Homeland Insecurity

It's interesting that our government is so concerned about homeland security that it does not mind bypassing secret courts to even more secretly eavesdrop on citizens, and yet it cannot seem to find the time, energy, and/or dollars to successfully bring its own agencies up to snuff security-wise.While The New York Times was polishing its report on secret, presidential-approved eavesdropping on U.S. citizens, another report was making the headlines last week on the beltway and in the tech press. The Cyber Security Industry Alliance, which includes big-name security companies such as Symantec, McAfee, and RSA blasted the government's progress in keeping the United States safe from cyberattacks.

Here we go again.

This is just nuts. In the past year, I've watched report after report record negative grades and mete out severe tongue-lashings to government agency after government department, posted in story upon story. When does this end?

Over the last several years we've watched the Homeland Security czar post become a revolving door as proponents struggle to give the position some visibility, meaning and authority.

Meanwhile, GAO report card after report cards slaps around our various government agencies--including Homeland Security--for earning low scores on security readiness.

Since this is the same government that has urged reluctant companies to report security breaches and the mostly privately owned national infrastructure to adhere to a standard level of security measures, it's a classic case of "do as I say, not as I do."

Now granted, the CSIA is a a security trade association--in other words, a bunch of vendors. And for all we know, they are really just peeved at not making their year-end sales quota. And if the government isn't working on its security shortcomings, there is probably some truth to that suspicion. But the fact is, as noted above, there is a boatload of evidence pointing to the same conclusion: Our government stinks at internal security.

Sticking the needle in a little deeper, the CSIA said its report, "National Agenda for Information Security in 2006," is a response to President Bush's "National Strategy To Secure Cyberspace," which was released in 2003.

As we all know, cyberspace ain't secure today, and it won't be anytime soon--if ever. (Speaking of which, are you up to speed on the latest worm plaguing the Internet byways?) But back to reality, it should be possible to batten down the hatches on government agency networks, laptops, and cell phones, at least enough to push those security grades out of the cellar and up toward a respectable B or, even better, an A. Some agencies have done it--the Department of Transportation, for one.

But when Homeland Security consistently takes a beating, it's beyond embarrassing. It should be worrisome.

The CSIA makes the point that Homeland Security is supposed to take over responsibility for cybersecurity from the White House, but complains the issue has been "lost ... constantly overwhelmed by other issues such as physical threats or event from overseas." This is all important stuff, but let's not forget that as a nation we are constantly pushing more and more of our data onto huge networks that are at least partially public. We've got public health-care initiatives, criminal databases, and information sharing between airports and various government agencies, to name just a few. Operations are becoming increasing automated. A successful cyberattack could have devastating consequences.

Yes, I know, a recent report from the FBI disses the ability of terrorists to mount serious cyberattacks and adds that the agency has so far not detected any plans to launch cyberattacks against major public institutions in the United States. But this is one agency, and its own record since 9/11 isn't so hot, especially when it comes to its own use of technology. And the Bush administration sure seems worried about a very real threat to the country. So what if the FBI is wrong?

Consider this: Hurricane Katrina gave us a taste of the chaos that will ensue if key personal records are lost and systems go down. Do we really want to wait until the bad guys are fully capable of launching a successful cyberattack? Now is the time to act. The government needs to step forward, get its own house in order, and take on that "strategic level" of leadership role that the CSIA and so many others rightly complain has been lacking.

If the threat of terrorism is so great that we need to infringe upon basic American civil liberties, then it stands to reason that securing the operations of key government agencies and departments should be a top priority, and the very least we could accomplish in the name of homeland security.