Keith B. Alexander’s NSA / Cyber Command Work Algorithms

1. What system boundary is actually being managed?
2. Which data, people, and permissions must interoperate?
3. What does the commander need to see without drowning in detail?

Convert scattered activities into an enterprise map: owners, data flows, permissions, operating rhythms, and measurable decision outputs.

enterprise architecture map, system-of-systems brief, decision dashboard

Enterprise architecture and command design

Architecture can become empire-building if every problem is solved by collecting or centralizing more.

1. What is the decision that requires fusion?
2. Which feeds are redundant, contradictory, or stale?
3. How will confidence and uncertainty be visible?

Build a fused view that keeps provenance and confidence attached to the answer rather than hiding them behind a clean graphic.

common operating picture, source-confidence legend, fusion brief

All-source synthesis

A polished picture can create false certainty if uncertainty is not shown.

1. What specific foreign-intelligence or combat-support question is unanswered?
2. Which authority and selector rules govern the collection?
3. What answer would change a decision?

Translate broad concern into a narrow requirement, then pair collection, minimization, and analytic production.

SIGINT requirement, priority list, minimization caveat, analytic answer

Requirements writing and SIGINT governance

Scale can invert discipline: the system may start preserving data because it can, not because the requirement justifies it.

1. What friendly system or unit is exposed?
2. Which adversary capability maps to that exposure?
3. What intelligence or defense action reduces risk?

Create a threat-vulnerability crosswalk and assign collection, analytic, and defensive owners.

threat matrix, vulnerability ledger, commander's risk note

Military intelligence and risk mapping

Threat inflation can distort priorities if vulnerability and likelihood are not separated.

1. Which theater decision is time-sensitive?
2. What level of detail can be shared with which unit?
3. What feedback loop corrects bad reporting?

Link national cryptologic capability to theater commanders through tailored reporting, liaison, and feedback.

combat-support note, liaison channel, releasability decision

Joint intelligence support

Support can become dependence if commanders lose local understanding and source skepticism.

1. What is the real time window?
2. What is being assumed because of fear rather than evidence?
3. Which control remains non-negotiable?

Speed up triage and escalation while forcing legal review, confidence marking, and after-action accountability.

urgent threat brief, escalation log, legal-risk annotation

Crisis prioritization

A permanent emergency can normalize extraordinary measures.

1. Which side of the house is primary in this case?
2. Does offensive knowledge improve defense or create a conflict?
3. What boundary keeps defensive trust intact?

Treat SIGINT and cybersecurity as mutually informing but legally and ethically distinct mission lanes.

dual-mission memo, assurance requirement, intelligence boundary note

Mission balancing

The more the same institution collects and defends, the more it must prove boundary discipline.

1. Where might U.S.-person information enter?
2. What targeting and minimization rules apply?
3. Who audits compliance?

Attach legal authority, minimization procedures, and audit trail to collection and querying decisions.

authority memo, targeting/minimization checklist, compliance log

FISA/EO boundary analysis

Public trust collapses when the boundary is described abstractly but experienced as sweeping collection.

1. Why is broad scale required?
2. What narrower alternative was considered?
3. What retention and access limits reduce collateral exposure?

Test scaled data programs against necessity, retention, access, and demonstrable value.

scale-necessity note, retention schedule, access-control map

Data governance

Scale tends to become self-justifying unless value and proportionality are measured.

1. What did the analyst infer?
2. What did the operator observe?
3. What collection should stop, continue, or change?

Create a loop in which analytic errors, operational needs, and collection gaps are updated quickly.

feedback ticket, revised requirement, lessons-learned note

Operational learning

Feedback can become confirmation bias if contrary evidence is not protected.

1. What approval exists?
2. What exactly was done under that approval?
3. What exception or incident must be disclosed?

Build auditable records for authority, queries, access, dissemination, and remediation.

compliance packet, audit trail, incident report

Governance and compliance

Records written only to satisfy insiders will not survive public scrutiny.

1. Who needs secrecy to protect the mission?
2. Who needs visibility to govern the mission?
3. What harms arise from over-compartmentation?

Design compartments with explicit oversight doors and periodic review.

compartment map, read-in justification, oversight-access plan

Security governance

Compartmentation can convert manageable mistakes into institutional surprises.

1. What makes this a military command problem?
2. Where does defense end and offense begin?
3. Which civilian agencies retain lead responsibility?

Frame cyberspace as an operational domain with doctrine, command relationships, and legal boundaries.

domain brief, command proposal, mission boundary map

Institutional strategy

A domain argument can militarize problems better solved by resilience, law enforcement, or industry.

1. What capability does shared leadership unlock?
2. Which missions require separation?
3. How can oversight see both equities?

Use shared leadership to accelerate stand-up while documenting conflicts, separations, and review points.

dual-hat governance memo, deconfliction protocol, review trigger

Command governance

Efficiency can become opacity when one leader embodies both intelligence and military cyber power.

1. Which mission fails if this network fails?
2. Who owns incident command?
3. What defense can be standardized across services?

Define defense of the DoD Information Network as a mission-assurance problem, not only an IT problem.

mission-assurance map, incident command chart, service-component tasking

Defensive cyber command

Defense can be underfunded if offensive cyber receives the prestige and budget signal.

1. What missions require dedicated teams?
2. What training and certification make readiness credible?
3. How are authorities and effects reviewed?

Decompose mission types into teams, readiness metrics, training pipelines, and command relationships.

force-generation plan, readiness dashboard, team taxonomy

Force design

Scaling personnel faster than governance creates capability without sufficient discipline.

