As reported September 2007, in conjunction with the Department of Homeland Security (DHS), the NSA is planning to expand a murky and problem plagued internet security program Turbulence. Its ostensible purpose is to protect the nation’s electronic infrastructure from attack by terrorists and hackers. However, as an unnamed government official said,"If you’re going to do cybersecurity, you have to spy on Americans to secure Americans."
The program has the hallmarks of a pet project of someone highly placed in the NSA, or the White House. It has an annual budget of $500 million, and both the budget and program were hidden from the Congress for over a year by means of a complicated shell game of creative accounting and splitting up its components (so it would be harder to identify and track not from our enemies but from our Congress). That takes considerable pull. Still the strategy is a simple one, get a program up and running before it can be quashed. Once up, as I have noted before, programs like Turbulence are virtually impossible to kill. In this light, the hookup with DHS is not about inter-agency cooperation but about extending the program’s political constituency and improving its chances for survival.
Turbulence is by its nature highly intrusive and ripe for abuse. Yet from its origins, it has been designed to avoid to the maximum possible any oversight. It is another case of the Bush Administration which has a record of repeatedly abusing the public trust saying, "Trust us," again.
On January 8, 2008, Bush signed National Security Presidential Directive 54/Homeland Security Presidential Directive 23 giving the program an even solider political foundation. It gives the direction of the program to the Director of National Intelligence (DNI). The NSA will do its thing. The DHS will seek to protect government computer systems from attack, and the Pentagon will have responsibility for any counterattacks. Questions of privacy aside, without a unified response team, this is a plan made in bureaucratic hog heaven and will likely be both intrusive and ineffective.