Kirsten Gillibrand Criticizes Pentagon For Cyber Confusion

Pentagon officials have acknowledged they must recruit more cyber experts to stop hackers from breaching their networks and stealing classified military data.

But they still don't know exactly how many experts they need because they have not created a clear definition of a cyber expert, assigning the title differently across the department, according to Sen. Kirsten Gillibrand (D-N.Y.).

In a strongly worded letter sent Thursday to Defense Secretary Leon Panetta, Gillibrand, a member of the Senate Armed Services Committee, said this confusion is preventing the military from recruiting enough troops for a potential cyber war.

"I continue to be concerned that the lack of cross-cutting, clear definitions of cyber personnel throughout the Defense Department is a significant hindrance to your ability to carry out this significant mission," Gillibrand wrote in the letter to Panetta, which was obtained by The Huffington Post.

The Pentagon has said it has about 90,000 people working on cyber issues, but that number includes IT employees who do maintenance on the department's 7 million computer devices. The exact number of military cyber experts is unclear, partly because the Pentagon uses the term "cyber" for some employees who are not engaged in fighting hackers, according to some experts.

"There are some people classified as 'cyber' who are just IT guys fixing hard drives," one Democratic Hill staffer said. "That's not what cybersecurity is about."

This uncertainty over what "cyber" means is "pervasive" across the Pentagon -- causing confusion not just with staffing, but also with equipment and funding -- and "gravely hampers your ability to build a strong and resilient cyber system," Gillibrand told Panetta in the letter.

She is not the only one to criticize the Pentagon for confusion over its cyber operations. A July report from the Government Accountability Office found "a lack of operational clarity significantly slowed down" the department's response to a 2008 data breach in which an infected flash drive was inserted into a laptop at a military base in the Middle East.

The GAO report also found that the Pentagon has not conducted a comprehensive assessment of cybersecurity gaps and that the meaning of a "cyber force" is not uniformly defined across the agency.

As the Pentagon has worked to increase the ranks of cyber experts, foreign hackers have targeted military computer networks with increased frequency, most notably stealing more than 24,000 files containing classified information this spring from the Defense Department.

Over the past few years, the Pentagon has reorganized itself to better address growing threats from foreign hackers, in particular launching the U.S. Cyber Command to take the lead role on cyber operations.

But concerns remain about a shortage of cyber experts. The National Security Agency, which plays a large role in the Pentagon's cyber efforts, has said it planned to hire about 1,500 people last year and another 1,500 this year. In August, officials from the Pentagon, among other federal officials, attended the DefCon hacker conference in Las Vegas in search of new recruits.

In June, Gillibrand proposed legislation that would direct the Pentagon to review its need for more cyber experts and to consider creating a "Cyber ROTC" to address the shortage.

"Given that our fundamental 'weapon' in the cyber arena is a talented, patriotic and well trained cyber expert, our ability to recruit, train and maintain cyber personnel is critical to this mission," Gillibrand wrote in the letter.

Comments

[IDmachines]

09:29 PM on 10/27/2011

OK so maybe not the Pentagon but elsewhere in the Federal Government particular the Chief Human Capitol Officers Council has done quite a bit. As an example take a look at:

http://www.chcoc.gov/transmittals/TransmittalDetails.aspx?TransmittalID=3436

Also look at the work at the National Institute of Standards where much or our computer security directives flow and their work on National Initiative Cybersecurity Education (NICE) http://www.nist.gov/itl/csd/nice.cfm

[geneandeddie59]

09:02 PM on 10/27/2011

The Pentagon will order up 1,500 new tanks, 500 F-35 fighter planes and 200 Predator drones to combat this new terrorist threat.

[Dunkleberger Karl]

03:54 AM on 10/28/2011

If it was NASA they would order 500,000 pizzas and 30 elemetery school kids to sing songs about defeating evil computers. while their teacher wanders the halls unsecured!

[chucksteaks]

03:38 PM on 10/27/2011

leave it to gilly to punch her 3" spikes right into the sweetish soft groin area!! AND STOMP ON IT! go girl, cuz the pentgong needs a morning headache. plus a bugle wake-up ! there are so many cyber warriors already in the milifairy ,the search komite do not have a sense of direction. send them to the schools and stop dicking around. if the schools do not want the milifairy there then send the cia,nsa,nrc,att,who ever and recruit the kids right after graduation.this is not brain surgery, but elements of the now-milifairy may need brain retraining!!god bless america and the gilly girl today.

[Dunkleberger Karl]

03:55 AM on 10/28/2011

Gilly Never wears heels, she is a freak for Nun shoes, her only fault!

[Radx28]

03:31 PM on 10/27/2011

Cmon now Kirsten! If they spend some of their 800 billion on real problems, it's going to 'p' off all of those Republican States with useless defense projects designed to keep their wick in the defense departments feeding trough!