1. Who has lead for the victim, adversary, evidence, and response?
2. What must be shared now?
3. Which authority cannot be borrowed?

Create synchronization tables that separate military, intelligence, law-enforcement, homeland-security, and private-sector lanes.

interagency matrix, deconfliction log, escalation note

Interagency coordination

Coordination can conceal responsibility if every actor can point to another lane.

1. What effect is being sought?
2. What legal authority applies?
3. What collateral, escalation, or sovereignty risk exists?

Convert cyber action into an effects, authority, collateral-risk, and escalation-review package.

legal-review packet, collateral-risk memo, authorization record

Operational law and cyber policy

Ambiguous effects can hide strategic escalation inside technical language.

1. What sensor generated the signal?
2. What context makes it meaningful?
3. What action threshold prevents overreaction?

Attach provenance, context, and confidence to indicators before they drive decisions.

indicator bulletin, provenance note, threshold rule

Technical analysis governance

Automated indicator sharing can spread false positives at machine speed.

1. What is automated?
2. Where does a human approve or challenge the result?
3. How are errors traced and corrected?

Use automated sorting with human review, error logs, and retraining/retirement criteria.

triage workflow, exception queue, model/error log

Automation governance

Automation bias can make weak signals appear objective.

1. Which legacy dependency is mission critical?
2. What security control must not be bypassed?
3. What migration stage is reversible?

Stage modernization around mission continuity, identity/access controls, and measurable risk reduction.

migration roadmap, dependency map, security-control checklist

Technical modernization

A modernization program can increase risk if identity, logging, and data ownership lag behind.

1. Who contributes data and under what consent?
2. What can be shared without exposing customers?
3. How is value measured?

Frame collective defense as governed sharing: privacy boundaries, trust model, incentives, and measurable detection value.

collective-defense charter, sharing rulebook, value dashboard

Cybersecurity strategy

Collective defense can become marketing rhetoric if data quality, incentives, and governance are weak.

1. Who can remove data at scale?
2. What anomalies are meaningful without creating surveillance abuse?
3. Where can ethical dissent be safely raised?

Reduce unnecessary privilege, log access, detect anomalies, and create lawful channels for dissent and reporting.

least-privilege map, anomaly report, insider-risk governance plan

Security culture

Insider-risk programs can chill lawful dissent if not bounded and reviewed.

1. What problem is access meant to solve?
2. Would the access mechanism weaken everyone?
3. What alternative investigative tools exist?

Translate encryption debates into threat model, rights, security, and operational tradeoff terms.

access-risk memo, alternatives table, public-interest brief

Cyber policy analysis

A narrowly framed access demand can create broad systemic weakness.

1. What did the public learn that oversight knew differently?
2. Which program claims require declassification or correction?
3. What reform restores trust without destroying capability?

Treat disclosures as a multi-layer failure: insider access, classification, public trust, legal communication, and compliance.

post-disclosure review, trust-repair plan, insider-risk lesson

Crisis accountability

Damage-control rhetoric can deepen mistrust if it avoids substantive critique.

1. What would the strongest rights critique say?
2. What facts would change the proportionality judgment?
3. What safeguard is measurable?

Add privacy, civil-liberties, and public-legitimacy review before and after program approval.

civil-liberties assessment, red-team memo, safeguard scorecard

Privacy and civil-liberties review

A red-team is performative if it cannot alter the program.

1. Which court or committee knows the full operational meaning?
2. What statutory interpretation is load-bearing?
3. What should be public in summary form?

Document authorities, interpretations, compliance incidents, and oversight notifications in a reviewable form.

FISC package, congressional notice, public summary candidate

Oversight law

A technically lawful program may still fail democratic legitimacy if the public cannot understand the rule.

1. What can be declassified without harming current operations?
2. Which claim requires official correction?
3. What recurring transparency report should exist?

Create a declassification and public-explanation sequence: facts, authorities, safeguards, compliance, limits.

declassification plan, transparency report, public Q&A

Strategic communications and transparency

Partial transparency can look manipulative if it omits the central controversy.

1. What can be said without misleading?
2. Which simplification will later be attacked as false?
3. What classified caveat cannot be ignored?

Force public claims through a precision review before senior officials speak.

public-claim review, caveat list, corrected talking points

Public accountability

A technically defensible statement can still be publicly misleading.

1. What behavior changed?
2. Who outside the agency verified it?
3. What metric proves the reform persists?

Turn controversy into audited reforms, published safeguards, and recurring reporting.

trust-repair roadmap, audit report, recurring metric

Institutional reform

Trust language without external verification becomes another trust deficit.

1. What exact customer pain is being solved?
2. What evidence shows buyers will pay?
3. Which government assumptions fail in commercial settings?

Translate national-security credibility into testable product claims, customer evidence, and governance.

market thesis, pilot evidence, product-risk memo

Strategic translation

Prestige can mask weak customer validation.

1. Who pays for shared defense?
2. What network effect is real?
3. What happens if customer density is too low?

Model data-sharing value, revenue assumptions, adoption friction, and trust constraints before scaling.

business-model stress test, adoption-risk model, customer-density metric

Business-model analysis

A strategic idea can be right while the company executing it fails.

1. Which claims are evidence-backed?
2. What metric could falsify the story?
3. Who can say no when prestige is driving momentum?

Stress-test public claims, contracts, revenue assumptions, and governance before market exposure.

claim-evidence ledger, investor-risk memo, governance red flag list

Corporate accountability

The fall from classified prestige to public-market scrutiny can be severe when claims outrun execution.