I said I would write up my notes from DEFCON27, where I had the “opportunity” to meet General Flynn’s residual guy with cyber in his title, so here it is.

DEFCON always has been for me about meeting with the Federal Government. Since the mid-1990s it has felt like the place government staff come to party with reduced accountability and oversight.

This year I stepped into the “Ethics Village” and listened to Joshua Steinman present his vision. To be honest in my decades of experience in security and working with the government I never had heard of Josh. When he began speaking I kind of realized why. He said very emphatically to the moderator:

Please don’t ever say cyber security. It’s just cyber.

This was like telling us don’t ever say “Internet security” because just saying Internet somehow magically implies security is there. Yeah, not going to happen. Say cyber security if you care about security.

Few things self-reveal someone inexperienced in security like their overuse of the term cyber, leaving off modifiers needed to clarify, or lacking a sense of irony.

He also gave an intro of his background where he claimed to be a world-class expert on Al Qaeda before 9/11, issuing a national security report based on all available evidence (I later found out this was just a short paper he wrote in high school, and I am not kidding).

Let me say that again. He wrote a paper in high school and, based on that alone with nothing more, claimed publicly to be a world expert on Al Qaeda.

He also said he was a big supporter of the Republican candidate for President and that pulled him straight into the White House after victory.

And finally he called himself entrepreneurial (I later found out he started a knitting company to make socks for men, and again I am not kidding).

While he puffed himself up like a giant balloon that believes he is on the right side of history and ahead of his time, something about this wildly self-promoting character was off… especially compared to the quality of other speakers in prior sessions in the Ethics Village.

For the next 30 minutes or so Josh rattled randomly about personal life philosophy. He suggested hanging around the coffee station or water-cooler is his management strategy. And he was surprised to find out an 1800s-era White House is physically small.

I’ve since been told “water cooler talk” is a dog whistle for closed door meetings where minorities who deserve equitable treatment are intentionally excluded.

For someone repeatedly claiming he was able to see into the future, everything said was the opposite of substance or prediction. Imagine traveling all the way to a conference, sitting down to hear the “head of cyber” for a national government, and getting a presentation that sounded like this:

Usually I like to stand around in the break room area by the coffee. That’s where I hear conversations others are having and can find out what’s happening in the White House. Sometimes I join their conversation.

We can infer that nobody would share details with him otherwise and probably too polite to refuse him joining their otherwise “inequitable” conversation format in the break room.

Think about this in terms of surveillance and confidentiality. What he is saying is he likes to insert himself into conversations in a manner most convenient to him, and such that he can interfere in a discussion without being formally invited; insider privilege because he has the key to the break room.

This was by no means a comforting talk to hear from the person purporting to be the policy making leader of our industry. I’m also paraphrasing here as Josh said several times “Raise your hand if you are a reporter. There are no reporters here? What I’m saying is off the record.” It appeared he was joking about this, although nobody laughed.

In retrospect I wish someone had said in response “how is being a reporter different from you standing around the break room and then telling other people what you heard?”

What caught my attention, among the rambling stories of hanging around spying on people and achieving nothing tangible, was that Josh proudly said with the utmost confidence “executive privilege is right there in the Constitution. Go read it to see for yourself.”

I’m no constitutional lawyer but as a historian who studied cold-war machinations of Presidents I’m well aware that the executive privilege line most definitely is NOT something you can read in the Constitution. Furthermore, as a security professional, I’m well aware of the danger of executive privilege being used to suppress evidence/speech and deny freedoms necessary to avert suffering at massive scale.

Perhaps Constitution Daily put it best:

One of the great constitutional myths is the principle of executive privilege. Though the term is not explicitly mentioned in the Constitution, every President has called upon it when necessary.

I really have no idea why Josh would say “go read it” for something that doesn’t exist in writing. He’s supposed to be a policy expert. Moreover you can imagine there is a big issue with oversight for that qualifier “when necessary”, since it’s for a privilege that is going to be argued as above all oversight.

Ronald Reagan infamously invoked executive privilege, while carefully avoiding use of the exact phrase, in attempts to avoid accountability for illegal arms deals:

The alternative language used by Mr. Reagan’s lawyers appears to reflect a desire to avoid the negative connotation associated with the term, which over the years has come to be thought of by critics as a legal ploy invoked by Presidents seeking to deflect embarrassing inquiries.

The legal skirmish is taking place in advance of Mr. Poindexter’s trial, which is scheduled to begin on Feb. 20. He faces five criminal charges, including accusations that he obstructed Congressional inquiries and made false statements to Congress about the Government’s secret arms sales to Iran and about efforts to aid the Nicaraguan rebels, or contras, at a time when such assistance was banned by Congress.

That reference to legal ploy comes from Richard Nixon, who similarly claimed he had such an executive privilege to conceal his guilt. He thought he could block White House tape recordings being revealed during the Watergate Scandal.

