Asked to comment on the hack of the Colonial Pipeline, Kiriakou began with the attribution, and with how quickly it had moved.
Who did it
The government, he said, was saying it was Russian. But the first report he had heard was that it was Indians — Indian hackers — and only afterwards did the account become Russian.[1]
Against the official line he set a private one. He had a friend at the FBI who said the bureau was pretty confident that it was not the Russian government, and that it was probably a handful of guys in their parents’ basements or something similar.[2]
Kiriakou did not treat that as reassuring. This is bad, he said — bad that a couple of hackers could shut down the East Coast’s main pipeline and essentially cut off the supply chain of gasoline to half a dozen states along the seaboard.[2]
Where was NSA
The conclusion he drew was about defence rather than attribution, and it returned to an argument he had been making throughout the same conversation about what the National Security Agency is for.
This comes back, he said, to the notion of what NSA should be doing. Why didn’t NSA protect us from this? They are supposed to be the geniuses in this realm.[2][3]
His answer to his own question was that the agency was busy elsewhere: reading your emails and my emails, listening to our phone calls, and trying to decide who is un-American or less American than the next person. Protecting the country from electronic enemies is exactly what NSA is supposed to be doing, he said, and it dropped the ball.[3]
The underlying objection
The complaint fits a position Kiriakou had stated a few minutes earlier in the same session: that the NSA’s charter prohibits it from collecting on United States persons — citizens and permanent residents — and that collecting on them is now essentially all it does, with the storage capacity to hold what it takes.[4][5]
The pipeline, on this reading, was not an intelligence failure of the usual kind. It was the predictable cost of an agency that had redirected its capability inward, and then found itself without an answer when the thing it was built to stop actually happened.