Lawmakers grill DHS’ CIO

Homeland Security Department’s Charbo promises that better security is on its way

Lawmakers lambasted the Homeland Security Department’s chief information officer last week for a host of cybersecurity vulnerabilities and breaches. But Scott Charbo, the target of the verbal attacks, stood his ground — promising that consolidation plans under way will make DHS’ systems more secure.

DHS reported 844 cybersecurity incidents in the past two fiscal years, some of which involved virus outbreaks and surreptitious installations of malware and passive hacking tools on DHS computers. Members of the House Homeland Security Committee’s Emerging Threats, Cybersecurity, and Science and Technology Subcommittee demanded to know why.

Charbo defended the agency’s security posture by saying that not all of those 844 incidents were serious ones. “No data exists within the department to support a position that any of the incidents recently reported by the department to Congress resulted in successful penetrations of our networks or that any mission was negatively impacted,” he said.

To fix remaining cybersecurity vulnerabilities, Charbo said, DHS would continue to consolidate many of its information technology systems. Officials plan, for example, to reduce eight wireless networks to one, consolidate numerous e-mail systems into one and close all but three data centers.

Subcommittee members said they were concerned that DHS spends less than 7 percent of its IT budget on cybersecurity. “The failure to invest in defensive measures and mitigate vulnerabilities is jeopardizing the department’s mission,” said Rep. Jim Langevin (D-R.I.), the subcommittee’s chairman.

Rep. Bennie Thompson (D-Miss.), the committee’s chairman, said he wanted Charbo’s office to be fully briefed on cybersecurity incidents, pointing out that Charbo was not told about international incidents. Charbo said he would try to get a better worldview of IT security.

Thompson got personal in his grilling of Charbo by criticizing him for not having “a strong background in IT.” He described Charbo’s management of computer security problems at DHS as “a Michael Brown situation,” a reference to the former director of the Federal Emergency Management Agency who was hounded out of office for his management of the Hurricane Katrina crisis.

A DHS official disagreed with Thompson’s characterization of Charbo.

“Scott Charbo is extremely qualified as a manager and leader, and he surrounds himself by the most technical and competent people in the IT community,” said the DHS official, who asked not to be named. “He knows technology, he knows how to manage and lead, and he knows what this department needs.”

Thompson carried his criticisms of Charbo outside the hearing room. In a June 22 interview on Federal News Radio, Thomspon again questioned Charbo’s qualifications. “He has a bachelor’s degree and a master’s degree in plant science,” Thompson said. “Had we had someone in that position with [an IT security] background, they probably could have found [those breaches] before outside investigators found them.”
Contractors on the loose?Some members of the House Emerging Threats, Cybersecurity, and Science and Technology Subcommittee questioned the Homeland Security Department’s use of contractors on systems for the U.S. Visitor and Immigrant Status Indicator Technology program, which tracks foreign visitors to the United States.

Rep. Bennie Thompson (D-Miss.) said he is concerned about whether contractors can simply walk into any DHS buildings and plug in a laptop PC to gain access to sensitive information.

Not to worry, said Scott Charbo, DHS’ chief information officer. Alarms would detect such an occurrence and countermeasures would prevent unauthorized access. Charbo tried to pacify lawmakers by assuring them that contractors undergo background checks before they are employed, and federal employees oversee their work.

However, Keith Rhodes, the Government Accountability Office’s chief technologist, said he had a different perspective. Contractors completely control some systems, including some used in the US-VISIT program. Contractors “have free reign,” he said.

— Wade-Hahn Chan

Featured

  • FCW PERSPECTIVES
    sensor network (agsandrew/Shutterstock.com)

    Are agencies really ready for EIS?

    The telecom contract has the potential to reinvent IT infrastructure, but finding the bandwidth to take full advantage could prove difficult.

  • People
    Dave Powner, GAO

    Dave Powner audits the state of federal IT

    The GAO director of information technology issues is leaving government after 16 years. On his way out the door, Dave Powner details how far govtech has come in the past two decades and flags the most critical issues he sees facing federal IT leaders.

  • FCW Illustration.  Original Images: Shutterstock, Airbnb

    Should federal contracting be more like Airbnb?

    Steve Kelman believes a lighter touch and a bit more trust could transform today's compliance culture.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.