<img height="1" width="1" style="display:none" src="http://b.scorecardresearch.com/p?c1=2&amp;c2=15743189&amp;cv=2.0&amp;cj=1&amp;&amp;c5=&amp;c15=">

Decoding NSA director Mike Rogers' comments on countering Russian cyberattacks

022718 Rogan NSA-pic
National Security Agency Director Mike Rogers' comments were more nuanced than "I'm not authorized to act against Russian cyberactivities." (AP Photo/Alex Brandon)

National Security Agency director Mike Rogers' comments to the Senate Armed Services Committee on Tuesday are not as simple as: "I'm not authorized to act against Russian cyberactivities."

That, however, is how most of the commentariat are assessing Rogers' response to questions from Sen. Jack Reed, D-Del., on how the NSA is responding to Russian attacks.

The reality is that Rogers' comments were more nuanced. First up, Reed asked, "Now, aside from our intelligence agencies operating under a presidential finding, are there any other organizations other than the cyber-command, cyber-mission forces that have the authority and capability to disrupt Russian election hacking operations where they originate? Does the FBI, DHS... have such capabilities?"

Rogers' responded that "You could argue that some combination of the [Department of Justice and Department of Defense] have the standing authority in that regard."

Two things stand out here.

First off, Reed's qualification of "aside from our intelligence agencies operating under a presidential finding."

This is crucial because "a presidential finding" refers to a covert action authorization that Reed would not be privy to and Rogers could not discuss with the Senate armed services or intelligence committees: even in closed hearing. A covert action authorization is only disclosed to the so-called "gang of eight" members of Congress.

As I've noted, "the gang is made up of the chairman and vice chairman of the Senate and House Intelligence Committees and the top Republican and Democrat from each chamber. Meeting in secret, these high-ranking politicians oversee intelligence activities that the president deems too sensitive to share with the full committees in the House and Senate."

This is a huge caveat for Reed's question in that it means Trump may have authorized specific action that no one beyond the gang knows about. Equally crucial, if there is a presidential finding related to Russia, Reed's caveat gave Rogers a way to answer specifically without misleading Congress.

The second stand out point is Rogers' answer that the departments of justice and defense have source-targeting counterattack authorities. This suggests that the U.S. does have the means to act quickly in the event a Russian cyberattack is detected (although not as effectively as would be the case had NSA also been given that authority).

The next point of relevance came when Reed asked Rogers whether NSA "mission units" had the standing authority to counter-strike Russian cyberthreats at their source.

Rogers responded, "I don't have the day to day authority to do that."

This is notable in that it shows the NSA does not have a broad authority to take action against Russian cyberoffensives.

Trump deserves criticism here in that the scale of Russian cyberactivities targeting the United States justifies a standing NSA authority to broadly counterattack hostile Russian actions. While Russian intelligence activities in cyberspace are varied, they are tactically aggressive and motivated by a strategic intent to disrupt U.S. democratic society. This requires countervailing U.S. action.

The final key point came when Rogers stated that "Based on the authority that I have as a commander, I have directed the national mission force to begin some specific work I'd rather not publicly go into that — using the authorities I retain as a commander in this mission space."

Here Rogers is almost certainly referencing efforts to plan for a counteroffensive capability should the president ever seek that action. Note, here, the "begin some specific work" element of Rogers statement. That suggests innovation towards a reflexive response capability that can counteract attacks targeting the midterms. What also supports this thesis is the fact that CIA director Mike Pompeo recently testified that the U.S. would retaliate against new Russian cyberattacks on the midterms.

Ultimately, I suspect that the White House has already authorized some kind of action against Russia. If nothing else, to allow the Russians to continue biting at the U.S. political system is to throw blood into shark infested waters.