During the Bush Administration, executive privilege was argued to be not only non-specific but also quite limited. Note the reference to Kavanaugh (now on the Supreme Court) lying to Congress.

Predictably, the White House is claiming executive privilege and refusing to cooperate with the legitimate Congressional investigations, one springing from Mr. Bush’s decision to spy on Americans without a warrant and the other from the purge of United States attorneys. The courts have recognized a president’s limited right to keep the White House’s internal deliberations private. But it is far from an absolute right, and Mr. Bush’s claim of executive privilege in the attorneys scandal is especially ludicrous. […] Nor can it be used to shield an official who might have lied to Congress. The Senate Judiciary Committee has asked the Justice Department to investigate Brett Kavanaugh, a former White House official who told a Senate hearing on his appointment to a federal judgeship that he was not involved in forming rules on the treatment of detainees. Recent press accounts suggest that he was.

That’s a far more restrictive interpretation of executive privilege theory versus a Washington Post article from 1986 that spells out how proponents had wanted to use it under the Reagan Administration:

While serving in effect as lawyer for Attorney General Edwin Meese III, Cooper also advises the Justice Department, other federal agencies and inquiring members of Congress on a wide range of legal questions. Most of his opinions remain confidential, but some that have surfaced have generated headlines. In one opinion, Cooper argued that employers may fire persons with AIDS because of fear that the disease may be contagious, even if that fear is irrational. In another, he said that President Reagan must support an executive privilege claim by former president Richard M. Nixon to keep Nixon’s White House papers secret. […] In addition, department sources say, Cooper has been advising Meese on the U.S. decision to allow arms to be shipped to Iran in connection with efforts to free American hostages. Meese, in turn, has provided assurances to the White House that the shipments were legal.

Perhaps most importantly for this Ethics Village talk, that comment on AIDS is more significant than you might realize. Ronald Reagan claimed executive privilege could block the Centers for Disease Control from issuing a pamphlet on the AIDS crisis despite tens of thousands of Americans dying.

First, let’s set the context of how Reagan handled a threat to Americans that started in 1981. After it already killed nearly twice the number of 9/11 casualties Reagan used his authority to stay silent on the issue:

One of the most prominent stains on the…Reagan administration was its response, or lack of response, to the AIDS crisis as it began to ravage American cities in the early and mid-1980s. President Reagan famously…didn’t himself publicly mention AIDS until [Sept 17th] 1985, when more than 5,000 people, most of them gay men, had already been killed by the disease.

Even in 1985, Roberts (now on the Supreme Court) wrote an infamous memo that recommended the President keep quiet for self-benefit, avoid reassuring people with science, and wait instead for hyperbolic commentators to be proven wrong by scientists.

I would not like to see the President reassuring the public on this point, only to find out he was wrong later. There is much to commend the view that we should assume AIDS can be transmitted through casual or routine contact…

AIDS can not be transmitted through casual or routine contact. It is known today as it was already known then.

After years of intentional silence on the subject by an American President the threat went on to be the greatest public health catastrophe of the twentieth century and kill approximately 650,000, the same as number of Americans estimated killed during the Civil War.

…for the first four years in office, the nation’s top health officer was prevented from addressing the nation’s most urgent health crisis, for reasons he insisted were never fully clear to him but that were no doubt political.

Imagine executive privilege being used to prevent experts from addressing the nation’s most urgent security crisis, then look at this graph of Reagan’s policy of censorship and silence on harms.

So this prompted me to ask Josh about the large and vague theory of executive privilege. Already we can see Josh was wrong about executive privilege being written in the Constitution. Now I wanted to know if he supported its use to block discussion of a bug that can kill hundreds of thousands of Americans.

I stepped up at the end of his presentation and asked 1) where executive privilege was written and 2) whether Ronald Reagan’s interpretation of it would enable the White House to secretly harm Americans with backdoors in encryption, much in the same way he avoided public accountability for export death (illegal arms shipments to Iran) and domestic death (blocking AIDS scientific alerting).

As I asked my question he shook his head disapprovingly. Perhaps my question, like my blog posts, was rambling and lacked clarity.

I was thinking of how to ask about executive privilege in terms of the AIDS epidemic because in computer security terms it would be a virus that easily could be remotely controlled. If the executive privilege theory means the White House can block scientific discussion for political self-benefit, leading to masssive harms of citizens, is the White House cyber policy head also saying secret government backdoors in encryption could be within this privilege?

Josh didn’t answer directly and instead said in a long statement that encryption was complex as a topic, there were many sides, and the market would decide backdoors. He also invited everyone to speak with him after as he could easily show where in the Constitution executive privilege was written (it’s not).

When he finished and got up to leave I walked up to him and he quickly exited towards the back of the room, passing directly by me. Several people said “he must not have seen you” so I rushed out the door and caught him in the hallway. He looked me directly in the eyes, turned and ran away.

If only there had been a break room nearby so I could talk with someone else about it in order to entice him to spy on us and inject himself into our conversation.