[Kat Posing]

03:25 PM on 10/27/2011

As a person who's worked in IT for over 20 years, I can tell you, these people are probably clueless. They wouldn't know the difference between an systems analyst, deveveloper, network technician and quality engineer. All they would know, if asked is "They are the IT people"

Plus, if they are like most non-tech companies in the US, they are more concerned with the delivery date, calling a win for some political project that has nothing to do with the overall mission (no matter if it works as designed and/or per the project requirements), or the bottom line. Or they planned to outsource the project but the subcontractor couldn't deliver or the discovered there would be a problem outsourcing national security projects overseas (no, I'm not joking)

And, in most government positions, they don't listen to their people nor do they pay competative rates, which is why so few really talented people will work civil service. PLUS, they want really talented people to join the military to work for them? And, if they have the same attitude as the private sector, they aren't looking for the more experienced people either.

And finally, the REALLY talented people do their utter best to stay OFF the radar of the government, not go work for them, unless they accidentally got caught.

[DocturT]

03:17 PM on 10/27/2011

In June, Gillibrand proposed legislation that would direct the Pentagon to review its need for more cyber experts and to consider creating a "Cyber ROTC" to address the shortage."

Excellent. China has employed the same strategy and it seems to be working for them.

[helioszephyr]

03:09 PM on 10/27/2011

"... about 90,000 people working on cyber issues"

can't we replace some of the 90K with computers to reduce the deficit? I'm sure there an "app" that can take their place!

[Artanis71]

03:27 PM on 10/27/2011

I am hoping that is some bad joke, otherwise that just displays a massive lack of intelligence.

[Dunkleberger Karl]

03:56 AM on 10/28/2011

Helioszephyr: aka Needs to Buy a clue TRoll! thanks for playing, next time bring money!

[RTIII]

02:55 PM on 10/27/2011

A major part of the problem - language issues aside - is that the best and the brightest who could really do this aren't interested, and the COMPANIES that are interested in doing this are NOT interested in doing so in an efficient manner - AND they are - their management and decision makers are - mostly computer illiterates who have VERY impressive credentials.

I know, I've worked in this area.

If you REALLY want to screw it up, get the major Defense contractors involved, like SAIC, or CSC, etc. These guys are intersted only in the bottom line of their companies, and not in any form of efficiency.

Most of all, when problems happen, these guys either don't know they've been hacked, or they don't wsant to admit it because of fear of what happens through "the chain of command." ...The "chain of command" is a SERIOUS liability in a situation like this, greatly exacerbated by the fact that nearly none of those in the chain of command know a damned thing about computers.

[RTIII]

02:51 PM on 10/27/2011

-heavy-sigh-

What the reporter, Gilbrand, and likely a great many others involved don't seem to get is that "cyber" just means "computer." It has ZERO connection, in and of itself, to security. The author of this article seemed to pick up Gilbrand's misunderstanding of the word, too, further spreading mis-information.

If you mean computer secutity, "cybersecutity" is as good a word as any, but don't try to hi-jack the word - or prefix - "cyber" to mean cybersecurity or you're in for even more pain.

In short, DO NOT LET THE MILITARY RE-DEFINE LANGUAGE THEY KNOW NOTHING ABOUT! And don't let a Senator do it, either.

[El Cuervo]

02:44 PM on 10/27/2011

She's a hottie.

[chucksteaks]

03:41 PM on 10/27/2011

she is a demo-krap for brainz, when you get the chance listen to her speak/screech.

[drumz]

02:15 PM on 10/27/2011

Why would someone want to work for the government when they know the republicons would use them as political patsies trying to either reduce their wages and benefits or eliminate collective bargaining?

[jws2346]

02:13 PM on 10/27/2011

Huh? With all those very talented unemployed young people out there (and the very talented long in the tooth) I'm sure they can find some very expert people. (just like the government, lets make some more paperwork by having a long and laborious description to define the pedigree of a computer expert) Just do it already, before it gets closer to being impossible?

[RTIII]

10:22 AM on 10/29/2011

No, it's not "government" that's the problem here, it's "military."

[ramman]

01:35 PM on 10/27/2011

I watch a show on CNBC about cyber attacks earlier this week and I must say it does not look good guys as they showed what the major problems were here and around the world and most didn't have a remedy for them yet. A few very top experts were being interviewed and presented a grim out look for our nations cyber security if things don't change asap. China was one of the major problems where as it has for too many people hacking our systems to even keep up with. One man in China, one who was considered one of their top hackers talked about how he was given commission to lead a team of 10,000 hackers to get into our systems. One of our experts here said the biggest fear wasn't knowing they have gotten in our systems but not knowing what haven't they gotten from us in these cyber attacks. In other word we're so vulnerable we don't know what's truly been stolen.

[Dunkleberger Karl]

03:59 AM on 10/28/2011

Some times the cure is less not more! see dec 31st 23;59 and 59 seconds , vladavlastov Russia , and the whole world exhaled, and realized the IT guys just riped them off for about half a trillion dollars!

[Aarroonn Fleszar]

01:33 PM on 10/27/2011

I imagine the phone is ringing off the hook at the Pentagon with self proclaimed cyber hackers looking for employment.

[Mao Meow2]

01:31 PM on 10/27/2011

Cyber security experts are PR and sales people. You need people who have seen the movie Hackers and War Games and are able to frighten people with scary fantasy stories to get billion dollar budgets passed to fund their highly paid cushy jobs. It's the military industrial complex of the future.