Cybersecurity leadership will not move to White House

Legislation that might have stripped the Homeland Security Department of its responsibilities for securing cyberspace has been quashed, prompting mixed reactions from technology executives and security experts about whether the agency is capable of leading the federal government's efforts to protect the nation's most vital computer networks.

Language in a House bill to reorganize the government's intelligence operations reportedly would have handed off the cybersecurity mission to a new post within the Office of Management and Budget. The proposed Office of Critical Infrastructure Information Protection would be headed by an administrator charged with analyzing threats by electronic attackers, warning about possible attacks and reducing the number of vulnerabilities in the government's most critical networks. Presumably, the administrator would also work with industry to reduce vulnerabilities in privately run networks, which help control the vital infrastructures , such as electric grids and dams, that officials fear are prominent targets for terrorism.

The Associated Press obtained drafts of the security proposals, authored by Rep. Tom Davis, R-Va., chairman of the House Government Reform Committee. The committee has broad oversight of information security issues in the government.

The AP reported Friday that a new proposal would still give OMB responsibilities for coordinating U.S. policies on improving cybersecurity.

Those duties currently fall to the National Cyber Security Division of Homeland Security. But some security experts have said the division's head, Amit Yoran, is too low in the department's pecking order to compel federal agencies to change their security policies, much less to make corporations alter theirs.

"How would [the department] change the level of [security] vulnerabilities within the Energy Department, for example?" asked Alan Paller, the director of research at the SANS Institute, a security research group. Paller said Yoran and his team have had little luck changing the security management within Homeland Security: "Put that leadership deep in one department, and tell me how it's going to change what other departments do."

Moving the security chief position to OMB would have given it the clout of the White House, and because OMB controls agencies' budgets, it would have provided a new form of leverage, Paller noted. The White House used to house the security coordinator post. Ex-counterterrorism chief, Richard Clarke, headed the President's Critical Infrastructure Protection Board, and raised the profile of cyber security by warning agencies about the danger hackers posed to the government and the nation's networks.

"The single greatest error made in U.S. cybersecurity policy was the dissolution of the president's board, Paller said. "When that responsibility was at the White House level, agencies throughout government focused-not perfectly, but with some energy at least-on working together to solve the problems."

Moving the job to Homeland Security, Paller said, made it "a target for making money" for security vendors. Companies have had largely unfettered access to Yoran and his team, with whom they've worked for months forging public-private partnerships and various working groups. That openness was prompted in part by security companies' complaints, when the security function was in the White House, that agencies were unresponsive to vendors who said they had solutions for the government's problems, according to Paller.

It was unclear what role technology companies played in getting the new language pulled out of the intelligence bill, but executives and associations that represent the technology industry had complained in recent days that moving the function to the White House would have thrown bureaucratic obstacles in their path.

Greg Garcia, a vice president with the Information Technology Association of America, said lawmakers never intended to scrap the work companies have already done with Homeland Security. Moving the security position to OMB "would be duplicative…and that would complicate our efforts," Garcia said. He added that Davis' staffers assured ITAA that the law's intent wasn't to make industry's job more difficult.

Changes to cybersecurity policy still may come, however. A bill pending in the House would elevate the position Yoran holds to the level of assistant secretary. Giving the security director more stature could draw more attention to his mission. But Paller cautioned that agencies already have so many other pressing concerns before them that it takes an official with deep experience and respect throughout the government, placed in an oversight position, to significantly influence how agencies respond to government entreaties to tighten up their networks.