Congressman sees broader role for DHS in state and local cyber efforts
Connecting state and local government leaders
Rep. Will Hurd (R-Texas) says a reorganized "cyber infrastructure protection" division could serve as a valuable resource and central point of contact.
Cyberthreats are expanding and evolving at such a rate that many state and local governments are struggling to keep up. Rep. Will Hurd (R-Texas) would like to see the Department of Homeland Security do more to help.
"More conversations need to happen" between different layers of government, Hurd told GCN in an April 12 interview. When it comes to state and local leaders on cybersecurity, he said, "there are some that are more sophisticated than others. ... I think DHS can be a resource for those folks, and ensure they’re doing the right things."
Hurd, a computer science major and former CIA officer who now chairs the House Oversight and Government Reform Committee's IT Subcommittee, introduced the
State and Local Cyber Protection Act in 2015. That bill would require DHS' National Cybersecurity and Communications Integration Center to help state and local agencies identify both system vulnerabilities and possible protections, provide technical assistance to deploy continuous diagnostic and mitigation services as well as offer training to their personnel.
The bill has yet to see action in the Senate (the House passed it last December), but Hurd sees potential in other changes at DHS. The department is looking to reorganize its National Protections and Programs Directorate -- renaming it to Cyber Infrastructure Protection and cutting across current stovepipes of the National Cybersecurity and Communications Integration Center, the Office of Infrastructure Security and Federal Protective Services.
That change, Hurd said, would turn NPPD from an "administrative division" into an operational one. "I think that structure can make it easier to have a point for state and local to go to," he said.
And as the State and Local Cyber Protection Act proposes, DHS provides a cybersecurity services to federal agencies that could be made more broadly available to state and local governments. Hurd said, however, said he was in no rush to expand the customer base for Einstein or the Continuous Diagnostics and Mitigation program.
"More conversations need to happen," he said. "The first step is understanding what the need is out there. I don’t know what it is from a holistic perspective. I think that’s were DHS can start better understanding what this is."
Hurd said he'd like to see those conversations focus on critical infrastructure first, and he praised the progress that's been made on information sharing in the past few years. But he stressed that DHS, state and local agencies and critical infrastructure providers must take care to respect privacy concerns both real and perceived. (Hurd's bill explicitly outlines requirements for privacy and civil liberties training that DHS would provide.)
In a keynote address at the April 12 FireEye Government Forum on cyber resilience, Hurd said: "The last thing that you want is that the people you’re trying to protect are distrustful of you. ... We can protect our civil liberties while protecting our digital infrastructure and chasing bad guys."
"I know it’s hard," he said. "But the future of our republic depends on us pursuing those three goals simultaneously."
NEXT STORY: Government slow to mount defense against APTs