NSA takes rare steps to support telework, remote work

The National Security Agency is sifting through its less-sensitive mission sets to see what it could possibly move into an unclassified cloud environment appropriate for telework — something the agency “rarely did prior to COVID-19,” CIO Greg Smithberger said.

“It’s the NSA culture, since the vast majority of our work is highly classified, you know, by default, we operate on our top-secret network,” Smithberger said this week on an INSA webinar. “That’s sort of where we’re most at home. And we hadn’t always thought about whether there were pieces of that that really could be done at a less-classified level because there didn’t seem to be much of a barrier to entry when we were all going to be going to our offices and, you know, working on a high-side network and our corporate partners were all going to be working on a top-secret network with us.”

Top secret work will probably never be fit for telework, Smithberger said, but, forced by the pandemic, the NSA is finding more work can be done via telework.

“It’s kind of become more of a standard for us to see how much we can actually do in a less protected environment to leverage our ability to work with some corporate partners who, in some cases, simply don’t have access to a SCIF but are fully cleared people,” he said. “In other cases, we’re building a sort of a variation on this environment, where we’re going to be doing a lot more collaboration with people who don’t have clearances for the capabilities mission, for NSA’s cybersecurity mission, for our research.”

Really, the roots in this move started long before COVID-19. About four years ago, the NSA began developing what Smithberger calls “a very protected low side development environment” in the intelligence community’s Commercial Cloud Services, supported by Amazon Web Services.

“We wrapped lots of security around it,” he said. “And we built a model of NSA’s high-side mission environment that sort of fakes the classified pieces and started doing development in this environment with our corporate partners. So we’ve actually been doing this for about three or four years. The revelation about five months ago was we’d actually designed this so well, that there was no additional risk allowing people to work from home in this environment.”

There’s also the option to work with classified information through remote work, which the NSA does not treat as one-and-the-same as telework. Smithberger said NSA has “lots of ability to work remotely with people within our classified networks” at sensitive compartmented information facilities (SCIFs) and other cleared facilities.

However, that requires having access to that secured network. For instance, contractors or NSA personnel working on the agency’s GovCloud would require such a direct network connection and couldn’t be done by telework.

“It only lives in the top-secret environment… It is top secret and only top secret,” Smithberger said. “So there will never be telework from home into the IC GovCloud.” But, there are “classified facilities around the intelligence community, frankly, around the world,” he said, that feed into GovCloud through top-secret networks.

And even in the cases where NSA personnel are still required to commute to an office, they’re still working in a virtual manner, which Smithberger is shifting NSA away from its “culture of face-to-face meetings.”

“Although there’s a limit to how many of our people can, you know, work from home and telework, all of our meetings within NSA facilities are now virtual,” he said. “So I get in the car and I commute to work, I put my mask on to walk through the hallways, I go to my office, and I sit through virtual meetings all day long. And I put my mask back on and go back to my car and drive home.”

Smithberger added: “We’ve learned that we can be a lot more effective and efficient, you know, operating virtually even in our classified environment. And then the unclassified things and the telework that opens up.”

To that end, the agency is also working with Microsoft to onboard Office 365 at all classification levels. NSA is sponsoring Office 365’s top-secret authorization, something Smithberger hopes to achieve in the next year.

It’s NSA’s intent that this is all here to stay, the CIO said. “Everything that we’re doing right now is in the nature of permanent change…If we stand it up, we intend to use it and use it on an ongoing basis.”

“I think for NSA and the way we interact with our industry partners, [it’s a] permanent change, a lot more remote, a lot more virtual,” Smithberger said. “You just need to keep track of what needs to say classified and what doesn’t.”