Loss of top cyber officials spells challenge for Trump

The Trump administration has lost a handful of individuals serving in top cybersecurity roles across the federal government in recent weeks, even as it has struggled to fill high-ranking IT positions.

The developments present hurdles for the new administration and speak to the longstanding challenge the federal government faces in competing with the private sector for top tech talent.

Among those resigning is Richard Staropoli, a former U.S. Secret Service agent who served as chief information officer (CIO) of the Department of Homeland Security for just three months before announcing abruptly that he would leave.

{mosads}Staropoli, who as recently as June forecast big plans to reorganize the department’s information technology office, will officially leave the post at the start of September, turning the role over to his deputy on a temporary basis.

The Office of Personnel Management (OPM) is also about to lose its top IT official, with news that CIO Dave DeVries has resigned from his position and will leave in September after about a year on the job.

The OPM has been under intense scrutiny from lawmakers and others since 2015, when it was revealed that a breach of its data systems resulted in personal information on more than 21 million Americans being exposed to Chinese hackers.

A spokesperson for the agency confirmed DeVries’s resignation, which was first reported last week, attributing his decision to family considerations. OPM does not yet have information on who will serve as interim or acting CIO, the spokesperson said.

On Friday, the Navy will lose its CIO.

However, Rob Foster, who has served in the role for more than two years, is transitioning to another role in the federal government — moving to fill the deputy CIO role at the National Credit Union Administration.

The cybersecurity coordinator for former President Barack Obama’s White House said the administration can survive the turnover but that it could cause long-term problems.

“As a general rule, the immediate departure of a few individuals is not going to make a difference in the federal government’s overall vulnerability over the short term,” said Obama cybersecurity coordinator Michael Daniel.

“When you have personnel vacancies at the top, the impact is felt on long-term cybersecurity efforts and incident response,” he said. “For the first, you don’t have someone to drive the needed policy changes and oversee implementation. For the second, you don’t have a leader to manage the response efforts.”

The Environmental Protection Agency’s chief information security officer (CISO) is also reportedly stepping down this month. Sean Kelley, who has been on the job since January, is said to be taking a position at the IT and defense company Leidos. The agency did not return a request for confirmation of his resignation.

Experts say the longer these positions remain unfilled, the tougher it will be to enact policy changes, including those laid out in President Trump’s executive order on strengthening cybersecurity signed in May.

“It can really paralyze an organization until new leadership [arrives],” said James Norton, who served in a cybersecurity role at the Department of Homeland Security during the George W. Bush administration.

Specific authorities of CIOs range from agency to agency, though they are broadly tasked with overseeing policy and security decisions when it comes to their individual government body’s IT infrastructure. Some CIOs are political appointments, while others are not.

Several occupants of these positions are currently serving on an acting basis, including those at the departments of Commerce, Transportation and Veterans Affairs and the Environmental Protection Agency.

“It is definitely incumbent on the administration to have every position filled by the end of the year,” said Norton. “If they’re not able to do that, I think that’s troubling.”

Trump has made some progress filling federal cybersecurity-related roles. White House homeland security adviser Tom Bossert, on board since the start of the administration, is widely credited with spearheading Trump’s cybersecurity executive order. The administration has also brought on Rob Joyce, a former National Security Agency official, to manage the federal government’s cybersecurity policy efforts at the National Security Council.

However, the administration has yet to permanently fill the roles of federal CIO and federal CISO within the Office of Management and Budget. Grant Schneider, the deputy federal CISO, has been filling the role of acting federal CISO since his boss left in January. Politico reported last week that Schneider will also fulfill a cybersecurity role at the NSC in the interim, taking on two jobs at once.

The White House is also said to have fired the CISO for the Executive Office of the President, Cory Louie, back in February.

Jason Healey, a cybersecurity expert and senior research scholar at Columbia University’s School for International and Public Affairs, noted other “critical” cybersecurity job openings across the government, including the recently vacated cybersecurity diplomacy coordinator role at the State Department.

“The loss of these senior officials is not promising, of course. But they’re generally only looking after their own agencies, not the larger federal enterprise or national cybersecurity,” Healey said of the recent departures in an email. “I’m most concerned that two of them had only recently joined will send danger signals for talented people looking who might want to serve in government.”

CIOs encompass just one of several leading technology roles in the federal government, a growing group that also includes CISOs, chief technology officers, chief data officers and chief innovation officers. The federal IT workforce encompasses more than 80,000 individual employees.

The federal government has long faced a challenge of competing with the private sector to recruit and retain top-tier tech talent.

But Daniel, the Obama cyber czar, surmised that the Trump administration could face an even tougher recruitment challenge because of its lack of organization and the perception of a White House embroiled in chaos.

“I suspect that has very little to do why an individual CIO at an agency might leave, but it certainly is going to add to their recruiting challenges,” Daniel, who is currently president of the Cyber Threat Alliance, said.

“It’s a challenge in any administration, and that’s if you have a big apparatus ready to go,” Daniel said. “If you don’t have that, it makes it even more challenging.”