MY DATA Act of 2025

— 225 — Intelligence Community Cover in the Digital Age. Even in the public domain, it is becoming increas- ingly clear that protecting the identities of undercover intelligence officers is difficult in the digital age.41 The truth is that as our daily activities are conducted predominantly in the digital domain, our antiquated system for providing cover to undercover officers has lagged woefully behind the threat from foreign adversaries. The DIA, CIA, and FBI are increasingly aware of this threat and are devoting resources to the problem. Their back-office infrastructure, however, is such that they are still using methods for providing cover from decades past that put valuable intelligence officers at unnecessary risk. How intelligence officers and their fami- lies are taught to use smartphones and social media, travel, conduct banking, and take and share pictures—even how and when they are paid—can make it difficult to protect identities.42 Legends, fake backstories, and identities are often weak, incomplete, and unable to stand up to a basic Google search.43 Officers operat- ing under nonofficial cover are offered even less protection and training to help them succeed. In addition, ubiquitous technical surveillance (UTS) techniques being refined by technologies emanating from the regimes in China and Russia will continue to be highly challenging for intelligence officers. An incoming Administration will need to double down on resourcing and training so that members of the IC will have the expertise they need to operate clandestinely (and successfully) against hard targets. Privacy Shield. For many years, the European Union (EU) has tried to force U.S. companies operating in Europe to follow its data privacy regulations. Misleading claims in the 2013 Snowden leaks destroyed the initial Safe Harbor Framework44 that allowed American companies to transfer data across the Atlantic; its succes- sor, the Privacy Shield Framework,45 was struck down by European courts on the grounds that it provides insufficient protections for EU citizens against hypothet- ical U.S. government surveillance. Those same European courts exempted the intelligence services of EU member states from the standards applied to the U.S., suggesting that trade protectionism may be the real motive behind data privacy regulations. In 2022, the Biden Administration negotiated a new agreement, the Trans-At- lantic Data Privacy Framework,46 intended to withstand European legal challenges. Given the fate of its predecessors, it is not certain that it will survive. Executive Order 14086, “Enhancing Safeguards for United States Signals Intelligence Activi- ties,”47 implements this new framework by attempting to align signals intelligence collection practices with European privacy regulations. At most, the executive order’s changes will be helpful support for the framework in future European litigation; at worst, they could throw sand in the gears of important intelli- gence programs. An incoming conservative President should reset Europe’s expectations. Brus- sels has always arbitraged the difference between being a military ally against, for — 226 — Mandate for Leadership: The Conservative Promise example, Russia and conducting a full-blown trade conflict with the United States. Restrictions on data exports have been part of the trade conflict, but now they could seriously harm our military and intelligence capabilities. Moreover, restrictions on U.S. intelligence collection hurt the Europeans themselves, especially as the United States shares unprecedented amounts of intelligence on Russia’s invasion of Ukraine with Europeans.48 Europe is telling the United States to meet intelligence oversight standards that no European country meets. At the same time, exports of data to China are unexamined and (so far) free from legal challenges. That violates World Trade Organization agreements as an arbitrary and discriminatory data protection stan- dard. It is a betrayal by a nominally allied jurisdiction. European court rulings that struck down prior data privacy frameworks were grounded not in constitutional law but in a treaty among European nations. If the EU accepted an international agreement that data may flow to the United States under a more reasonable stan- dard than the one adopted by the court, that interpretation would be binding, at least as a gloss on the earlier treaty. The United States has never seriously pushed back against the EU; now is the time. An incoming President should ask for an immediate study of the implemen- tation of Executive Order 14086 and suspend any provisions that unduly burden intelligence collection. At the same time, in negotiations with the Europeans, the United States should make clear that the continued sharing of intelligence with EU member states depends on successful resolution of this issue within the first two years of a President’s term. It is time for a real solution, not the 30 years of stopgaps imposed by Brussels. President’s Daily Brief (PDB). An incoming conservative President should make clear what the President’s Daily Brief is and is not. The PDB should be for the President specifically, with a much narrower distribution and addressing areas of strategic concern. During the transition, the future National Security Advisor, along with the DNI, should conduct a review of current PDB recipients and deter- mine which should remain recipients when the President’s term begins. Instead of being used as the statement of record for the agencies, the PDB often misses the areas of interest for Presidents and their senior advisers. The President should want the PDB to focus on providing the information needed for the often imperfect and complex decisions that a President needs to make, which should always be based on the best intelligence that can be gathered. Where consensus and agreement are possible, an IC-coordinated product is excellent, but insights provided by properly channeled dissent can lead a President to ask relevant ques- tions of his DNI and IC. A future DNI determines the PDB briefer based on recommendations made by the Deputy Director of National Intelligence for Mission Integration (MI). His- torically, briefers have come from the CIA, but a future President and DNI should

