Reports & Papers

2023 marked eighty years since the wartime adoption of the BRUSA Agreement between Great Britain and the United States. This 1943 document codified the growing relationship between U.S. and U.K. signals intelligence organizations and included policies governing the exchange of personnel and joint regulations for handling sensitive material. Security directives and protocols aligned operational processes between the democratic governments, setting new cooperative standards for nation-states battling authoritarian regimes.

This paper provides a framework for a program to advance IC ethics professionalization, to better serve the national interest, avoid ethical lapses or moral pitfalls, and strengthen US national security and the Intelligence Community against the risk of politicization. The program would serve as catalyst for national security intelligence officials to better perceive, reflect on, make judgments about, and potentially act on ethical lapses in the midst, in adjacent units, or higher in the chain of command. The program would provide a means for officials to deliberate on real or hypothetical ethical dilemmas, both as individuals or in groups.

Establishing norms for state behavior in cyberspace is critical to building a more stable, secure, and safe cyberspace. Norms are defined as “a collective expectation for the proper behavior of actors with a given identity,” and declare what behavior is considered appropriate and when lines have been crossed. Cyberspace is in dire need of such collective expectations. However, despite efforts by the international community and individual states to set boundaries and craft agreements, clear and established cyber norms for state behavior remain elusive. As early as 2005, the UN Group of Governmental Experts (GGE) and UN Open-Ended Working Group (OEWG) both aimed to create shared “rules of the road,” but fundamental disagreements between states and a lack of accountability and enforcement mechanisms have prevented these initiatives from substantively implementing cyber norms. As a result, the international community and individual states are left with no accountability mechanisms or safeguards to protect civilians and critical infrastructure from bad actors in cyberspace.

France and the United States are the two Western countries with the highest sovereign interests in the Indo-Pacific region. Ensuring sovereign integrity and the security of their citizens are the first strategic priority of both nations. Furthermore, as longtime allies, Washington and Paris share mutually supporting interests that align their geopolitical security within the diplomatic, economic, and military spheres. Traditionally thought of as national interests, many now transcend borders to reflect inclusive interests of both Washington and Paris versus the exclusivity of a single nation-state. There is an increasingly common strategic vision that can bolster regional security by developing physical and digital connectivity to ensure a free, safe, and open Indo-Pacific. Shared strategic vision requires apt diagnosis of the state of play before consideration of potential policy prescriptions that might strengthen a unified approach to the Indo-Pacific. This report identifies the best approaches for the US, France, and the EU to support their Indo-Pacific allies within a framework of collaboration, coordination, and consultation, underpinned by common values.

The Intelligence and Applied History Projects hosted a National Security Act Essay Contest in 2022 entitled: “Imagining a New National Security Act for the 21st Century.” The contest sought to generate new ideas for improving the intelligence and national security community in the US based on the dynamic security environment we face in the 21st century. The essay prompt offered a variety of hypothetical scenarios where intelligence failure contributed to catastrophic failure and posed the question: what you would change now to improve the intelligence and national security posture of the US?

The winning essays, from a field of approximately 75 applicants, were authored by (1) Russell Travers, (2) Sophie Faaborg-Andersen, and (3) Marie Couture and Laurie LaPorte. The authors' winning essays appear in this report.

In the past, strategic surprise has often stemmed from a failure of imagination. Most intelligence failures are rooted in a lack of foresight or early warning of impending events. Blue sky thinking seeks to prevent these surprises by devoting more attention not just to known risks and likely scenarios, but also to low probability, high impact events. In an unprecedented step in forging ongoing global collaboration, 129 global experts gathered in Amman, Jordan, in December 2021. The conference was held under the auspices of Jordan’s Aqaba Process and facilitated by representatives from the Harvard Kennedy School Belfer Center’s Intelligence Project. Attendees included intelligence officers, diplomats, military officers, private sector practitioners, and academics representing 29 countries, 5 continents, and 68 government and private sector organizations. Through presentations and discussion under Chatham House Rules, the conference facilitated an open exchange of ideas on the possible next big threats from terrorism and on strategies for moving forward.

In more than seven decades of study after study, the U.S. Intelligence Community (IC) has identified a lack of diversity in the workforce as a problem. Beginning with a 1953 Central Intelligence Agency (CIA) report on women in the agency, tellingly titled “The Petticoat Panel,” organizations have documented a lack of presence and opportunity for women, minorities, and other groups including people with disabilities. Recommendations and actions were repeated over the years with marginal results. This paper reviews efforts of what has been done, what has succeeded, and what has failed as an important starting point for building a robust intelligence workforce for the latter half of the twenty-first century. It then offers recommendations for overcoming systemic challenges and fostering culture change to improve diversity across the community.

Contemplating the causes and effects of 9/11, as well as the experiences of those on the ground that day, yields useful insights into tackling today’s intelligence and policy challenges. This report is derived from 9/11: Intelligence and National Security Twenty Years Later, a full-day conference hosted by the Belfer Center’s Intelligence Project that examined the impact of the 9/11 through personal stories and policy reflections. It explores how strategic intelligence on Al Qaeda’s intentions failed to lead to policy changes that could have prevented the attacks on 9/11. It also examines how the U.S. can draw on the experience of 9/11 as it faces the specter of great power competition with China against the backdrop of globalized, existential threats posed by climate change and novel disease outbreaks like COVID-19. It also explores the critical nexus between intelligence warning and policy action. More broadly, the twentieth anniversary of 9/11 is an opportunity to reflect on who we are as a nation and who we want to be in confronting violent extremism—both at home and around the world.

The implications of the Schrems II decision have substantial short and long-term repercussions. This paper will seek to briefly explain the history of the Schrems cases, then outline the options available to decision makers seeking to enable transatlantic cooperation. The paper will also argue that short-term solutions such as the ones leveraged up till now will increasingly be unfeasible, and therefore present four proposals for consideration on how a revived data transfer ecosystem could be shaped through national and international tools and mechanisms.

The overarching question imparting urgency to this exploration is: Can U.S.-Russian contention in cyberspace cause the two nuclear superpowers to stumble into war? In considering this question we were constantly reminded of recent comments by a prominent U.S. arms control expert: At least as dangerous as the risk of an actual cyberattack, he observed, is cyber operations’ “blurring of the line between peace and war.” Or, as Nye wrote, “in the cyber realm, the difference between a weapon and a non-weapon may come down to a single line of code, or simply the intent of a computer program’s user.”