Lawmakers lambasted the Homeland Security Department’s chief information officer last week for a host of cybersecurity vulnerabilities and breaches. But Scott Charbo, the target of the verbal attacks, stood his ground — promising that consolidation plans under way will make DHS’ systems more secure.
DHS reported 844 cybersecurity incidents in the past two fiscal years, some of which involved virus outbreaks and surreptitious installations of malware and passive hacking tools on DHS computers. Members of the House Homeland Security Committee’s Emerging Threats, Cybersecurity, and Science and Technology Subcommittee demanded to know why.
Charbo defended the agency’s security posture by saying that not all of those 844 incidents were serious ones. “No data exists within the department to support a position that any of the incidents recently reported by the department to Congress resulted in successful penetrations of our networks or that any mission was negatively impacted,” he said.
To fix remaining cybersecurity vulnerabilities, Charbo said, DHS would continue to consolidate many of its information technology systems. Officials plan, for example, to reduce eight wireless networks to one, consolidate numerous e-mail systems into one and close all but three data centers.
Subcommittee members said they were concerned that DHS spends less than 7 percent of its IT budget on cybersecurity. “The failure to invest in defensive measures and mitigate vulnerabilities is jeopardizing the department’s mission,” said Rep. Jim Langevin (D-R.I.), the subcommittee’s chairman.
Rep. Bennie Thompson (D-Miss.), the committee’s chairman, said he wanted Charbo’s office to be fully briefed on cybersecurity incidents, pointing out that Charbo was not told about international incidents. Charbo said he would try to get a better worldview of IT security.
Thompson got personal in his grilling of Charbo by criticizing him for not having “a strong background in IT.” He described Charbo’s management of computer security problems at DHS as “a Michael Brown situation,” a reference to the former director of the Federal Emergency Management Agency who was hounded out of office for his management of the Hurricane Katrina crisis.
A DHS official disagreed with Thompson’s characterization of Charbo.
“Scott Charbo is extremely qualified as a manager and leader, and he surrounds himself by the most technical and competent people in the IT community,” said the DHS official, who asked not to be named. “He knows technology, he knows how to manage and lead, and he knows what this department needs.”
Thompson carried his criticisms of Charbo outside the hearing room. In a June 22 interview on Federal News Radio, Thomspon again questioned Charbo’s qualifications. “He has a bachelor’s degree and a master’s degree in plant science,” Thompson said. “Had we had someone in that position with [an IT security] background, they probably could have found [those breaches] before outside investigators found them.”