— 224 — Mandate for Leadership: The Conservative Promise l Enhanced metrics for accuracy of classification. l A general simplification of the overall system for the benefit of users. On the back end, an ODNI-run declassification process that is faster, nimbler, default-to-automated, and larger-scale should be a priority. Additionally, investments in IT are required to deal with the growing volumes of CNSI collected and produced in the digital age, along with many years’ worth of existing analog and digital holdings that could provide valuable historical insights. An incoming Administration needs to explore options to prioritize funding for innovation in declassification management: for example, by establishing a budget line item specifically for the modernization of declassification or designating fund- ing for program classification management as a special-interest item. The Administration will also need to transition to using technology, including tools and services for managing Big Data (which provide a robust electronic record repository, making information within and across agencies easier to organize and locate and facilitating more rapid review and release capabilities for records of emerging interest); artificial intelligence/machine learning (which, when incor- porated into existing business practices, enables machine interpretation of unstructured text and data, applies decision support technology to enable more consistent classification decisions, and expedites reviews between agencies); and expansion of Commercial Cloud services (which facilitate the rapid testing and deployment of new tools and technologies). However, technology is not a panacea; human expertise in information holdings and routine validation of the technology will always be necessary. With or with- out machine assistance, agencies will require more people and more varied skill sets to improve their ability to meet the electronic records era’s classification and declassification demands and serve an incoming Administration’s goals. Broader U.S. Government and IC Intelligence Needs. Increasingly, con- flicts among U.S. adversaries such as China, Russia, Iran, and North Korea are conducted in the realms of technology and finance.40 This challenge requires new tools, authorities, and technological expertise across the U.S. government, par- ticularly at the Commerce Department’s Bureau of Industry and Security (BIS) and the Committee on Foreign Investment in the United States (CFIUS), which is housed at the Treasury Department. An incoming conservative President should task his DNI and Secretary of Commerce with increasing coordination, the resources needed for BIS and SCIF capacity, and proper and necessary intelligence sharing to counter the activities of multifaceted adversaries such as China. This would include additional work with private-sector expertise, granting clearances to niche sector experts and United States citizen commercial and financial partners as needed. — 225 — Intelligence Community Cover in the Digital Age. Even in the public domain, it is becoming increas- ingly clear that protecting the identities of undercover intelligence officers is difficult in the digital age.41 The truth is that as our daily activities are conducted predominantly in the digital domain, our antiquated system for providing cover to undercover officers has lagged woefully behind the threat from foreign adversaries. The DIA, CIA, and FBI are increasingly aware of this threat and are devoting resources to the problem. Their back-office infrastructure, however, is such that they are still using methods for providing cover from decades past that put valuable intelligence officers at unnecessary risk. How intelligence officers and their fami- lies are taught to use smartphones and social media, travel, conduct banking, and take and share pictures—even how and when they are paid—can make it difficult to protect identities.42 Legends, fake backstories, and identities are often weak, incomplete, and unable to stand up to a basic Google search.43 Officers operat- ing under nonofficial cover are offered even less protection and training to help them succeed. In addition, ubiquitous technical surveillance (UTS) techniques being refined by technologies emanating from the regimes in China and Russia will continue to be highly challenging for intelligence officers. An incoming Administration will need to double down on resourcing and training so that members of the IC will have the expertise they need to operate clandestinely (and successfully) against hard targets. Privacy Shield. For many years, the European Union (EU) has tried to force U.S. companies operating in Europe to follow its data privacy regulations. Misleading claims in the 2013 Snowden leaks destroyed the initial Safe Harbor Framework44 that allowed American companies to transfer data across the Atlantic; its succes- sor, the Privacy Shield Framework,45 was struck down by European courts on the grounds that it provides insufficient protections for EU citizens against hypothet- ical U.S. government surveillance. Those same European courts exempted the intelligence services of EU member states from the standards applied to the U.S., suggesting that trade protectionism may be the real motive behind data privacy regulations. In 2022, the Biden Administration negotiated a new agreement, the Trans-At- lantic Data Privacy Framework,46 intended to withstand European legal challenges. Given the fate of its predecessors, it is not certain that it will survive. Executive Order 14086, “Enhancing Safeguards for United States Signals Intelligence Activi- ties,”47 implements this new framework by attempting to align signals intelligence collection practices with European privacy regulations. At most, the executive order’s changes will be helpful support for the framework in future European litigation; at worst, they could throw sand in the gears of important intelli- gence programs. An incoming conservative President should reset Europe’s expectations. Brus- sels has always arbitraged the difference between being a military ally against, for

