Perspective: An open letter to the incoming cyberczar

Editors' note: On May 18, the House of Representatives approved a reorganization of the Department of Homeland Security that would create an assistant secretary for cybersecurity. The Senate is expected to follow suit soon, and the post is likely to be filled by summer's end.

September 1, 2005

Dear Assistant Secretary,

By now the congratulatory speeches and handshakes from President Bush are over and you've got to get to work. Let me congratulate you on your new job and offer some advice.

Your first task should be to solve the department's own problems. I'm sure you remember that report from May 26, which concluded that Homeland Security had fulfilled precisely zero of its 13 key cybersecurity responsibilities--a damning indictment of an agency that's supposed to be the brains of the federal government in this area.

In that report, the Government Accountability Office concluded that the department "cannot effectively function as the cybersecurity focal point intended by law and national policy" at the moment, and even warned that it may be "unprepared to effectively address cyber emergencies."

I know that lackluster performance in the past wasn't your fault. And it may have been inevitable; when the department was created nearly three years ago, it was bequeathed a clutch of unrelated computer security centers from the FBI, the Defense Department, the Commerce Department and the Energy Department.

Remember, you've been appointed as a servant of the American people--not their master--and a little modesty goes a long way.

Even now, persuading those people to cooperate and smoothing ruffled bureaucratic feathers can't be an easy task. Good luck with that--you'll need it.

Just as important is your relationship with the private sector: the technologists, network administrators and executives who are the ones busy expanding the Internet and finding better ways to secure it.

You may wish to consider the performance of Richard Clarke, one of your predecessors, as an example not to follow.

Clarke made a habit of showing up at security conferences and lecturing the attendees on topics that they usually knew more about than he did.

In one memorable appearance at the 2002 RSA Conference, Clarke proclaimed: "If you spend more on coffee than on IT security, then you will be hacked. What's more, you deserve to be hacked."

Those kind of statements may have endeared Clarke to the media, but they weren't exactly a way to establish lasting relationships with technology companies. No wonder he left his White House post in a huff.

You might want to demonstrate a bit less hubris. Remember, you've been appointed as a servant of the American people--not their

Biography
Declan McCullagh is CNET News.com's chief political correspondent. He spent more than a decade in Washington, D.C., chronicling the busy intersection between technology and politics. Previously, he was the Washington bureau chief for Wired News, and a reporter for Time.com, Time magazine and HotWired. McCullagh has taught journalism at American University and been an adjunct professor at Case Western University.

More Perspectives

You guys are the last ones to be giving advice

Cnet, seriously, you guys are the last ones on earth to be giving
someone advice. You know that story about people in glass houses
not throwing stones>?? I can't tell you the nubmer of times you
guys have commited sins against the journalistic standard.

Please you guys are pathetic. So why am i here in the first place?
Well I totally overlooked your link in my RSS feed. My bad. I'm
going to fix that right now, because god knows you dont belong in
the NEWS section.

Here Here

You would think that Declan McCullagh would have done
research before writing a letter to the new Asst. Sec. (who is
nothing close to final). For example, the position has never
been termed "cyberczar" officially it is simply one of those the
media created and others less affiliated with the activity have
kept.

First time I've seen his name associated with anything cyber
security related. Oh well, I guess everyone can make a few
mistakes the first couple time. Welcome to the community
McCullagh, you will catch on in time.

There is a good point in the letter, however, the lack of response
to any of the strategy recommendations from 2003. Not much
to show for and a lot of catching up to do.

.

You guys are the last ones to be giving advice

Cnet, seriously, you guys are the last ones on earth to be giving
someone advice. You know that story about people in glass houses
not throwing stones>?? I can't tell you the nubmer of times you
guys have commited sins against the journalistic standard.

Please you guys are pathetic. So why am i here in the first place?
Well I totally overlooked your link in my RSS feed. My bad. I'm
going to fix that right now, because god knows you dont belong in
the NEWS section.

Here Here

You would think that Declan McCullagh would have done
research before writing a letter to the new Asst. Sec. (who is
nothing close to final). For example, the position has never
been termed "cyberczar" officially it is simply one of those the
media created and others less affiliated with the activity have
kept.

First time I've seen his name associated with anything cyber
security related. Oh well, I guess everyone can make a few
mistakes the first couple time. Welcome to the community
McCullagh, you will catch on in time.

There is a good point in the letter, however, the lack of response
to any of the strategy recommendations from 2003. Not much
to show for and a lot of catching up to do.

.