Homeland Security fills top cybersecurity post

More than a year after Homeland Security Secretary Michael Chertoff publicly promised to bring in a top cybersecurity specialist, he finally hired one.

Chertoff said on Monday that Gregory Garcia, who has been working at a Washington-area trade association, would become the department's first assistant secretary for cybersecurity, with responsibility for advising agencies and the private sector.

Gregory Garcia

The announcement ends a vacancy at Homeland Security that lasted more than 14 months and a wait that drew criticism from members of Congress, who it said demonstrated that Chertoff has not taken the topic seriously.

"Quite simply, our nation has been without adequate leadership on cybersecurity," Rep. Zoe Lofgren, a Democrat, wrote in an opinion article that CNET News.com published in July. Republicans have also recently criticized Homeland Security's cybersecurity efforts, and a series of government reports has painted a picture of bureaucratic ineptitude.

Chertoff acknowledged last year that he had "initial concerns" about raising the profile of cybersecurity in a bureaucratic culture that had focused on physical threats since Sept. 11, 2001. It took a formal vote last May in the U.S. House of Representatives to create the position--and an expected one in the Senate--to prompt Chertoff to acquiesce two months later.

Garcia, who prior to accepting his new position was a vice president at the Information Technology Association of America, will succeed Donald "Andy" Purdy Jr., a two-year contract employee on loan from Carnegie Mellon University. Purdy, who has been criticized for taking the job of running a department that awarded at least $19 million in contracts to his university employer this year, was the acting cybersecurity chief.

It's not clear what took Homeland Security so long to fill the job, but some industry watchers have characterized it as having high-profile responsibility but little day-to-day authority over either the federal government or the private sector. (Johns Hopkins University Professor Avi Rubin said: "I sure wouldn't take that job--it only has a downside.")

In an appearance before Congress, Chertoff said last year that the assistant secretary "should not sit at the center of all federal agencies and direct and control their policies on information sharing and cybersecurity."

Washington veterans who know Garcia applauded Monday's announcement. It's "a year late but a positive development," said Shannon Kellogg, director of government and industry affairs for RSA, the security division of EMC. "To me, it's worth the wait. They really have someone who can get the job done."

Previous cybersecurity "czars" have been, besides Purdy, Richard Clarke, a veteran of the Clinton and first Bush administrations who left the post with a lucrative book deal. Clarke effectively was succeeded in quick succession by Howard Schmidt, also known for testifying in favor of the Communications Decency Act, then Amit Yoran and Robert Liscouski.

Garcia will join an already complicated and sprawling hierarchy at the Department of Homeland Security. There's also an undersecretary for management, an undersecretary for science and technology, an assistant secretary for policy, an undersecretary for preparedness, an assistant secretary for intelligence and analysis, and assistant secretary for legislative affairs, an assistant secretary for public affairs, an assistant secretary for transportation security, an assistant secretary for immigration and customs, and an undersecretary for FEMA.

That's not counting a multitude of directors and commissioners (including the head of the U.S. Secret Service) who also report to Chertoff (click here for PDF of a departmental organizational chart).

[mstrhypno]

Cyberczar' job - what IS it?

Chertoff said last year that the assistant secretary "should not sit
at the center of all federal agencies and direct and control their
policies on information sharing and cybersecurity."

Then what IS he supposed to do? Sit in his office and play
Minesweeper?

Somebody had better start putting together a comprehensive
cybersecurity and information program - AT LEAST for our
emergency response agencies, if nothing else!

Lee Darrow, C.H.

[Seaspray0]

Shhh, it's secret

step one: make sure your job description is secure from prying eyes.

[marileev]

What's the Plan Garcia?

Now that the position's been filled, what's the plan? With finally filling the post, I hope Homeland Security hasn't been just twiddling its thumbs to get a list of needs for Mr. Garcia. As "first assistant secretary for cybersecurity, with responsibility for advising agencies and the private sector," he doesn't exactly have the luxury of moving into the position without knowing what the pressing national security needs are.

But in case you need help, making sure government secrets and plans don't escape should be a priority http://www.essentialsecurity.com/news.htm?id=93

You may want to make sure certain branches of the government aren't leaking confidential dossiers, just a thought http://www.iwantmyess.com/?p=81

[missingamerica]

Wonder why Garcia was chosen? The ITAA line of H1Bs...

Read the ITAA policy statement about H1B visas at http://www.itaa.org/policy/immigration/. Very pro H1B...looks like they'll be offshoring homeland security, too.

[pritchet1]

Replacement Systems?

First order of the day - replace all those non-Mac machines within the Homeland Security environment and maybe they won't be given an "F" rating next round.

[Seaspray0]

Replace the coffee pot?

Where do you put the grounds and water on a Mac? I've already found the cup holder.