Lawmakers grill DHS’ CIO

Homeland Security Department’s Charbo promises that better security is on its way

Lawmakers lambasted the Homeland Security Department’s chief information officer last week for a host of cybersecurity vulnerabilities and breaches. But Scott Charbo, the target of the verbal attacks, stood his ground — promising that consolidation plans under way will make DHS’ systems more secure.

DHS reported 844 cybersecurity incidents in the past two fiscal years, some of which involved virus outbreaks and surreptitious installations of malware and passive hacking tools on DHS computers. Members of the House Homeland Security Committee’s Emerging Threats, Cybersecurity, and Science and Technology Subcommittee demanded to know why.

Charbo defended the agency’s security posture by saying that not all of those 844 incidents were serious ones. “No data exists within the department to support a position that any of the incidents recently reported by the department to Congress resulted in successful penetrations of our networks or that any mission was negatively impacted,” he said.

To fix remaining cybersecurity vulnerabilities, Charbo said, DHS would continue to consolidate many of its information technology systems. Officials plan, for example, to reduce eight wireless networks to one, consolidate numerous e-mail systems into one and close all but three data centers.

Subcommittee members said they were concerned that DHS spends less than 7 percent of its IT budget on cybersecurity. “The failure to invest in defensive measures and mitigate vulnerabilities is jeopardizing the department’s mission,” said Rep. Jim Langevin (D-R.I.), the subcommittee’s chairman.

Rep. Bennie Thompson (D-Miss.), the committee’s chairman, said he wanted Charbo’s office to be fully briefed on cybersecurity incidents, pointing out that Charbo was not told about international incidents. Charbo said he would try to get a better worldview of IT security.

Thompson got personal in his grilling of Charbo by criticizing him for not having “a strong background in IT.” He described Charbo’s management of computer security problems at DHS as “a Michael Brown situation,” a reference to the former director of the Federal Emergency Management Agency who was hounded out of office for his management of the Hurricane Katrina crisis.

A DHS official disagreed with Thompson’s characterization of Charbo.

“Scott Charbo is extremely qualified as a manager and leader, and he surrounds himself by the most technical and competent people in the IT community,” said the DHS official, who asked not to be named. “He knows technology, he knows how to manage and lead, and he knows what this department needs.”

Thompson carried his criticisms of Charbo outside the hearing room. In a June 22 interview on Federal News Radio, Thomspon again questioned Charbo’s qualifications. “He has a bachelor’s degree and a master’s degree in plant science,” Thompson said. “Had we had someone in that position with [an IT security] background, they probably could have found [those breaches] before outside investigators found them.”
Contractors on the loose?Some members of the House Emerging Threats, Cybersecurity, and Science and Technology Subcommittee questioned the Homeland Security Department’s use of contractors on systems for the U.S. Visitor and Immigrant Status Indicator Technology program, which tracks foreign visitors to the United States.

Rep. Bennie Thompson (D-Miss.) said he is concerned about whether contractors can simply walk into any DHS buildings and plug in a laptop PC to gain access to sensitive information.

Not to worry, said Scott Charbo, DHS’ chief information officer. Alarms would detect such an occurrence and countermeasures would prevent unauthorized access. Charbo tried to pacify lawmakers by assuring them that contractors undergo background checks before they are employed, and federal employees oversee their work.

However, Keith Rhodes, the Government Accountability Office’s chief technologist, said he had a different perspective. Contractors completely control some systems, including some used in the US-VISIT program. Contractors “have free reign,” he said.

— Wade-Hahn Chan


  • Budget
    Stock photo ID: 134176955 By Richard Cavalleri

    House passes stopgap spending bill

    The current appropriations bills are set to expire on Oct. 1; the bill now goes to the Senate where it is expected to pass.

  • Defense
    concept image of radio communication (DARPA)

    What to look for in DOD's coming spectrum strategy

    Interoperability, integration and JADC2 are likely to figure into an updated electromagnetic spectrum strategy expected soon from the Department of Defense.

Stay Connected