GovInfoSecurity.com - Information Security News, Regulations, & Education

Government Information Security Blogs

Cyber 'Czar' Vacancy Persists

July 31, 2009 - Eric Chabrow

Comments (0) Read All Posts (254)

Eric Chabrow
It seems that no one wants to be President Obama's cybersecurity adviser.

Two months after a major presidential address that outlined the job's responsibilities as part of a major administration cybersecurity policy initiative, the cybersecurity coordinator's post remains unfilled. At least 30 people have been interviewed for the post, according to a former high-level executive branch IT official with ties to the White House.

Why would anyone want this job? 

One person apparently out of the running for the job is Melissa Hathaway, the National Security Council senior staffer who conducted the so-called 60-day cybersecurity review that served as the foundation of the administration's cybersecurity policy, the ex-executive branch official said. The former official didn't know why Hathaway is no longer a candidate, but believes the choice wasn't hers. "She's smart as a whip and knows the issues, and knows how to hold things close to the vest," he said.

A White House spokesman late Friday would neither confirm nor deny the number of people the White House has vetted for the job or whether Hathaway remains a candidate, saying the administration does not comment on personnel matters.

The spokesman pointed out that the president will be personally involved in selecting the cybersecurity coordinator, but hasn't done so yet, in part, because he's been focused on other pressing matters.

The names of former White House computer security advisers Howard Schmidt and Paul Kurtz along with Frank Kramer, a one-time assistant defense secretary, have been prominently mentioned for the job.

Among those who told the White House thanks but no thanks, The Washington Post reports: former Republican U.S. Rep. Tom Davis of northern Virginia, Microsoft executive Scott Charney, Symantec Chairman John Thompson and retired Air Force Gen. Harry Raduege Jr., the former Defense Information Systems Agency director and co-chair of the Commission on Cybersecurity for the 44th Presidency, which proposed the White House establish a cybersecurity post that has more influence than the job Obama described.

Indeed, the job Obama described isn't seen as influential enough to attract some of those being courted by the White House. "I do believe there are some issues with the level and role of the position that have some folks in pause mode," said another well-connected former White House official.

Though the president pledged the cybersecurity coordinator would have access to him, he or she would report directly to two masters: Gen. James Jones and Lawrence Summers, national security and economic advisers, respectively. The prospect of having two bosses with strong personalities and who don't necessarily see eye-to-eye on some key issues isn't seen as an attraction of the job, especially to a candidate who wants to help shape and not just coordinate cybersecurity policy. "Why would anyone want this job?" one of the former officials asked.

And, the turf battle wouldn't be just between the National Security Council and National Economic Council, but with the Department of Homeland Security and the National Security Agency that control much of the government's operational IT security within civilian agencies and defense establishment, respectively. "The person in the role will have no authority over the departments and agencies with regard to budget and operations; they will not be able to broadly influence the private sector; there is some 'squabbling' over which agency will have the lead for cybersecurity - NSA, DHS cybersecurity division or Air Force cyber command - and how the president's cyber czar will interact for policy development and direction," another well-tied ex-White House official said.

Thus, the job could be a thankless one. One challenge is how to judge whether the coordinator is successful in the job. The blame likely would be swift against the cybersecurity coordinator should a major assault or breach occur against government or national critical IT infrastructures, even if the adviser has no operational control. If no significant cyber disruption occurs, there's likely to be little credit given to the coordinator several rungs removed from the president.

Another challenge in finding a qualified cybersecurity coordinator could be the pay, which likely would be under $200,000 a year, a pittance when compared with what some of the prospective candidates earn in the private sector. Still, many public servants have forfeited higher pay to work in the government, especially if they are granted real authority.

To many, the cybersecurity coordinator's job is perceived as a glorified traffic cop, an official who brings together key parties to synchronize the government's approach to IT security, but in itself doesn't have the weight to help create policy. Perhaps if the president pledges to give the cybersecurity coordinator real influence in shaping federal cybersecurity policy - as many leading government and IT security experts have suggested - the post wouldn't be so hard to fill.

Also read:


digg del.icio.us reddit
Share
Print Print

Post a Comment

Please login or register to post a comment
Username:  
Password:
Remember Username?