
Q: All right. So then can you go back to the first point, which is two distinct time periods. I don't -- can you explain how you would see those as dueling investigations when you're dealing with one man who is CIA director, and then another man who was -- had several top roles at DOD at different times?
Quigley: When you go back to the June-July 1998 timeframe, when we were advised at that point that there may be something that we want to -- that we would want to follow up on a possible damage assessment once the results of the CIA investigation were known to us, keeping in mind that this was an investigation that was ongoing by CIA at that point, they were in possession of the relevant computers at that point. And the -- I don't know how we would have proceeded at that point knowing that the investigators at CIA were already marching down this same road. And that --
Q: Let me address that. You have your own experts in this building -- I mean, if there's something very technical, like the footprint of a warhead when it hits, so that you know its killing capacity. It just would seem to me that this was not an antagonistic witness, so to speak. You could send your experts to borrow the computer, to go to the CIA and get the computer. If there were any interest in the DOD finding out what went wrong in its own house, I don't see you can hold out the excuse that, well, we didn't have access to the computers. You were welcome to look at those computers. You could have taken your experts over there. I don't get it.
Quigley: There was an enormous amount of information, I understand, on those computers that DOD has no equities in. The CIA does. And to ask them at that point to segregate, Please put all the DOD information in this pile so we can take a look at it while you guys go ahead and retain the CIA information, just didn't seem like an efficient way to move forward.
Barbara?
Q: Who made the decision in this building not to proceed with the DOD investigation? Who made that final decision?
Quigley: I don't know that there was a suggestion by anyone to initiate a DOD investigation in the summer of 1998.
Q: Why not?
Q: But, I mean, is it just the dog didn't bark, or was there a decision not to do this, or did nobody just bother?
Quigley: I don't know.
Q: There was a warning flag. We all agree on that.
Quigley: That's right. And the warning flag was clearly placed in people's minds that when the CIA investigation is made available to the DOD, we may want to take a close look at the damage assessment. That is precisely what we did in February of 2000.
Q: It's a warning that nobody did anything about for 18 months in this building.
[...]