Here’s what John Bolton had to say about cybersecurity policy in his new book

In his new book, former national security adviser John Bolton says that squabbling amongst Trump administration officials hobbled the White House’s efforts to issue new policies that shaped the U.S. government’s offensive and defense cyber-operations.

The book, “The Room Where It Happened: A White House Memoir,” which CyberScoop obtained, provides an insider’s view of the U.S. government’s largely secretive approach to revamping cyber policy in the last two years. Aside from cyber-operations, Bolton paints President Donald Trump as preoccupied and angered by cybersecurity-related issues, as well as all too willing to use hacking to prop up his political goals in negotiations with China and Ukraine.

“We needed to do two things: first, we needed a Trump Administration cyber strategy, and second, we needed to scrap the Obama-era [offensive cyber-operations] rules and replace them with a more agile, expeditious decision-making structure,” Bolton writes of his time negotiating new policies with national security and intelligence officials in 2018. “Unfortunately, bureaucratic inertia, turf fights, and some genuine unresolved issues paralyzed the Trump Administration, month after month.”

Bolton writes that the Obama administration’s approach to fending off hacking from China, Russia, Iran, and North Korea had been criticized for not being aggressive enough. In order to better deter them, the Trump administration had set its sights on giving U.S. military hackers more leeway to hit back.

And although the Trump White House eventually issued its national cyber strategy in September of 2018, which Bolton says involved “considerable hard slogging,” developing new policies to govern offensive cyber-operations for the U.S. military was “even harder,” Bolton says.

“The interagency process was frozen solid. The Department of Homeland Security and others wanted to keep a stranglehold on the Defense Department, as did the intelligence community,” Bolton writes. “The Pentagon didn’t want oversight from anyone, including the White House, and took an ‘all or nothing’ approach in negotiations that only infuriated everyone else involved.”

The result of this change was the elimination of PPD-20, which guided the approval process for government-backed cyberattacks from 2012 to August 2018. Its replacement, National Security Presidential Memorandum 13, (NSPM-13) has been described by White House officials as “far more streamlined” than its predecessor.

The book’s release, which is slated for Tuesday, has triggered a series of legal confrontations for Bolton, including the Trump administration’s effort to block the book’s publication. According to top national security officials, including Director of National Intelligence John Ratcliffe and the National Security Agency Director Gen. Paul Nakasone, the book contains classified information. A judge has since denied the request to delay the book’s release.

Turf wars

Bolton, who eliminated the cybersecurity coordinator role at the White House as soon as he took office, portrays himself as playing a central role in pushing updates to the U.S. government’s cyber policies, while portraying other officials as impediments to progress.

Bolton takes aim at then-Secretary of Defense James Mattis for how he allegedly acted during meetings about NSPM-13. During one particular meeting on Aug. 7, 2018, Gen. Mattis had objections to the draft, but declined to share them, Bolton said.

“In the Administration’s first year-plus, I had been told, the common pattern was that Mattis would hold forth, [then-Secretary of State Rex] Tillerson would agree, everyone else would fold without significant comment, thereby ending the meeting,” Bolton writes. “That may have worked earlier, but I wasn’t having it. I ended the meeting saying we had broad consensus on the way ahead (even if Mattis didn’t agree), and I hoped we could move rapidly to finalize the draft decision memorandum.”

In his narration of the NSPM-13 negotiations, Bolton claims some in the intelligence community were not fully supportive of the memorandum, which to this day remains classified.

According to Bolton’s recollection, some hesitations about NSPM-13 had emerged amongst elements in the intelligence community, namely at the CIA that were “jealous of the National Security Agency’s authority,” Mattis said. “This reflected a long-standing, almost existential, CIA-Pentagon tension,” Bolton writes.

“Nonetheless, I told Trump we were making progress. After internal White House bureaucratic delays too tedious and inexplicable to recount, on August 15, Trump signed our directive,” Bolton writes.

Mattis, who now works at the Hoover Institution, did not immediately return requests for comment.

Cybersecurity shoved aside

In the book, Bolton writes he was concerned on a number of occasions, about Trump’s understanding of the role of cybersecurity issues in geopolitics. Amid trade talks with China in 2018, for instance, Bolton became concerned that Trump would ignore perceived cybersecurity threats from Chinese-based telecommunications firm Huawei in any possible trade deals with Chinese President Xi Jinping.

“Trump made matters worse on several occasions by implying that Huawei also could be simply another U.S. bargaining chip in the trade negotiations, ignoring both the significance of the criminal case and also the far larger threat Huawei posed to the security of fifth-generation (or 5G) telecom systems worldwide,” Bolton writes. ”The idea that this was merely trade bait both discouraged and confused our friends.”

Intelligence officials have warned that Chinese firms such as Huawei may be complicit in Beijing-backed espionage efforts that compromise U.S. communications. Huawei denies the allegations.

“Trump himself continued to be part of the problem, asking [U.S. Trade Representative Robert] Lighthizer, at one point in April, whether we should say something in the trade deal about cyberwarfare,” Bolton writes. “This idea bordered on the irrational, or worse … where else might it be toddling along, leading to incalculable mischief if it reemerges in the next Xi-Trump meeting?”

Trump has long thrown cybersecurity-related issues under the bus while speaking with autocrats and dictators, a tactic which Bolton indicates has been cause for concern. Particularly, Trump’s “weak responses to Russian provocations” have made Bolton’s work to counter Russia more difficult, Bolton says.

“Trump repeatedly objected to criticizing Russia and pressed us not to be so critical of Russia publicly,” Bolton writes. “Trump’s inconsistent views and decisions on Russia made all our work complicated, and cyber and noncyber issues often bled into each other.”

Impeachment intrigue

At times, Trump has become so preoccupied by Russian hacking-related issues, he has become irate, according to Bolton. In the months building up to Trump’s fated July 2019 phone call during which Trump requested Ukraine’s president’s help investigating Russia’s Democratic National Committee hack, Trump exploded at then-Energy Secretary Rick Perry about the same issue.

“I want the f—–g DNC server,” Trump said, according to Bolton’s recollection.

The president has long erroneously thought that in the wake of the DNC hack, which U.S.-based cybersecurity firm CrowdStrike has attributed to Russian government hackers, a DNC server wound up in Ukraine.

That July 2019 phone call ultimately became central to the Democratic-controlled House of Representatives’ impeachment of Trump last year.

Bolton’s book touches on a number of incidents, as retold by Bolton, that he says should have been examined by the House of Representatives in its impeachment inquiry. Bolton refused to testify in the inquiry last year.