Acouple of months after getting a bad report card and a few days after one reorganization plan was stripped out of a U.S. House of Representatives security bill, the U.S. cybersecurity chief resigned from his job with one day’s notice. He claimed it was because he had finished his work and hinted that another reason was a desire to spend more time with his family. But the Washington buzz is there is less to the story than that.
Anit Yoran was the third U.S. cybersecurity chief to resign in the past two years, starting with Richard Clarke, who was followed in resignation by Howard Schmidt. Both of Yoran’s predecessors publicly expressed frustration that cybersecurity was getting far less emphasis in the minds of government officials than they felt it should. Reports that Yoran felt the same way have been circulating around Washington for the past few months.
The report of the Department of Homeland Security (DHS) inspector general (see this column) didn’t make Yoran feel all that good. Nor, I expect, did the removal – less than a week before he resigned – of a provision in a House security bill that would have moved the DHS cybersecurity effort to the U.S. Office of Management and Budget, where it might have gotten more resources. In what may be a rewriting of history, no one now admits that there was ever such a provision in spite of a number of believable reports at the time. Another effort, to raise the status of the cybersecurity chief within DHS, is still alive but may be dying.
The current cybersecurity effort is staffed by 60 people and has an annual budget of $70 million or so, but does not seem to be doing much that anyone can see, as the inspector general’s report card pointed out.
It’s hard for me to understand why so little is being done. Various reports put the annual loss caused by cybersecurity problems in the U.S. at tens of billions of dollars. Even in Washington I would think someone would notice numbers of this size. Note that this is a time of relative cyberpeace. I say cyberpeace because there doesn’t seem to be much evidence that we are under a general attack by organized groups. The evidence seems to be that the big problems at this time are the result of cyberpunks trying to outdo each other, or from plain old capitalism where hackers are selling the use of networks of compromised computers to spammers or to people who want to order a denial-of-service attack on someone else. Things could get a lot worse if some anti-U.S. group or government decided to try to trash the U.S. cyberinfrastructure to make a political point.
I’m not quite sure what a good and effective U.S. government-led cybersecurity effort would do, but the way things are going there doesn’t seem too much of a risk of finding out.
Disclaimer: Some of what Harvard does is seen as good, some effective, a little as both and some as none of the above, but this commentary is my own.