— 222 — Mandate for Leadership: The Conservative Promise forward-leaning in sharing cyber threat intelligence with private-sector partners and the public, emphasizing that the protective nature of such information is of value only if put into the right hands at the right time. Since critical infrastructure and services are overwhelmingly owned, managed, and defended by the private sector in the United States, there has been an increasing emphasis on declassify- ing intelligence and sharing actionable information with private-sector partners, often through industry-specific Information Sharing and Analysis Centers (ISACs); regional meetings of government and private-sector experts called InfraGard, run by the FBI; direct public notification from the Department of Homeland Security, the FBI, and (increasingly) the NSA; and more discreet one-on-one engagements led by the collecting agencies. These programs properly recognize the private sector’s role in providing cyber- security for Americans; in practice, however, the intelligence shared by the U.S. government through these venues is too often already known or no longer relevant by the time it makes its way through the downgrade process for sharing. In addition, government-shared information often needs to take advantage of the opportunity to provide contexts, such as attribution, trends, and size of the observed cyber problem. As warranted, additional context should be provided to the private sector as a matter of routine. To continue improving the U.S. government’s ability to defend the country’s most vital networks, the IC must adopt an “obligation to share” policy process, including the capacity for “write to release” intelligence products whereby newly discovered technical indicators, targeting, and other intelligence relevant to cyber defense are automatically provided either to the public or to targeted entities within 48 hours of their collection—which is how counterterrorism intel- ligence has been managed for years when it comes to a “duty to warn.” Under this policy, agency heads should still have the flexibility to withhold intelligence for operational or counterintelligence reasons but would need to report regularly to Congress on the number of and justification for exceptions. This policy would make sharing intelligence and defending networks the default, as it already is in the rest of the cybersecurity community outside the IC, to improve the quantity, relevance, and timeliness of defensive information while ensuring accountability for top leaders when they must withhold this information. One of the most significant challenges within the IC is presented by the need to share information promptly among the 18 elements of the intelligence enterprise. The only long-term solution to the understandable tension between the need to share information and the need to protect intelligence sources and methods is a robust real-time auditing capability that electronically flags unauthorized access. Under an identity management system with real-time audit, even the most sensi- tive information acquired by America’s intelligence agencies can be shared, and the access to and use of that information are appropriately monitored. Establishing — 223 — Intelligence Community a real-time auditing capability is essential to decreasing the risk for the heads of intelligence agencies in meeting their statutory requirements to ensure that they protect sources and methods associated with the classified information their agen- cies collect. Overclassification. There is broad consensus across the U.S. government and among stakeholders that the system for classifying, declassifying, and otherwise marking and handling sensitive information is at a crossroads. Exorbitant amounts of classified data are created daily, and agency personnel often mistakenly choose classification as the default selection to ensure national security. At the same time, the effectiveness of downgraded and carefully declassified information to support foreign policy efforts has been borne out in, for example, alerting the broader world of Russia’s buildup and likely plans for its invasion of Ukraine. Two executive orders principally govern how the U.S. government handles clas- sified and sensitive information. l Executive Order 13526, “Classified National Security Information,” issued in 2009,38 prescribes the classification levels and procedures for declassification. l Executive Order 13556, “Controlled Unclassified Information,” issued in 2010,39 aimed to establish a uniform program for managing all unclassified information that requires safeguarding or dissemination controls. The current system for declassifying classified national security information (CNSI) is extraordinarily analog, requiring experts’ review of individual records. Declassification policies are based on human review of paper and need to con- template and handle the proliferation and volume of digital records created by agencies. The U.S. government will soon reach the point at which manual review is impossible. The declassification of CNSI should support key U.S. national security objectives, reflect mission priorities, and not serve solely as a necessary procedural function. Reforms should include: l Tighter definitions and greater specificity for categories of information requiring protection. l More stringent policies to effect significant reductions in the number of Original Classification Authorities (OCAs). l Stricter accountability measures at the OCA level and more detailed security classification guides.